New blog articles in Microsoft Community Hub

Beyond the Canvas: The Azure Architecture Diagram Builder Becomes Agent-Ready

arturoqu — Fri, 10 Jul 2026 21:40:06 GMT

AZURE ARCHITECTURE BLOG · 8 MIN READ

Author: Arturo Quiroga, Senior Partner Solutions Architect — Microsoft

Two months ago I published From Prompt to Production: Building Azure Architecture Diagrams with AI, introducing the open-source Azure Architecture Diagram Builder. The response was humbling — thousands of you read it, tried the tool, and filed issues and feature requests. A follow-up on how the Well-Architected Framework scoring works went deep on validation.

You asked, and the tool grew. This post is about what’s new since May — and one change big enough to reframe the whole project: the Azure Architecture Diagram Builder is no longer just an app you click. It’s a partner you chat with, and a tool other agents can call.

TL;DR. Three arcs of new capability: (1) Architecture Chat turns diagram design into a multi-turn conversation over the live canvas; (2) Blueprint Diagrams produce hand-drawn, whiteboard-style deliverables alongside the formal topology; and (3) the app now exposes its capabilities as a Model Context Protocol (MCP) server, so AI agents can generate, validate, cost, and render Azure architectures programmatically. Plus a 13-model fleet, deployment guides grounded in Microsoft Learn, and July output enhancements.

What’s new at a glance

Capability	What it does
Architecture Chat	Refine a diagram by conversation — “add Front Door with WAF,” then“now make it zone-redundant.” Each turn reads the live canvas and auto-saves to history.
Blueprint Diagrams (BETA)	Hand-drawn, whiteboard-style renders with nested zones and numbered flow arrows. Topology, Blueprint, or Both.
A fleet of 13 models	Multi-provider roster — GPT-5.x, DeepSeek, Grok, Mistral, and Kimi — with side-by-side comparison to pick the right brain per task.
MCP server	The app is now a remote MCP server. Agents can list_services, validate_architecture, estimate_costs, generate_bicep and render_diagram with typed, structured outputs.
Microsoft Learn grounding	Deployment guides now cite live Microsoft Learn documentation.
Output enhancements (July 2026)	Cost badges, light/dark render themes, and metadata panels in rendered diagrams.

From clicking to conversing: Architecture Chat

The single most common request after the launch post was some version of “I love the first diagram, but I want to iterate without re-writing the whole prompt.” Regenerating from scratch every time you tweak a requirement is slow and loses context.

Architecture Chat solves this. It’s a conversational panel that sits alongside the canvas and treats your diagram as a living document. Each message is a turn in an ongoing design session:

“Add an Azure Front Door with WAF in front of the app tier.”
“Now make the data layer zone-redundant.”
“Swap the SQL Database for Cosmos DB and update the connections.”

Every turn reads the current state of the canvas — not the original prompt — so refinements compound naturally the way they would with a human architect at a whiteboard. The conversation auto-saves to history, so you can step back through the evolution of a design or branch from an earlier point.

Figure 1. Architecture Chat treats the diagram as a living document. Each message refines the current canvas — adding services, changing SKUs, or reorganizing groups — and the full exchange is saved to history.

The shift is subtle but important: architecture design stops being a one-shot prompt and becomes an iterative dialogue.

The whiteboard deliverable: Blueprint Diagrams (BETA)

Formal topology diagrams with official Azure icons are perfect for documentation and stakeholder decks. But early-stage design conversations often want something looser — the hand-drawn feel of a whiteboard sketch that communicates intent without implying finality.

Blueprint Diagrams generate exactly that: a whiteboard-style render with nested zones (subscription → VNet → subnet), numbered flow arrows, and a deliberately sketchy aesthetic. You choose the output mode:

Topology — the formal, icon-based diagram from the launch post
Blueprint — the hand-drawn whiteboard style
Both — generate the two side by side

Figure 2. The same architecture in two visual languages. Left: the formal, icon-based topology. Right: Blueprint mode — a whiteboard-style render with nested zones and numbered flow steps, plus a numbered legend explaining each hop. Use Blueprint for early design conversations and Topology for final documentation.

It’s the same underlying architecture — two visual languages for two different moments in the design lifecycle.

A fleet of 13 models: pick the right brain per task

The launch post shipped with multi-model support. That fleet has grown to 13 models across five providers, so you can match the model to the job — fast models for iteration, reasoning models for complex designs, code-optimized models for Bicep generation:

OpenAI GPT-5.x — GPT-5.1, GPT-5.2, GPT-5.2 Codex, GPT-5.3 Codex, GPT-5.4, GPT-5.4 Mini
DeepSeek — V3.2 Speciale, V4 Pro
xAI Grok — 4.1 Fast, 4.3
Mistral — Large 3
MoonshotAI Kimi — K2.5, K2.7 Code

The Compare Models feature runs the same prompt through any subset of these in parallel and ranks them on service count, token usage, latency, and cost — with Fastest / Cheapest / Most Thorough badges — so you can make an evidence-based choice rather than a guess.

Figure 3. Multi-model comparison across the full 13-model fleet. Top: the results grid ranks every model on service count, connections, token usage, latency, and cost, with Fastest / Cheapest / Most Thorough badges. Bottom: an optional AI Critique uses a critic model to rank the outputs and explain each model’s strengths and gaps.

Adding a model is now a small, well-understood change — a testament to how the multi-provider abstraction has matured since May.

The headline: the Diagram Builder is now an MCP server

Here’s the change that reframes the project. Everything above is about a person using a web app. But the same capabilities — generating a diagram, validating it against WAF, estimating its cost, producing Bicep — are exactly the things an AI agent needs when it reasons about Azure architecture.

So we exposed them. The Azure Architecture Diagram Builder now runs as a Model Context Protocol (MCP) server. Any MCP-capable agent can call its tools with typed inputs and structured outputs:

Tool	What the agent gets
`list_services`	The catalog of supported Azure services and categories
`validate_architecture`	A WAF assessment with pillar scores and findings
`estimate_costs`	Multi-region cost estimates from the Azure Retail Prices API
`generate_bicep`	Infrastructure-as-Code templates for the design
`render_diagram`	A rendered diagram (topology or blueprint) of the architecture

This means an agent can hold a conversation like “design a HIPAA-compliant platform, check it against the Well-Architected Framework, tell me the monthly cost in West Europe, and give me the Bicep” — and the Diagram Builder answers each part programmatically, returning structured data the agent can reason over and chain.

Figure 4. The Diagram Builder as an MCP server inside Microsoft Scout. Top: from a natural-language request, the agent calls the render_diagram tool with structured parameters (title, format, direction, theme, region) and saves the returned SVG to its workspace. Bottom: the rendered architecture — grouped zones, labeled flows, and cost badges — appears inline in the conversation, generated entirely through agent tool calls.

The tool that started as a canvas for humans is now also a building block for agents. That’s the arc: from an app you click, to a partner you chat with, to a tool other agents call.

Grounded in Microsoft Learn, and sharper output

Two smaller-but-meaningful improvements round out the release:

Microsoft Learn grounding. Deployment guides now search official Microsoft Learn documentation at generation time and cite it, so the guidance reflects current, authoritative practice rather than a model’s training snapshot.
Output enhancements (July 2026). Rendered diagrams now carry per-service cost badges, support light and dark render themes, and include metadata panels that summarize the architecture — service counts, regions, and estimated cost — directly on the image.

Highlights

Since the May launch, the Azure Architecture Diagram Builder has grown from a design tool into an agent-ready platform:

Conversational design: iterate on a diagram by chatting over the live canvas, with full history
Two visual languages: formal topology and hand-drawn Blueprint, from the same architecture
13 models, five providers: choose the right brain per task, with evidence-based comparison
Agent-ready: an MCP server exposing generation, validation, costing, and IaC as callable tools
Grounded guidance: deployment guides cite live Microsoft Learn documentation
Still open source: every capability above is available to inspect, extend, and contribute to

Try It Today

Live demo: https://aka.ms/diagram-builder
Source code: GitHub repository
Documentation: See the Getting Started Guide for setup, and the repository’s MCP server directory for agent integration.

If you read the first post and tried the tool — thank you. The features above exist because you told me what you needed. Keep the feedback coming via GitHub Issues.

Tags: artificial intelligence · application · apps & devops · well architected · infrastructure

Azure Front Door: Resiliency Series – Part 3: Tenant isolation

AbhishekTiwari — Fri, 10 Jul 2026 22:08:29 GMT

Abhishek Tiwari, Vice President of Engineering, Azure Networking
Amit Srivastava, Partner Director of PM, Azure Networking
Varun Chawla, Partner Director of Engineering, Azure Networking

Azure Front Door serves hundreds of thousands of tenants from hundreds of edge locations, densely sharing the globally distributed edge fleet. That density is exactly what allows us to deliver global scale, performance, and cost efficiency. It also means that, without strong isolation, a single tenant’s incompatible configuration or anomalous traffic can, in the worst case, affect many other tenants. The October 2025 incidents reinforced how important it is to contain this class of risk. Our goal for this tenant isolation is simple to state and hard to achieve: no single tenant’s configuration or traffic should be able to impact any other tenant.

In Part 1 of our three part mini blog series, we outlined our four‑pillar strategy for improving the resiliency of Azure Front Door: configuration resiliency, data plane resiliency, tenant isolation, and accelerated Recovery Time Objective (RTO). Part 1 detailed how we would make configuration propagation safer and how the data plane keeps serving from a ‘last‑known‑good’ (LKG) configuration, even if an incompatible configuration change is propagated to the data plane. Part 2 turned to recovery, showing how we bring the system back to full operation in an accelerated, predictable, and in a bounded timeframe. In this final part, we turn to the tenant isolation pillar that ensures that any single tenant configuration or traffic issues are limited in scope to that tenant alone and do not impact other tenants. We will also show how Azure Front Door achieves single-tenant containment through configuration isolation, lazy loading, and a micro-cellular layered ingress-sharding architecture.

Repair status: all outstanding items now complete

Before we dive into tenant isolation, here is a final update on the overall repair items from the two October 2025 incidents (you can review the details in our Azure Incident Retrospective sessions for the October 9th and October 29th incidents). We are pleased to report that all outstanding work across every pillar is now complete and fully deployed in production – including the tenant isolation work described in this post. With these safeguards in place, we have also returned configuration propagation latency to pre‑incident levels while keeping platform stability our top priority. In the table below, “Completed” means broadly deployed in production.

Learning category	Goal	Repairs	Status
Safe customer configuration deployment	Incompatible configuration never propagates beyond ‘EUAP or canary regions’	Control plane and data plane defect fixes; forced synchronous configuration processing; additional stages with extended bake time; early detection of crash state	Completed
Data plane resiliency	Configuration processing cannot impact data plane availability	Manage data‑plane lifecycle to prevent outages caused by configuration‑processing defects; isolated work‑process in every data plane server to process and load the configuration	Completed
100% Azure Front Door resiliency posture for Microsoft internal services	Microsoft operates an isolated, independent Active/Active fleet with automatic failover for critical Azure services	Phase 1: onboarded critical services batch impacted on Oct 29th outage running on a day‑old configuration; Phase 2: automation & hardening of operations, auto‑failover and self‑management of onboarding for additional services	Completed
Recovery improvements	Data plane crash recovery in under 10 minutes	Data plane boot‑up time optimized via local cache; recovery time accelerated to under 10 minutes	Completed
Tenant isolation	No configuration or traffic regression can impact other tenants	Micro‑cellular Azure Front Door with ingress layered shards	Completed

Why isolation at edge scale is deceptively hard

Traditional isolation techniques such as dedicating separate hardware to each tenant or running every tenant inside its own virtual machine are impractical at the edge. Edge sites are constrained on space, power, and capacity. The entire premise of a modern, multi-tenant application delivery platform is that any tenant can be served from any site closest to the user. We cannot simply partition hundreds of thousands of tenants onto dedicated machines without giving up either proximity, scale, or the efficiency that make the edge fast and cost efficient. Isolation therefore, must be achieved in software, inside a multi-tenant fleet.

What we already do today

Azure Front Door already includes several layers of tenant isolation and partitioning. However, the incidents in October clearly highlighted that these techniques were not enough. Prior to the incidents, our protection mechanisms included:

Infrastructure partitioning. Edge sites were organized into physically isolated primary and fallback traffic rings.
Noisy‑neighbor protection. Fair‑share resource allocation, rate limiting, and anomaly-based load protection kept any single tenant from monopolizing shared resources such as CPU, memory, or network bandwidth on an Azure Front Door server.
Circuit breakers. Circuit breakers shed costly work first and can disable a risky per‑tenant feature before it exhausts shared resources on a server.
Real‑time crash protection. A crash‑analysis system correlates crash signatures across machines and can pinpoint and block crash patterns caused by tenant IPs or traffic patterns.

While these protections are valuable, many of them are reactive and proved insufficient during the October incidents. The next generation of isolation makes single‑tenant containment a fundamental part of the platform which governs how configurations are loaded, and how traffic is served.

Configuration isolation: loading only what is needed

Part 2 introduced ‘lazy loading’ as a recovery optimization technique. It is also an important configuration‑isolation mechanism. Historically, every worker on every edge server had to be ready to serve any tenant, which meant each worker loaded a large set of tenant configurations. A single incompatible configuration could therefore ripple across many workers.

With lazy loading, a worker loads a tenant’s configuration and its TLS certificates only when it actually receives traffic for that tenant. The practical consequence for isolation is powerful: a faulty configuration can only affect the workers that have loaded that specific tenant, never the entire server or fleet. Combined with per‑tenant validation on load, and the Food Taster safeguard from Part 1 (a sacrificial process that pretests every configuration change in isolation), configuration problems are caught early and contained to the smallest possible footprint.

Figure 1: With lazy loading, an incompatible configuration is contained to the workers serving that tenant, instead of poisoning the whole server.

Tenant isolation: a micro-cellular, layered ingress sharding architecture

Configuration isolation limits the blast radius of an incompatible configuration. Traffic isolation addresses the other half of the problem: a tenant whose anomalous traffic incident, like a sudden surge, a pathological request pattern, or malicious activity, could degrade a shared worker. Our approach is a micro‑cellular architecture that combines multiple concepts working together.

Worker‑process isolation. Each edge server already runs many independent worker processes. Instead of letting every worker serve every tenant, we assign tenants to specific groups of workers. Those worker group (shards) become the unit of isolation: if a tenant destabilizes its shard, the impact is contained to that shard’s workers while the rest of the server keeps serving normally.
Ingress sharding. Rather than a handful of fixed shards, we compose shards from overlapping subsets of a server’s workers. Even a modest number of workers can be combined into an enormous number of distinct, overlapping shards – giving us a very large number of fine‑grained fault domains without dedicating hardware to every tenant.

Figure 2: Tenants are randomly assigned to different shards on each server (layer). Even when a good tenant shares the noisy tenant’s shard on one layer, routing steers its traffic to healthy shards on the others.

Multi‑layer ingress sharding. This is where ‘layered’ comes in. Each edge server is treated as an independent layer, and each tenant is assigned to a different, randomly chosen shard on every server. Because assignments are independent from one server to the next, two tenants that happen to share a shard on one server are extremely unlikely to share a shard again on another server. The chance of any good tenant repeatedly colliding with a noisy tenant across many servers becomes vanishingly small.
Intelligent ingress routing. Tying it together is a routing layer that terminates each incoming connection, identifies the tenant, and steers the request to that tenant’s assigned, healthy shard. If a shard is unhealthy or saturated, traffic is directed to the tenant’s healthy shards on other layers.

Figure 3: Intelligent Ingress Routing

The combined effect is that when a noisy tenant overwhelms or crashes its shard on one server, only that shard is affected. Because every other tenant is spread across a different, randomized set of shards, they continue to find healthy paths, and the routing layer moves their traffic accordingly. A worst-case availability problem is downgraded to, at most, a small and redistributable capacity problem, that the routing layer smooths over.

An in-depth technical analysis of layered ingress sharding is available here for reference.

Shrinking the blast radius

Taken together, these mechanisms fundamentally change the shape of failure. In a uniform, fully shared fleet, an incompatible tenant can, in the worst case, affect a large share of the tenants on a machine, in an edge location, or beyond. With configuration isolation and layered ingress sharding, the same failure is confined to a subset of workers serving the offending tenant. Our target for this tenant isolation pillar is effectively single‑tenant containment: a configuration or traffic anomaly caused by one tenant should never cause issues to any other tenants.

Figure 4: From a shared fleet where a single tenant can affect many, to micro‑cellular shards that confine impact to the offending tenant.

Validating isolation in practice

As with our recovery work, we don’t simply design these boundaries and assume they hold, we test them. Through deliberate fault‑injections, we have pushed noisy and faulty tenants into the system and confirmed that impact stayed contained to the offending shard, that healthy tenants kept serving, and that the routing layer steered around unhealthy shards as intended. This turns isolation from a design claim into a well-drilled, and repeatable outcome.

Closing

This post concludes our three-part mini blog series on Azure Front Door resiliency. We have shared how we are making configuration propagation safer (Part 1), recovering faster when failures do occur (Part 2), and containing the blast radius stemming from any single tenant through configuration isolation and a micro‑cellular, layered‑sharding architecture (Part 3).

Resiliency, however, is not a project with an end date. It is an ongoing commitment. While this series concludes the blog series of our response to the October 2025 incidents, our investments in Azure Front Door’s resiliency, isolation, and recovery will continue. As we make further improvements, we will keep sharing them with you.

We deeply value our customers’ trust in Azure Front Door. We remain committed to exceeding expectations for security, reliability, and transparency.

Welcome Back to AZ Update

Pierre_Roman — Fri, 10 Jul 2026 20:20:19 GMT

Hello Folks!

Welcome Back to AZ Update

A few years ago, Antony Bartolo and I launched a simple idea called AZ Update.

The goal was to provide a place where IT professionals could quickly understand what was changing in Azure, why it mattered, and what they should pay attention to next. The show became a weekly conversation focused on Azure news, infrastructure, operations, security, and the real-world impact of Microsoft's latest cloud updates.

Today, Azure is moving faster than ever.

Every week brings new services, platform capabilities, operational improvements, AI innovations, and architectural guidance. Keeping up is a full-time job. Most of us don't have time to read every blog post, release note, announcement, and documentation update.

That's why I'm bringing AZ Update back.

This time, as a weekly LinkedIn newsletter and this blog. To be completely transparent I am using an AI Agent to parse the update list for any in the last 7 days, filter for Infra/Ops content and research product docs and help with the draft. I do review content and write the post myself.

Each edition will cut through the noise and focus on what matters most for cloud architects, platform engineers, infrastructure teams, SREs, security professionals, and IT operators. I'll share the Azure announcements worth your attention, explain why they're important, highlight practical implications, and point you to the resources that can help you go deeper.

Just a concise weekly briefing from one ITPro to another.

If your day-to-day involves building, operating, securing, or modernizing infrastructure in Azure, Azure Arc, AKS, hybrid environments, or the growing world of AI-powered operations, this newsletter is for you.

Welcome to the next chapter of AZ Update.

Here is week 1!

This week’s Azure infrastructure updates bring practical operational gains for security, platform reliability, disaster recovery, and identity-driven access control. Here is a detailed ITPro breakdown with implementation guidance you can use in production planning.

Update #1 - Generally Available: Network Security Perimeter support for Azure Event Hubs
Update #2 - Generally Available: Confidential Computing support for Azure Event Hubs Dedicated
Update #3 - Generally Available: Support 5x churn in Azure Site Recovery
Update #4 - Generally Available: Microsoft Entra ID-based access for Azure Blob Storage SFTP

Update #1 - Generally Available: Network Security Perimeter support for Azure Event Hubs

Why ITPros should care

Network Security Perimeter for Event Hubs changes how ITPros enforce connectivity boundaries around mission-critical event pipelines. Instead of depending only on isolated firewall rules per namespace, you can apply perimeter-aware controls that are easier to govern consistently across multiple services.

From an operations perspective, this is a service-level hardening improvement. It helps reduce accidental exposure and supports better audit conversations when security teams ask for clear evidence of allowed and denied paths.

Operational value

The operational value is stronger day-two control. You can standardise network access policy patterns for producer and consumer applications, reduce policy drift, and simplify incident investigations when unexpected traffic appears.

For production rollout, validate all dependencies first: private endpoints, DNS resolution, trusted service exceptions, managed identities, and cross-subscription network paths.

Real-world example with step-by-step guidance

Inventory current producer and consumer traffic flows, including private endpoints, DNS zones, and any trusted service allowances.
Deploy a pilot Event Hubs namespace with perimeter controls in non-production and mirror realistic ingestion and consumption traffic.
Apply least-privilege inbound and outbound perimeter rules, then execute end-to-end send/receive tests with representative message volume.
Review diagnostic logs for denies, refine exceptions only where business-justified, and capture evidence for change management.
Promote to production in stages with a rollback plan that restores previous network policy if message flow health degrades.

Technical details including code examples

Use the following sequence when validating that perimeter onboarding did not break data plane operations. The first command confirms your active Azure context, the second verifies endpoint reachability, and the third validates Event Hub metadata retrieval.

Run this safely in a test window before production enforcement. If connectivity and control-plane checks pass in test, repeat with production namespace read-only checks before enabling stricter policies.

az account show --output table Test-NetConnection <namespace>.servicebus.windows.net -Port 5671 az eventhubs eventhub show --resource-group <rg> --namespace-name <namespace> --name <eventhub> --output table

Expected outcome: TCP probe to port 5671 succeeds, and Event Hub metadata query returns without auth or network timeout errors. If probe fails, check DNS, NSGs, route tables, private endpoint linkage, and perimeter rule assignment scope.

Comprehensive Resources

Update #2 - Generally Available: Confidential Computing support for Azure Event Hubs Dedicated

Why ITPros should care

Confidential Computing support for Event Hubs Dedicated matters when ITPros operate regulated or high-sensitivity event streams. It extends protection expectations beyond encryption at rest and in transit, into stronger assurances during processing.

Compared with older architectures, this reduces the need for some compensating controls and helps security and operations teams align on platform-native protections for streaming workloads.

Operational value

Operationally, this strengthens trust boundaries for event ingestion platforms that feed analytics, SIEM, and business-critical automation. It also improves evidence posture for compliance reviews where data handling controls must be demonstrated end to end.

Before rollout, validate throughput impact, partition behaviour, client compatibility, and observability baselines so confidentiality controls do not create unexpected SLO regressions.

Real-world example with step-by-step guidance

Classify Event Hubs namespaces by sensitivity and select the first dedicated environment where enhanced confidentiality requirements apply.
Enable and validate in non-production with representative producer and consumer load, including peak and burst patterns.
Measure latency, throughput, and throttling trends before and after enablement to confirm workload behaviour remains acceptable.
Capture attestation and configuration evidence required by internal security governance or external auditors.
Roll out in waves by workload criticality, with rollback criteria tied to message latency, error rates, and throttling thresholds.

Technical details including code examples

This validation example confirms namespace details and metrics health so you can compare baseline vs post-change behaviour. The metrics query focuses on ingestion, egress, and throttling signals that commonly surface operational risk first.

Run with a least-privileged operations identity that can read namespace configuration and metrics. Avoid making unrelated changes while collecting baseline evidence.

az eventhubs namespace show --resource-group <rg> --name <namespace> --output jsonc az monitor metrics list --resource /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.EventHub/namespaces/<namespace> --metric IncomingMessages OutgoingMessages ThrottledRequests --interval PT5M az account show --query user.name -o tsv

Expected outcome: namespace query succeeds, metrics return consistently, and no abnormal throttling spike appears after control changes. If results diverge, review dedicated capacity planning, partition strategy, RBAC scope, and workload profile fidelity.

Comprehensive Resources

Update #3 - Generally Available: Support 5x churn in Azure Site Recovery

Why ITPros should care

Higher churn support in Azure Site Recovery is directly relevant for ITPros protecting write-intensive systems. It expands what can be replicated reliably, reducing DR exceptions for fast-changing workloads.

Compared with the previous operational envelope, this gives more room for modern transactional applications while still requiring disciplined capacity and replication health management.

Operational value

Operational value is improved DR coverage and better alignment between production write behaviour and recovery plans. Teams can protect more workloads without bespoke workaround architecture.

For production rollout, validate process server sizing, bandwidth headroom, cache storage performance, and sustained replication lag during peak change windows.

Real-world example with step-by-step guidance

Baseline current churn and replication lag for candidate workloads to identify which systems benefit most from the increased support.
Enable replication in a pilot for one high-churn workload and observe initial seeding and steady-state health.
Run test failover and reprotect to verify recovery objectives and operational runbook completeness.
Tune bandwidth and cache settings if lag increases during peak write intervals or backup overlap windows.
Onboard additional workloads incrementally and use replication health gates before each expansion wave.

Technical details including code examples

These commands are relevant for validating actual recovery readiness instead of configuration-only status. They expose protected item health and support controlled failover rehearsal.

Use a non-production network for test failover and document outputs so operations and business continuity stakeholders share the same readiness evidence.

az site-recovery fabric list --resource-group <rg> --vault-name <vault> -o table az site-recovery protected-item list --resource-group <rg> --vault-name <vault> --fabric-name <fabric> --protection-container <container> -o table az site-recovery recovery-plan test-failover --resource-group <rg> --vault-name <vault> --name <recoveryPlan> --network-id <testNetworkId>

Expected outcome: protected items remain healthy, lag remains within target, and test failover completes without consistency errors. If failures occur, inspect connectivity, process server capacity, cache throughput, and policy mappings.

Comprehensive Resources

Update #4 - Generally Available: Microsoft Entra ID-based access for Azure Blob Storage SFTP

Why ITPros should care

This launch modernises SFTP access for Azure Blob Storage by bringing identity control closer to Microsoft Entra. ITPros gain stronger governance options than local-account-only models for many enterprise scenarios.

Operationally, the key change is identity lifecycle alignment: provisioning, review, and revocation can be managed with central identity processes instead of fragmented local credentials.

Operational value

The value is reduced credential sprawl, better auditability, and clearer access accountability across teams and external partners exchanging files over SFTP.

Before production, validate client compatibility, RBAC scope, network restrictions, access review cadence, and emergency break-glass procedures.

Real-world example with step-by-step guidance

Confirm SFTP is enabled on the storage account and validate networking model (public endpoint restrictions or private access path) matches policy.
Assign Entra-based permissions with least privilege and validate scope at storage account and container boundaries.
Test SFTP authentication and file operations using approved clients while collecting diagnostic logs for audit evidence.
Validate joiner-mover-leaver scenarios by changing membership and role assignments, then confirming access updates propagate correctly.
Roll out in stages by partner or workload segment with clear support ownership and incident response runbooks.

Technical details including code examples

This sequence verifies account capability and role assignment posture before user acceptance testing. It is useful for catching scope mistakes that often cause authentication-success/data-access-failure patterns.

Run safely by using a dedicated test identity and non-production storage account first; then repeat read-only validation in production before broad enablement.

az storage account show --name <storageAccount> --resource-group <rg> --query "{name:name,isSftpEnabled:isSftpEnabled,allowBlobPublicAccess:allowBlobPublicAccess}" -o jsonc az role assignment list --assignee <principalObjectId> --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storageAccount> -o table az account show --query user.name -o tsv

Expected outcome: SFTP capability is enabled, expected role assignments are present, and test identity can perform allowed operations only. If sign-in works but file actions fail, inspect RBAC propagation delay, ACL/permission scope, and storage network restrictions.

Comprehensive Resources

If you are planning adoption, start with one workload per update area, collect operational evidence, and standardise the validated pattern in your runbooks and IaC modules. That approach keeps change safe while accelerating delivery.

Cheers!

Pierre

Introducing Layered Ingress Sharding: Achieving Single-Tenant Isolation in Multi-Tenant Services

VarunChawla — Fri, 10 Jul 2026 20:37:31 GMT

Abhishek Tiwari, Vice President of Engineering, Azure Networking
Amit Srivastava, Partner Director of PM, Azure Networking
Varun Chawla, Partner Director of Engineering, Azure Networking

Why Multi‑Tenant Isolation Is Still Hard at Hyperscale

Modern cloud platforms thrive on multitenancy. By sharing infrastructure across tenants, services like Azure Front Door (AFD) can deliver massive scale, global reach, and cost efficiency. At hyperscale, however, this efficiency comes with a hard truth: rare failures are inevitable, and their blast radius matters more than their frequency. When hundreds of thousands of tenants share a global data plane, a single misbehaving tenant, configuration regression, or zero-day exploit can turn a low probability event into a high impact outage.

Over the years, the industry has developed many protections — rate limiting, circuit breakers, fair share scheduling, crash protection, and various sharding strategies. These techniques dramatically reduce average case risk, but they still struggle to bound worst case impact. In particular, they fall short of delivering what customers intuitively expect: single tenant isolation semantics (the guarantee that one tenant’s failure does not affect another) without requiring dedicated per-tenant infrastructure.

At Azure Front Door, we’ve been working on a new architectural approach that directly targets worst case blast radius. Today, I’m excited to introduce Layered Ingress Sharding, a sharding strategy designed to enable single tenant fault isolation for largescale multitenant services.

From Traditional Sharding to Ingress Sharding

Traditional partitioning assigns each tenant to a fixed shard. This limits blast radius, but tenants in the same shard can still experience complete outages when that shard fails. Shuffle sharding improves on this by assigning each tenant to a subset of instances, where subsets partially overlap, dramatically reducing the probability of widespread impact. However, shuffle sharding still allows 100% availability loss for tenants in the affected shard, relies heavily on client retries, and introduces nontrivial capacity loss in overlapping shards.

To address these limitations, we introduced Ingress Sharding.

With ingress sharding, an ingress controller, which we call IRIS (Intelligent Routing with Ingress Sharding), sits directly on the data path. Ingress sharding uses shuffle sharding to construct shards from service instances; IRIS operates on top of these shards to perform tenant-aware, capacity-aware routing rather than introducing a new shard construction algorithm. IRIS identifies the tenant for each incoming connection and deterministically maps that tenant to a shard.

Instead of relying on clients to retry when a shard is unhealthy, IRIS actively:

Monitors the health of service instances
Tracks available capacity in real time
Retries and reroutes traffic internally
Steers traffic away from unhealthy or overloaded instances
Dynamically expands the set of service instances used for oversized tenants when sustained load exceeds a single shard’s capacity

In effect, IRIS turns shard selection into a real-time, capacity-aware decision that is reevaluated for every new connection. This moves fault resilience and load balancing inside the platform, rather than pushing that burden onto clients.

Ingress sharding significantly improves isolation and resilience, but on its own, a tenant can still experience a complete loss of availability if all instances in its shard are affected.

Introducing Layers: Isolation Through Independence

Layered Sharding adds a new dimension to multitenant isolation. In Layered Sharding, the service is divided into multiple independent layers. A layer represents an independent serving dimension of the system capable of handling tenant traffic independently.

This technique was developed to reduce blast radius by changing how tenants are assigned across shards, rather than changing the underlying shard construction within a single layer. A key design goal is that layered sharding is orthogonal to the underlying sharding strategy. It works with existing approaches, whether that is standard partitioning-based sharding, shuffle sharding, or other shard assignment schemes used within a layer.

Within each layer:

Service instances are grouped into shards using an existing sharding technique (for example, traditional partitioning or shuffle sharding)
Each tenant is assigned to a shard independently in that layer

Crucially, tenant-to-shard assignments are randomized and independent across layers. This independence is what gives layered sharding its isolation properties, regardless of the specific sharding algorithm used within a single layer.

The definition of a layer itself is intentionally flexible and service dependent. In Azure Front Door, each server naturally acts as one layer. In other services, a layer might correspond to a cluster, a scale unit, a fault domain, or even a regional partition — any unit capable of serving tenant traffic independently while preserving uniform load distribution.

The result is powerful: even if a tenant’s traffic causes failures in one shard in one layer, it is statistically unlikely that the same tenant will collide with the same peers across many layers. Instead of experiencing a full outage, other tenants see at most a small, transient reduction in capacity, often invisible with standard retry behavior.

Layered sharding alone already reduces availability impact across tenants. But when combined with ingress sharding, it enables something fundamentally stronger.

Layered Ingress Sharding

Layered Ingress Sharding integrates two complementary ideas:

Layered Sharding spreads tenants across many independent layers with randomized shard assignments.
Ingress Sharding dynamically routes traffic to healthy service instances across layers using real‑time health and capacity signals.

The key blast radius reduction that enables single tenant isolation comes from the combination of independent shard randomization across layers with active, intelligent traffic steering.

When a tenant misbehaves due to harmful traffic, a bad configuration, or an unknown vulnerability, IRIS detects unhealthy service instances and automatically routes traffic to healthy shards in other layers. Because shard assignments are independent, IRIS can always find unaffected capacity for well-behaved tenants.

The resulting behavior is a fundamental shift in multitenant failure dynamics:

Outages remain localized to the misbehaving tenant
Healthy tenants continue to serve traffic
Blast radius shrinks from fleetwide to tenant-local

In effect, a shared multi‑tenant system begins to behave like it has single tenant‑ isolation semantics, without abandoning multitenancy.

Why the Math Works

The guarantees behind layered ingress sharding are not heuristic, they’re statistical.

Because tenant-to-shard assignments are randomized independently across layers, the probability that two tenants repeatedly collide in the same shard follows a binomial distribution. With production representative configurations, tens of layers and shuffle-sharded service instances, the probability that an arbitrary tenant experiences a user-visible failure due to another tenant drops below what standard client retries already mask.

Instead of asking “Can a noisy neighbor impact me?”, the system answers “What is the probability that a single connection attempt is unlucky across all layers?” and that probability decreases exponentially as the number of layers increases.

This allows us to trade catastrophic outages for rare, isolated, and standard retry-mitigated events.

A Hidden Benefit: Identifying Bad Tenants

Layered ingress sharding provides an additional, powerful side benefit: automated identification of misbehaving tenants.

Because shard assignments are computed independently across layers, a tenant that is consistently responsible for failures appears as a common factor across impacted shards and service instances. By correlating signals across layers, the platform can accurately identify the offending tenant and apply targeted mitigations such as isolation, throttling, or traffic steering without relying on coarse-grained circuit breakers that penalize everyone.

This dramatically improves response time under high load or adversarial conditions while preserving availability for unaffected tenants.

Beyond Azure Front Door

While Layered Ingress Sharding was developed in the context of Azure Front Door, the underlying principle is broadly applicable.

Any large‑scale multi‑tenant system that:

Serves many tenants from shared infrastructure
Can distribute traffic uniformly across independent layers
Can enforce shard-level isolation within each layer

can benefit from this approach.

Layers don’t have to be servers they could be clusters, scale units, or regional partitions. The key is independent assignment across layers combined with intelligent ingress routing.

We believe this pattern represents a reusable architectural strategy for building resilient, hyperscale, multi‑tenant services.

Closing Thoughts

Multi‑tenancy doesn’t have to mean shared fate. Layered Ingress Sharding shows that by combining probabilistic isolation with intelligent ingress routing, we can build systems where failures are expected, bounded, and automatically contained, even at hyperscale.

Rather than eliminating failure, this approach mathematically constrains its impact. And in large‑scale multi‑tenant platforms, that distinction makes all the difference.

mssql-python 1.11.0: Fixes for transaction semantics, Apple Silicon imports, and bulk copy

DavidLevy — Fri, 10 Jul 2026 17:00:00 GMT

This release is about removing friction in real production paths. It fixes transaction handling in with blocks, restores clean-machine imports on Apple Silicon, improves NULL binary parameter binding, removes a class of hangs in SSH-tunnel-style forwarding setups, and unblocks bulk copy with service principal authentication.

Upgrade

pip install --upgrade mssql-python

Highlights

with connection: now commits on success and rolls back on exception

The Connection context manager now implements the documented commit-on-success / rollback-on-exception behavior when autocommit=False. The connection still closes on exit.

Code like this now behaves the way most users already expected it to:

import mssql_python conn = mssql_python.connect(connection_string, autocommit=False) with conn: cursor = conn.cursor() cursor.execute("INSERT INTO dbo.audit_log(message) VALUES (?)", ("created",))

If the code in the block succeeds, the insert is committed. If the code in the block raises an error, the transaction is rolled back.

Apple Silicon imports work on clean machines again

We fixed the bundled macOS ODBC dylib configuration for every architecture shipped in the universal2 wheel.

For Apple Silicon users, this removes a frustrating failure mode where import mssql_python could point at a missing Homebrew unixODBC path on a clean machine. In 1.11.0, the bundled libraries resolve correctly without a separate unixODBC install.

NULL BINARY and VARBINARY parameters bind more reliably

We fixed the SQLDescribeParam ordinal remapping issue behind GitHub issue #627.

1.11.0 improves parameter binding for NULL binary values, especially in temp-table and table-variable scenarios. When automatic type resolution is not possible, the driver now gives actionable guidance instead of a vague failure, including cursor.setinputsizes() guidance for binary columns.

Bug fixes worth calling out

Shutdown and parameter-typing paths no longer hang SSH-tunnel-style forwarders

We fixed hangs caused by holding the GIL across blocking ODBC operations.

This matters most for users routing connections through an in-process Python TCP forwarder, including SSH-tunnel-style setups. Closing connections and cursors after parameterized queries, as well as executing parameterized queries containing None, no longer wedge the interpreter in those paths.

Bulk copy with service principal authentication no longer freezes

1.11.0 also picks up mssql-py-core 0.1.6, which fixes a freeze affecting bulk copy with Authentication=ActiveDirectoryServicePrincipal.

If you are using service principal authentication for bulk ingest workloads, this release is worth taking promptly.

Upgrading

For most users, pip install --upgrade mssql-python is all you need. If you had local workarounds for broken with connection: transaction behavior, Apple Silicon import issues, or binary NULL parameter binding, 1.11.0 is the release where those workarounds should become unnecessary.

This is not a feature-heavy release. We opted to focus on the friction you are reporting in real production workflows:

transactional with blocks now persist successful work
Apple Silicon setup is smoother on clean machines
binary NULL parameters are more reliable
SSH-tunnel and threaded forwarding scenarios are less fragile
service principal bulk copy is unblocked

Thank you

Thanks to everyone who filed issues, sent repros, and reviewed fixes in this cycle. Several of the changes in 1.11.0 came directly from concrete user reports in production-like environments, which made the failure modes easier to reproduce and fix.

If you upgrade to 1.11.0 and hit anything unexpected, please open an issue in the repository.

Repository: microsoft/mssql-python

Issue tracker: open an issue

Release notes: mssql-python v1.11.0

July update: What’s new for partners in AI Business Solutions

JillArmourMicrosoft — Fri, 10 Jul 2026 16:00:00 GMT

July’s AI Business Solutions newsletter highlights key opportunities for Microsoft partners—from new Microsoft 365 Copilot SKUs and agent scenarios to licensing changes, limited-time offers, and events. Discover what’s changed and how you can drive adoption and impact for your customers.

News and Announcements

Microsoft 365 Business with Copilot SKUs now available: Your small and medium-sized business (SMB) AI opportunity just became easier to scale. Microsoft 365 Business with Copilot SKUs are now generally available, turning a successful promo into a permanent, predictable offer with AI built into every license. That means faster sales, larger deals, and a clearer path to drive renewal growth—without managing add-ons or promo windows. Read the blog post to explore this opportunity and find more details in the Partner Center announcement.

New licensing prerequisite for Microsoft Agent 365: New Microsoft Agent 365 purchases now require prerequisite licenses to ensure customers have the security, identity, and compliance foundation needed to use agent capabilities effectively. Customers can meet these prerequisites through eligible Microsoft 365 licensing or by licensing the required security components, as outlined in the Microsoft Product Terms. Use this update to assess customer readiness early, identify licensing gaps, and guide customers toward the right Microsoft 365, Business Premium, and security solutions to support governed AI adoption. Learn more about how this update can empower your customers as you review the Microsoft Product Terms.

Temporary purchasing pause of Windows 365 GPU Enterprise Select lifted: After a temporary purchasing limitation was put in place for the Windows 365 GPU Enterprise Select 256-GB SKU in the CSP channel through June 30, 2026, the SKU is available for purchase again as of July 1, 2026, in alignment with the standard CSP publishing cadence. Customers who have expressed interest should be informed of this availability timeline, and there is no impact to any existing Windows 365 entitlements. Explore the Partner Center announcement to learn more about how the Windows 365 GPU Enterprise Select 256-GB SKU can optimize your customers’ graphic-intense workloads.

Smarter targeting for per-user promotions: Also coming in FY27, Microsoft can target offers by seat count with greater precision, building stronger motions for partners to acquire customers and grow at scale. Learn more in the Partner Center announcement.

Incentives and Offers

Frontier Accelerate for Copilot is your hero FY27 investment for AI and agents: FY27 partner investments are here, and Frontier Accelerate for Copilot is our hero investment across Microsoft 365 E7, Copilot, agents, and Agent 365. It supports discovery, technical workshops, and deployment motions that move customers from AI curiosity to operationalized Copilot and agent scenarios at scale—while this year's CSP incentives reward the adoption and expansion you drive. Explore the FY27 incentives guide and register for a Partner Investments Community Call (in the Americas or Asia).

Save with Microsoft 365 Copilot and Microsoft 365 Copilot Business: Customers want AI that delivers measurable value now. Microsoft 365 and Copilot help employees supercharge productivity, streamline everyday tasks, and reduce costs across the business. Available now, a new wave of FY27 CSP promotions provide a compelling, easy-to-position lever to scale Microsoft 365 Copilot and Copilot Business. Learn more about the offers below on the CSP offers and promotions site.

- Microsoft 365 Copilot: 15% off new one-year subscription on 300+ licenses and 30% off 1,000+ licenses for SMB and corporate customers; 15% off new three-year subscription on 300+ licenses through September 30, 2026.
- Microsoft 365 E7: 10% off new one-year subscription on 10+ licenses and 15% off 100+ licenses; 15% off new three-year subscription on 300+ licenses through December 31, 2026.
- Microsoft 365 Copilot Business: Up to 15% off new add-on subscription on up to 300 licenses and 25% off new Microsoft 365 Business Basic + Copilot Business bundle on up to 300 licenses through December 31, 2026.

Skilling and Events

Start FY27 ready to execute and scale Microsoft 365 Copilot and agents: Join us at MCAPS Start for Partners for a deep dive into how partners can unlock a new wave of transformation with Copilot and agents—grounded in real customer scenarios, reimagined business processes, and scalable impact. Register now to learn about the next chapter of opportunity powered by AI.

Join us for the Microsoft Partner FY27 GTM Kickoff Event: For a double-click on the priorities shared at MCAPS Start for Partners, don’t miss this critical FY27 planning moment. Hear directly from Microsoft executives about priorities, learn how to build your strategy around Frontier Transformation, and gain insight into the market trends and investments shaping growth. Register for the Microsoft Partner FY27 GTM Kickoff Event on July 28.

Nominations for the 2026 Microsoft Partner of the Year Awards are closed: Nominations for the 2026 Microsoft Partner of the Year Awards closed on July 7, 2026. Thank you to those who nominated their organizations—and stay tuned for winner announcements in November.

Turn AI demand into repeatable revenue with Frontier Transformation campaigns: Build AI thought leadership and pipeline with the Frontier Transformation campaign in a box, a ready-to-launch, co-branded campaign that helps customers embed AI across their business with the governance, security, and intelligence needed to scale. Use it to go to market faster, generate qualified leads, build pipeline without creating assets from scratch, and position your business as a strategic AI partner. Explore Partner Marketing Center Pro, download key campaign in a box assets, or visit Partner Marketing Center for more information.

Check out the Microsoft Partner Skilling Hub, a unified platform for all your skilling needs: In this fast-moving market, skilling is no longer a nice-to-have—it's a must for adopting new technologies, driving innovation, and winning business. Find all the skilling opportunities you need to keep winning on the Microsoft Partner Skilling Hub, our unified platform that brings together all partner skilling resources into one seamless experience. This experience offers sales, technical, and solution-based learning, skilling paths mapped to Solutions Partner designations and specializations, and continuously updated content. Explore the Skilling Hub today.

Go-To-Market

Copilot Cowork is now generally available: This update give you new ways to deliver AI-powered collaboration and automation for your customers. Powered by Copilot Credits-based consumption, Copilot Cowork empowers you to monetize ongoing usage while built-in admin controls support governance and visibility at scale. This creates a clear path to expand services, drive adoption, and grow recurring revenue. Read the Partner Center announcement and view the Cowork Microskilling training on Copilot Cowork to start building your consumption-led Copilot strategy now.

Customer Success

Increment strengthens school data security and AI readiness: Increment partnered with Australian public education systems to strengthen protection of sensitive student data and prepare for AI adoption. Using Microsoft security and compliance solutions, the team established scalable data governance practices across large, complex school environments. This work reduced risk, improved visibility into sensitive information, and created a foundation for secure use of tools like Microsoft 365 Copilot.

Ingram Micro guides partners through cloud and AI modernization: Ingram Micro works with partners to move customers from legacy infrastructure to Azure-based environments, creating a structured path from cloud migration to AI adoption. By combining technical expertise, funding programs, and repeatable approaches, partners can reduce complexity, optimize costs, and deliver scalable, secure solutions that position customers for AI-powered workloads.

Sign up for the monthly Microsoft AI Cloud Partner Program newsletter: Encourage your teams to sign up for the newsletter to stay informed on updates, incentives, and partner opportunities. It’s an easy way to get the latest partner news delivered directly to your inbox.

Follow the AI Business Solutions tag to stay updated on monthly AI Business Solutions partner news!

Cross-Tenant Message Recall in Exchange Online

The_Exchange_Team — Fri, 10 Jul 2026 15:38:58 GMT

Since we released cloud-based Message Recall in April 2023 (see Cloud-based Message Recall in Exchange Online), we’ve continued to expand where and how recall works – including support for Outlook on the web and mobile, recipient recall notifications, a maximum recallable message age, and support for external round-trip routing (see Exchange Online Message Recall Updates).

Until now, all these capabilities shared one boundary: Message Recall only worked within a single tenant. Today, we’re pleased to announce one of our most requested cross-organization enhancements:

Cross-Tenant Message Recall, controlled by a tenant admin allow list

The intra-tenant boundary

By design due to privacy concerns, Message Recall operates within the Exchange Online service boundary, and until now it has been limited to intra-tenant messages – those where the sender and the recipients belong to the same Microsoft 365 tenant. When a sender tried to recall a message they had sent to recipients in a different tenant, the recall would fail, even between organizations that work closely together and trust one another.

Customers told us this was a gap. Partners, subsidiaries, and affiliated organizations that collaborate daily across tenant boundaries wanted the same recall experience they already had inside their own tenant.

Introducing cross-tenant Message Recall

With Cross-Tenant Message Recall, a tenant admin can add other Microsoft 365 tenants to an allow list. Once a tenant is on the list, senders from those allow-listed tenants can recall messages they’ve sent to recipients in the receiving tenant – just as they would for an intra-tenant recall.

Control sits with the receiving tenant – the organization whose users received the messages. A cross-tenant recall is only honored when the receiving tenant’s admin has explicitly allow-listed the sender’s tenant. This keeps the receiving organization in full control of which external tenants are permitted to recall messages from its users’ mailboxes. The feature is disabled by default; no cross-tenant recall occurs until an admin adds at least one tenant to the allow list.

How it works

Consider two organizations that work together, Contoso and Fabrikam, both of whom are hosted in Microsoft 365:

A Contoso admin adds Fabrikam’s tenant to Contoso’s cross-tenant recall allow list.
A sender at Fabrikam recalls a message they previously sent to a recipient at Contoso.
Because Contoso has allow-listed Fabrikam, the recall is honored and processed like a standard recall against the Contoso recipient’s mailbox.

If Fabrikam is not on Contoso’s allow list, the recall fails and the Fabrikam sender will see in the recall status report that the message can’t be recalled across organizations. Allow-listing governs inbound recalls into the receiving tenant, so each organization decides independently which external tenants it trusts to recall messages from its mailboxes.

Configuring with Exchange Online PowerShell

Admins can configure these settings using Exchange Online PowerShell.

Enable or disable cross-tenant message recall for the tenant. Setting this parameter to $True turns on the capability; $False (default) turns it off:

Set-CrossTenantRecallConfiguration -CrossTenantRecallEnabled [$true | $false]

Specify external tenants to add or remove from the allowed list. Add the tenant IDs of the organizations you trust to perform recalls:

Set-CrossTenantRecallConfiguration -AllowedSenderTenantIds @{Add="<tenantId 1>","<tenantId 2>"}; {Remove="<tenantId 1>","<tenantId 2>"}

What senders and recipients see

When a sender in an allow-listed tenant recalls a message, recipients in the receiving tenant experience the recall exactly as they would an intra-tenant recall. If the receiving tenant has enabled recipient recall notifications, those notifications apply to cross-tenant recalls as well. If the sender’s tenant is not on the receiving tenant’s allow list, the sender receives a notification that the message can’t be recalled across organizations.

Availability

Cross-Tenant Message Recall will start to deploy to worldwide, GCC, GCC High, DoD and Microsoft 365 operated by 21Vianet starting mid-August, completing by mid-September. We hope you’ll find this enhancement useful, and we look forward to your feedback.

Microsoft 365 Messaging Team

Title Plan Update - July 10, 2026

anbordianu — Fri, 10 Jul 2026 15:02:38 GMT

📁July 10, 2026 - Title Plan Now Available

Access the latest Instructor-Led Training (ILT) updates anytime at http://aka.ms/Courseware_Title_Plan to ensure you're always working from the most current version.

📌 Reminder: To help you stay informed more quickly and consistently, we’ve moved to a weekly publishing cadence for the title plan. This means each update may include fewer changes but ensures you’re always up to date.

New MRCA test for External user meeting join

DJ1298 — Fri, 10 Jul 2026 13:06:17 GMT

If you support Microsoft Teams, you’ve probably seen cases where an external user can’t join a meeting and the cause isn’t obvious at first glance. This test helps identify common configuration issues that may prevent external users from joining Teams meetings.

This test checks:

Meeting policies
Guest access settings
External access settings
Federation configuration
Lobby settings
Cross-tenant access settings
Identity classification

The goal is to make it easier to pinpoint the setting or policy that’s blocking a successful meeting join experience for external users. We encourage you to try the test and add it to your troubleshooting toolkit.

Get Started

To access the diagnostic, navigate to the Microsoft Remote Connectivity Analyzer, select Microsoft Teams, then click on External user meeting join.

Learn more

For a deeper look at why external participants can or can’t join a Microsoft Teams meeting, see Why External Participants Can—or Can’t—Join a Microsoft Teams Meeting. This article explains the different participant types and how meeting policy, organizer meeting options, and tenant-level settings work together to affect join behavior.

Thanks for taking a look and let us know how it helps.

New in Microsoft Marketplace: July 10, 2026

Nikhil_Viswanathan — Fri, 10 Jul 2026 16:46:23 GMT

Learn about 132 new offers that went live in Microsoft Marketplace, a single destination to find, try, and buy cloud solutions, AI apps, and agents to meet your business needs.

Get it now in our marketplace
	4MINDS for Microsoft 365 Copilot: 4MINDS enables organizations to train custom AI models on their own documents and data, integrating them directly into Microsoft 365 Copilot. The 4MINDS Assistant agent delivers accurate, domain-specific answers within familiar apps like Excel and Word, enhancing finance, engineering, legal, HR, and operations workflows without leaving your Microsoft 365 environment.
	Access Rio Observations: Access Rio Observations is a mobile app built on Microsoft Azure for real-time patient data capture, syncing seamlessly with Rio EPR. It offers offline use, secure synchronization, and access to vital signs and alerts. Integrated with Access Evo and AI-powered analytics, it enhances accuracy, efficiency, and patient safety in emergency care.
	AiTiALVSD: AiTiALVSD is an AI-powered ECG solution that helps healthcare providers detect early heart failure signs using routine 12-lead ECGs. The solution delivers rapid risk scores, integrates seamlessly into workflows, and supports timely intervention.
	BigCat: BigCat is an enterprise AI platform offering knowledge discovery, natural language analytics, AI agent automation, and multi-model integration. It enables building knowledge bases, data analysis, intelligent agent deployment, and secure AI model connections, enhancing productivity, decision-making, and unlocking business value in a scalable environment.
	Business Analyst Assistant Agent: ba-agent is an AI-powered assistant that transforms Microsoft Teams conversations into clear, actionable product requirements. The assistant analyzes transcripts and chats to summarize discussions, extract key decisions, and reduce manual documentation. Designed for product managers and teams, it improves alignment, accelerates delivery, and integrates seamlessly with collaboration workflows.
	CodeFind CIP: CodeFind CIP is an AI-powered platform for searching and classifying Canadian postsecondary educational programs using Classification of Instructional Programs (CIP) codes. CodeFind CIP offers natural language and hybrid search. The platform provides API integration and supports educational institutions, government, and workforce planners. It streamlines program mapping, data accuracy, and integration for education and research applications.
	CodeFind NOC: CodeFind NOC is an AI-powered tool for quickly identifying and validating Canada's National Occupational Classification codes and TEER categories. It supports workforce development, immigration, career guidance, and labor market analysis by providing accurate occupation details, hierarchies, and requirements, streamlining classification and enhancing planning for organizations and professionals.
	ComplianceGenie: ComplianceGenie is an AI-powered platform automating ISO/IEC 27001, SOC 2, GDPR, and HIPAA compliance for IT and software-as-a-service companies. It reduces audit preparation time, supports multiple frameworks, automates evidence collection, offers real-time monitoring, and provides audit-ready reports.
	Covene CloudMonitor: Covene CloudMonitor unifies Microsoft Azure cloud and AI spend monitoring, integrating Microsoft Azure OpenAI and other AI solutions. CloudMonitor offers cost analysis, anomaly detection, compliance alerts, and AI usage metrics. Built on Azure, it supports role-based access control (RBAC), audit trails, and AI-driven insights for efficient cloud and AI resource management.
	Data & AI Consulting Services: NeoStats offers end-to-end consulting for Microsoft Azure, enabling modern data platforms for business intelligence, data science, and AI. Services include migration, platform modernization, predictive modeling, data governance, and real-time analytics.
	Ezra360 Document Management System: Ezra360's document management system helps organizations efficiently manage, store, and retrieve documents with advanced tools for organization, secure access, and compliance. It simplifies workflows through easy categorization, version control, and collaboration, improving productivity and control over document processes while addressing common file management challenges.
	Healthcare Agentic AI Contact Center: Ascendion's Agentic AI Contact Center, built on Microsoft Azure AI, enhances healthcare engagement by integrating with existing systems. It reduces call costs, improves handling time, and achieves first contact resolution. Designed for HIPAA compliance, it boosts efficiency, personalization, and regulatory adherence in healthcare operations.
	ICRON Procurement Planning & Blending Optimization: ICRON Procurement Planning and Blending Optimization uses AI to optimize sourcing, blending, and supply chain decisions in process industries. It balances cost, quality, and sustainability by analyzing complex scenarios quickly. Proven to reduce costs, inventory, and run times, it enhances transparency and aligns procurement, production, and quality teams efficiently.
	IK Weather Insights: IK Weather Insights is a cloud-native platform that modernizes live weather broadcasts with real-time data visualization, browser-based workflows, and scalable infrastructure on Microsoft Azure. It streamlines production, supports multi-market operations, and enhances responsiveness during severe weather.
	Insurance Intelligence Platform: Insurance Intelligence Platform (IIP) is a Microsoft Azure Managed Application that automates insurance workflows like claims intake, policy servicing, underwriting, and document processing. It enhances communication, provides operational visibility, and ensures data security within your Azure environment. Ideal for insurers, brokers, and operations teams seeking AI-driven efficiency.
	Jeen AI Platform: Jeen is an enterprise AI platform enabling secure, governed, and scalable AI adoption across industries like healthcare, finance, and government. It supports Microsoft Azure, on-premises, hybrid, or air-gapped deployments, ensuring control over data, models, and compliance while integrating AI into mission-critical workflows with enterprise-grade security and oversight.
	Kritmatta AI Agent Builder: Kritmatta is an advanced platform to enable teams to create, manage, and scale intelligent AI agents. These agents autonomously coordinate tasks across various tools and environments, enhancing productivity within an integrated, agentic AI ecosystem.
	Micro-Vigilant SecOps Agent: Micro-Vigilant SecOps Agent enhances SOC performance by analyzing Microsoft Defender XDR incidents, workload, and response efficiency. It identifies unresolved cases, workload imbalances, and alert quality issues, providing actionable recommendations to optimize security operations, improve analyst productivity, and prioritize critical incidents through an interactive chatbot interface.
	Modern Activity Timeline for Microsoft Dynamics 365: Modern Timeline enhances Microsoft Dynamics 365 and Power Apps by streamlining activity management directly within the timeline. It boosts productivity for sales, service, and field teams by enabling quick email replies, activity creation, and task completion without extra clicks or navigation.
	Octave OnSite Completions: Octave OnSite Completions is a comprehensive project management solution for planning, execution, and handover in construction and commissioning. It ensures traceability, accountability, and system integrity, supports large projects, and includes modules for completions, safety, risk, and turnaround management, meeting high industry standards efficiently.
	Okai Compliance: Monitor regulations and consultations from key Brazilian regulators in one searchable workspace. Okai is designed for regulatory compliance teams, centralizing monitoring, AI-assisted summaries, impact analysis, and task management. It supports financial and regulated markets by streamlining regulatory tracking, project workflows, deadlines, and collaboration, reducing manual effort and ensuring traceable, audit-ready compliance actions in one searchable workspace.
	Omnia-Voice Teams Transcription: Omnia-Voice is an AI transcription and meeting intelligence platform for Microsoft Teams. It supports over 50 languages with automatic detection, requires no guest bots, uses secure data storage hosted in Europe to aid compliance with the GDPR, and delivers instant post-meeting summaries, transcripts, and action items directly into Teams channels for seamless collaboration.
	Onseen DEV: Onseen DEV is a Japanese-to-English captioning app that supports multilingual online meetings. It displays translated subtitles in near-real-time to ease understanding, reduce communication gaps, and enhance collaboration in business, training, and technical discussions involving Japanese and English speakers.
	Optimize365: Optimize365 is designed for managed service providers (MSPs) and managed security service providers (MSSPs) to manage Microsoft 365 security across clients. Optimize365 offers rapid security assessments, one-click remediation, automated change tracking, branded reports, AI readiness checks, and compliance mapping.
	Qualdo-DRX Private Realtime Data Observability for AI: Qualdo-DRX Private offers real-time data observability and incident detection within Microsoft Azure, monitoring over 75 metrics for reliability, quality, and drift. It ensures data stays secure in customer infrastructure, supports AI, RAG, and ML workflows, integrates with Microsoft tools, and meets compliance for robust, automated data governance and pipeline monitoring.
	Query AI Chatbot for Your Documents: Query leverages Microsoft Azure AI and LLMs to deliver conversational, context-aware answers from enterprise documents using retrieval-augmented generation (RAG). It enables instant, accurate responses, intelligent multi-document search, and secure access, boosting productivity, decision-making, and knowledge accessibility across business platforms for AI-driven digital transformation.
	Resilience for Microsoft 365: AvePoint offers a secure, scalable solution for Microsoft 365 data protection and rapid recovery. It supports large-scale restores, covers multiple workloads, cleans redundant data, and extends protection to key apps. Prioritized restore minimizes downtime, ensuring compliance and resilience for modern incidents across Microsoft 365 environments.
	Routine: Routine automates repetitive administrative tasks within existing systems without new software or migration. It offers fast, reliable, rule-based workflows that adapt automatically, ensuring compliance and auditability. Routine enables human oversight for sensitive cases, integrates seamlessly across applications, and deploys quickly, boosting team efficiency without disrupting operations.
	SCALE AI Transformation Office: The AI Transformation Office (ATO) helps organizations scale AI by providing a centralized platform for managing, governing, and expanding AI initiatives. It offers dashboards, program management, training, and governance aligned with Microsoft Copilot and Azure AI, ensuring consistent execution and measurable business impact through a structured, ongoing AI transformation program.
	SOLUM AIMS Cloud Platform: SOLUM AIMS Cloud is a professional platform for managing and monitoring electronic shelf labels (ESL) in global retail stores. It automates pricing updates and ensures data accuracy, enhancing efficiency and control in retail pricing management.
	Spassu Code: Frontier: Spassu Code is an AI-assisted software development suite that streamlines the entire pipeline from requirements to pull request. It integrates with Microsoft Azure DevOps and GitHub, offers web and CLI interfaces, ensures human approval at critical points, provides governance, auditability, real-time streaming, and reduces rework by maintaining context and standardization.
	Sprouts AI: Sprouts AI is a revenue intelligence platform integrated with Microsoft Dynamics 365 Sales, offering real-time account and opportunity insights. It enriches data, maps decision-makers, analyzes competitors, and identifies high-value accounts, helping B2B sales teams improve targeting, reduce manual research, and boost pipeline conversion efficiently.
	Switchblade Tableau to Microsoft Fabric: Switchblade by Vector Lab automates migrations from Tableau to Microsoft Fabric, cutting manual effort and speeding delivery. Switchblade analyzes dashboards, maps schemas, translates logic, and ensures compatibility, while also supporting unlimited data volume, enhancing consistency, and reducing migration risk for enterprises.
	Taxcel Hub: Available in Portuguese, Taxcel Hub is a cloud-based big data fiscal platform offering centralized storage, high-performance processing, interactive dashboards, and AI-driven insights. It automates tax data management, supports user control, integrates with external systems, and scales for large operations, aiding corporations, business process outsourcing organizations, and tax consultancies in strategic decision-making.
	Unifize AI Governed Layer for Quality & Document Management: Unifize is an AI-driven quality and document management platform for regulated industries that provides with full traceability, audit readiness, and hosting on Microsoft Azure. Unifize streamlines corrective and preventative action (CAPA), change control, and training, enabling faster compliance and expansion without re-implementation.
	Video Banner Web Part: KapiNex's Video Banner web part lets you add a full-width video hero banner to SharePoint Online pages, enabling autoplay, loop, and muted MP4 support. Customize title, description, call-to-action (CTA) buttons, alignment, overlay color, text, and banner height. The web part features edge-to-edge layout, advanced styling, and configuration tips for video sources and design.
	VitalEdge IntelliDealer: VitalEdge IntelliDealer is a modern dealership management system for equipment dealerships, integrating sales, parts, service, and inventory into one platform. It enhances efficiency with real-time data, simplifies operations, and supports hosting on Microsoft Azure and reporting via Microsoft Power BI. Designed for usability, it streamlines workflows and boosts dealership performance and growth.
	Vulnerability Scanners for Web Apps and Network: Pentest-Tools.com offers over 20 vulnerability scanners for web applications and network security. It detects issues like XSS, SQL injection, and critical CVEs such as Log4Shell. This all-in-one platform combines web and infrastructure scanning, providing comprehensive security assessments by simulating external attacker probes to identify vulnerabilities.
	Vyoma-Asqrt Payroll: Vyoma-ASQRT Payroll is a cloud-based HR solution that automates payroll tasks, ensuring accuracy and compliance. The user-friendly dashboard streamlines attendance, leave, and salary management. Ideal for HR and finance teams, it reduces errors, boosts productivity, and offers seamless, accessible payroll processing for organizations of all sizes.
	Xillio Link Redirector: Xillio Link Redirector ensures business continuity after content migration by maintaining existing links to moved documents. It prevents broken links and user frustration, enabling seamless access to content in new systems. This continuity layer supports smooth transitions, reducing support issues.
Easily deploy virtual machine images
	Database for PostgreSQL 18 on SUSE Linux Enterprise Server 15
	CloudSync and Data Sharing Tool Data Platform Graph Insights and Analytics Tool Jitsi OpenCart Pritunl VPN Ubuntu Server UniFi
	Docker on Ubuntu 26.04 LTS Ubuntu Desktop 26.04 LTS
	SFTP Server on Ubuntu 24.04 LTS
	GitLab CE on Ubuntu 24.04 LTS Pre-Hardened Ubuntu 24.04 LTS Confidential VM
	Anaconda Nomad Wagtail
	Craft CMS
	Kubeflow and MLFlow by QUANTUM AI
	Docker CE on Ubuntu 26.04 LTS for Containerized Applications and DevOps
	Siemens NX VM (CA)
Go further with workshops, proofs of concept, and implementations
	Agile Payment Engine: Implementation: Endava’s Agile Payment Engine modernizes payment routing with a Microsoft Azure-native platform featuring intelligent multi-PSP routing to reduce costs. Agile Payment Engine provides pre-built adapters for rapid integration and a resilient, event-driven architecture. It ensures secure, scalable, compliant payment processing, accelerating legacy migration and enabling businesses to own and optimize their payment infrastructure.
	AI Voice Agent – Intelligent Call Automation & Customer Engagement: Logic V’s AI Voice Agent modernizes business communications by automating call handling using natural language understanding. Integrating with Microsoft Teams and VoIP, it offers virtual agents for customer support, call routing, and appointment booking, reducing costs, improving response times, and enhancing customer experience across various industries.
	AI-Driven Frontier Back Office Transformation: Implementation: Sonata Software's AI-Driven Frontier Back Office Transformation modernizes finance, HR, legal, procurement, and IT operations using Microsoft AI, automation, and cloud technologies. It boosts productivity, reduces costs, accelerates decisions, and ensures compliance through AI-powered workflows, copilots, and governance, delivering significant efficiency gains and faster processing across enterprises.
	Center of Excellence for AI: Onevinn's Center of Excellence for AI (CoEAI) helps organizations strategically build, govern, and scale AI using Microsoft Foundry and Copilot. It ensures secure, responsible AI adoption, accelerates innovation, aligns teams, and maximizes business value, enabling confident, enterprise-wide AI transformation with standardized governance and future-proof strategies.
	Center of Excellence Services for Microsoft Fabric: Available in Spanish, the GOVms offer offers expert support for designing, implementing, and optimizing Microsoft Fabric data solutions. Services include architecture design, data integration, real-time intelligence, governance, and training. GOVms accelerates data transformation with scalable architectures, best practices, and enhanced adoption of Fabric capabilities.
	Copilot and AI Adoption Accelerator: Logic V’s Copilot and AI Adoption Accelerator helps organizations deploy Microsoft 365 Copilot effectively. It includes readiness assessment, use case identification, configuration, user training, and a value realization framework. The program ensures secure, compliant AI integration, boosting productivity, decision-making, and reducing manual effort across business functions.
	Digital Credit Officer: Quadrant Technologies’ AI-Powered Credit Memo Generation automates commercial lending credit analysis for banks using Microsoft Azure AI. It processes loan documents, calculates financial metrics, benchmarks compliance, and generates audit-ready memos in seconds. Features include risk detection, stress testing, and integration with loan systems, boosting efficiency and accuracy.
	eir business Proof of Concept for Microsoft Azure Arc: eir business offers a proof of concept built on Microsoft Azure Arc to help organizations validate Azure Arc capabilities in their environment. The engagement includes planning, deployment, governance, monitoring, and reporting, enabling unified management across on-premises, multi-cloud, and edge resources, improving visibility, policy enforcement, and operational control.
	eir business Implementation of Microsoft Purview: eir business offers an implementation of Microsoft Purview to enhance data governance, protection, and compliance across Microsoft 365. This service includes assessment, solution design, sensitivity labeling, data-loss prevention, retention policies, and auto-labeling, helping organizations reduce data risks, improve visibility, automate protection, and establish a roadmap for ongoing governance maturity.
	Endava Digital Merchant Experience & Onboarding: Endava’s Digital Merchant Experience & Onboarding Service modernizes merchant onboarding with automated workflows, real-time dashboards, and seamless single sign-on using Microsoft Entra ID. Deployed on Microsoft Azure, it integrates legacy systems, accelerates merchant acquisition, and secures access via role-based controls, enhancing payment platforms with scalable, data-driven insights and compliance automation.
	Fabric ACT: Data & AI Managed Service: The Information Lab Ireland offers a Microsoft Fabric data service ensuring accurate, connected, trusted data. Services include diagnosis, design, and ongoing support. The Information Lab Ireland provides outcome-focused solutions furthering governance, AI readiness, and executive alignment for Irish businesses.
	Hybrid Network Foundation: Azure Virtual WAN: scopewyse AG will implement a hybrid network solution built on Microsoft Azure virtual WANs, aligned with the Microsoft Cloud Accessibility Framework and the Zero Trust framework. Eliminate implicit trust, reduce attack surfaces via segmentation, and enable secure remote work without VPNs while gaining improved visibility and control across hybrid, multi-cloud environments.
	Legacy Payments and ISO 8583 Integration: Endava delivers a secure ISO 8583 adapter built on Microsoft Azure to bridge modern JSON APIs with legacy banking systems. This solution ensures accurate message translation, secure TCP/IP connectivity, cryptographic protection via Azure Key Vault, and accelerated deployment using proprietary tools, enabling seamless integration between cloud-native payments and traditional financial infrastructure.
	Mobile Payment & App Accelerator: Endava’s Mobile Payment & App Acceleration service speeds secure mobile commerce on iOS and Android. It integrates brandable payment SDKs, secure card tokenization to reduce PCI scope, user onboarding, and push notifications for engagement. Built on Microsoft Azure, it ensures seamless, secure, and scalable mobile payment experiences.
	Modern Data Platform on Azure & Fabric: 4-Week Implementation: Algoscale modernizes data platforms on Microsoft Azure, Fabric, and Power BI. The implementation includes architecture assessment, lakehouse design, pipeline migration, and governed semantic models, delivering a unified, trusted data source with faster reporting, self-service analytics, and improved data quality for enterprises and mid-market firms.

Contact our partners

351X Insider Risk & Personnel Reporting Platform

AD merchantCENTRAL Supplier Jarltech

Admiral: Sync Microsoft Entra & Active Directory with Oracle ERP

Admiral: Sync Microsoft Entra & Active Directory with ServiceNow

Admiral: Sync Microsoft Entra and Active Directory with Salesforce

AI Advisor Enterprise

AI Opportunity Advisor Agent by SoftwareOne

AI Transcription to Dynamics 365

AI-Driven Master Data Management (MDM) on Microsoft Fabric

alfred_ Personal AI Assistant

Avanade Delivery Status Agent

Azure AI Application Modernization: Assessment and Proof of Value

bKlug e-Commerce for WhatsApp

CrucialLogics FinOps Workload

CuroSygnal

Data Analytics

DataStreams QualityStream Application

Digital Workplace 365 Platform

DoneThat

Dradis Community Edition (CE)

Dreamina Seedance 2.0

Dynamity Electronic Invoicing ZUGFeRD

EasyEntra

Expense Agent (Preview)

FeedEx

FinOps App for Azure and Microsoft Spending

Formula

Greycoat Land and Environment Management System

HCLTech Guideline Comparison Agents

IBM i Application & Data Assessment for Microsoft Azure Modernization

Infiterra Subscription Commerce Platform for MSPs

Infoma Tasks and Reports (CH)

Infoma e-Invoice (CH)

Infoma for Public Administrative Services and Churches (CH)

Infoma Inventory (CH)

Latam Collection Tracking

LemonLime

Managed Services for Security: 2-Hour Briefing

Matter Alert

MyWay Education

Naval SCM for Business Central

numi AI Demand Forecasting, Inventory Optimization, & Automated Purchasing

Onware Contract Administration

QRFeedix

RecoveryTools For ProtonMail Export Tool

RecoveryTools For Zimbra to Gmail Migration Tool

RUX Advanced Surcharge

SecNova AI SIEM

SecurePoint Regulated Access

Sentinari See It Say It

Shopware for Microsoft Dynamics 365 Business Central

SysInfo DBX Viewer Software

SysInfo NSF Viewer Tool

Telana PowerReview: Security Assessment

WrenchTime Pro CMMS

WyvernIQ Autonomous Cyber Health Intelligence

This content was generated by Microsoft Azure OpenAI, then revised by human editors.

When Arc Goes Silent: Turning Visibility Gaps into SOC Action

absharan — Fri, 10 Jul 2026 12:07:15 GMT

Hybrid blind spots rarely announce themselves. They appear when an Azure Arc-enabled server drops out, health signals go stale, and the SOC loses confidence in monitoring coverage. This playbook uses Microsoft Sentinel and Logic Apps to turn that noise into one clear daily signal the team can act on.

The problem: too much noise, not enough assurance

One unhealthy server, one alert, one more email—at scale, that does not help the SOC. What leaders need is assurance: where visibility is weakening, which systems matter, and when action is needed.

The use case: daily assurance for hybrid monitoring coverage

The use case is simple: identify Arc-enabled servers that stay unhealthy beyond a set threshold, such as 30 minutes, and send one consolidated summary each day. For a CISO, this improves assurance. For a SOC Manager, it cuts noise and helps teams prioritize faster.

Solution overview: simple automation, stronger operational signal

The workflow runs on a schedule, queries Log Analytics, filters Arc health issues, formats the results into a clean HTML report, and sends a single email through Office 365 Outlook. The outcome is not more telemetry—it is a better operational signal.

Prerequisites

One or more Azure Arc-enabled servers connected to Azure.
Azure Monitor Agent installed and sending heartbeat data to a Log Analytics workspace.
Microsoft Sentinel enabled on the target workspace if the playbook is being used as part of SOC operations.
A Logic App with permissions to run the query and send email through Office 365 Outlook.
A reviewed threshold, recipient list, and notification cadence aligned to your operating model.

How the workflow creates decision-ready visibility

In practice, this becomes a daily control: check Arc health, isolate persistent issues, and route one concise summary to the right teams. That gives the SOC a cleaner way to review monitoring gaps before they become bigger operational problems.

Why this matters to a CISO and SOC Manager

For security leadership, this is about confidence. If Arc health degrades on systems tied to monitoring, policy, or data collection, the risk is not just technical—it is a visibility gap. This playbook helps surface that gap early and in a form teams can act on quickly.

Three practical scenarios where this playbook delivers value

Reduce SOC noise.Replace scattered alerts with one daily summary.
Strengthen executive assurance.Highlight persistent blind spots before they turn into escalations.
Improve team coordination.Give security and infrastructure teams one shared view of the issue.

Sample KQL to identify persistent Arc monitoring gaps

This sample query uses the Heartbeat table to identify Azure Arc-connected machines whose latest heartbeat is older than the defined threshold. It is a practical starting point and can be tuned further based on the environment and data collection design.

let ThresholdTime = 30; AzureActivity | where TimeGenerated > ago(1d) | where CategoryValue == "ResourceHealth" | where parse_json(Properties).currentHealthStatus == "Unavailable" | where ActivityStatusValue == "Active" | extend ResourceType = Properties_d.resourceProviderValue | where ResourceType == "MICROSOFT.HYBRIDCOMPUTE" | extend StartTime = TimeGenerated | extend ServerName = Properties_d.resource | join kind=leftouter ( AzureActivity | where ActivityStatusValue == "Resolved" | extend ResourceType = Properties_d.resourceProviderValue | where ResourceType == "MICROSOFT.HYBRIDCOMPUTE" | extend EndTime = TimeGenerated ) on CorrelationId | extend Minutes_OfflineTillResolve = datetime_diff('minute', EndTime, StartTime) | project ServerName, StartTime, EndTime, CorrelationId, Minutes_OfflineTillResolve, Level, ActivityStatusValue1, ResourceGroup, OperationNameValue, SubscriptionId, ResourceProvider, Type, CategoryValue, ActivityStatusValue | extend TotalMinutes_Offline = datetime_diff('minute', now(), StartTime) | where TotalMinutes_Offline >= ThresholdTime and ActivityStatusValue1 !has "Resolved" | order by TotalMinutes_Offline desc

Operational flow

ARM Template: microsoft-security-operations-toolkit/Microsoft Sentinel/Automation/Playbooks/AzureArcServerMonitoring.playbook.json at 1e3aeff329e0d9b1d7caf2e4bfbc8476dfdb2ff2 · Abhishek-Sharan/microsoft-security-operations-toolkit

Customization Ideas:

Adjust the heartbeat threshold based on server criticality or business hours.
Route summaries to different teams based on subscription, resource group, or server tags.
Send notifications to Microsoft Teams in addition to, or instead of, email.
Enrich the output with owner, business service, or environment metadata.
Trigger incident creation only for high-priority or repeated visibility gaps.

Closing perspective

The best SOC automations do not just collect signals—they create clarity. This playbook helps security teams spot Arc-related monitoring gaps early, reduce noise, and act with more confidence.

Stop Hand-Building VMs at 2 AM: Automated Image Pipelines with Azure Image Builder and Compute Gallery

Pierre_Roman — Fri, 10 Jul 2026 07:00:00 GMT

Hello Folks!

If you have ever stood up a marketplace Ubuntu VM, SSH’d in, layered on your monitoring agent, security tooling, a couple of CA certs, and a hardening script, then captured the result and called it your “golden image,” I have bad news. That image was already drifting from the next one your coworker built before you finished naming the snapshot. At the Microsoft Azure Infra Summit 2026, Sandeep Raichura (PM for Azure Compute Gallery) and Kofi Forsen (PM for Azure VM Image Builder) rebuilt the whole workflow the right way. Source, customize, validate, distribute, deploy. No clicks. No tribal knowledge. No 2 AM heroics.

📺 Watch the session:

Why IT Pros Should Care

You carry the pager when a bad image rolls into ten regions. You explain why three teams have three different Ubuntu 22.04 baselines with three different agents. You find out at 2 AM that someone deleted “the old image” and the old image was the one production VMSS was still pulling.

This session is in your lane. It covers:

Why hand-rolled images stop working the moment a second team needs one.
How Azure VM Image Builder (AIB) turns image creation into declarative pipeline code.
How Azure Compute Gallery handles versioning, replication, sharing, and accidental-deletion protection.
How automatic image creation triggers chain a marketplace update through your golden image, into every downstream image, with zero manual steps.
How VM Scale Sets close the loop with rolling upgrades and automatic OS upgrade.

In short, this is the practitioner version of “do VM image management properly,” from the PMs who own both services.

What is Azure Image Builder and Azure Compute Gallery

The two services do different jobs and you really do need both.

Azure VM Image Builder is the build engine. You hand it a JSON template that declares:

A source (marketplace image, managed image, VHD, or existing gallery version).
Customizers (shell, PowerShell, Windows updates, file copies, restart steps).
One or more distribute targets (usually a Compute Gallery image definition).

AIB spins up a temporary build VM, runs your customizers in order, validates, generalizes, captures, and publishes. Every build runs the exact same way. No SSH, no RDP, no “I forgot to install the monitoring agent this time.”

Azure Compute Gallery is the management layer for the resulting artifacts. Formerly Shared Image Gallery, it has three levels:

Gallery. The top-level container. Sharing policy lives here: RBAC, Direct Shared Gallery, or Community Gallery.
Image definition. The metadata. OS type, generation, security type, publisher / offer / SKU. The SKU of an image family.
Image version. The actual replicated artifact. Controls regions, replica counts, storage type (ZRS by default), end-of-life date, and the safety flags.

AIB writes the artifact. Compute Gallery stores, versions, replicates, and shares it.

Building an automated image pipeline

The session walked through the five steps a real pipeline needs, with no manual intervention in the critical path:

Source. A marketplace image or any other base.
Customize. Scripts that install agents, harden, configure, and validate. Stored in a storage account so AIB can pull them with the right managed identity.
Validate. Built-in validation hooks plus your own smoke tests baked into the customizer. Fail fast. Do not silently continue.
Distribute. Push the captured image to a Compute Gallery image definition. Pick your regions and replica counts here.
Version. Compute Gallery handles semantic versioning, replication, and safety flags.

The trick that makes this a real pipeline is the two-template pattern Kofi demoed:

A source template builds the org-wide golden image from the marketplace base. Its source reference is set to latest for the marketplace SKU (for example, Canonical Ubuntu 22.04 latest).
A distro template layers user-group-specific tooling on top of the golden image. Its source reference is the golden image gallery version, also set to latest.

Both templates get an automatic image creation trigger attached. Triggers only fire when the template references latest. From that point on:

Canonical publishes a new Ubuntu 22.04. The source template’s trigger fires, AIB rebuilds your golden image, and a new version lands in the source gallery.
That new golden image version fires the distro template’s trigger. AIB rebuilds every downstream distro image automatically.
VM Scale Sets configured for automatic OS upgrade pick up the new image version and roll it out in batches, pausing if the Application Health probe goes red.

You set it up once. After that you only come back when you want to change something on purpose.

Safety by design in Compute Gallery

A bad image at the top of this chain takes out thousands of VMs at the bottom. Sandeep was clear: safety is not optional, it is built in. The four features worth turning on every time:

ZRS storage by default. Image versions stored on zone-redundant storage so a zonal failure does not take the image down.
Exclude from latest. Stage an image into a region without making it the default for new deployments. Flip the flag when you are ready to roll. You can set this globally on the version or per region.
Block deletion before end-of-life. The image cannot be deleted until its end-of-life date. This is the flag that stops the 2 AM accidental delete.
Soft delete. If everything else fails, soft delete gives you a recovery window to restore an image version that should not have been removed.

Combine those four with a sane end-of-life date on every version and your blast radius drops dramatically.

Real-world scenarios

A few patterns that came up in the session and the Q&A:

Multi-region fleets. Define your target regions in the AIB template. AIB hands the artifact to Compute Gallery and Compute Gallery does the replication. Your scale sets in every region pull a local replica, not a cross-region copy.
Open-source publisher. Use a Community Gallery so anyone in Azure can deploy your image. You provide a contact URL and email at the gallery level so consumers know where to file issues.
Partner sharing. Use Direct Shared Gallery to grant specific subscriptions or tenants access without making the image public.
VM Scale Sets with rolling upgrade. Reference the image definition (not a specific version) when you create the scale set. The scale set tracks latest. Pair it with a rolling upgrade policy and the Application Health extension. AIB publishes, Compute Gallery replicates, the scale set rolls, and the rollout pauses itself if the Application Health probe goes red.

Getting Started

Pick the highest-pain item and start there. You do not have to do this all at once.

Stand up a Compute Gallery in one region. Create one image definition with proper publisher / offer / SKU metadata. Turn on soft delete at the gallery.
Wrap an existing build script in an AIB image template. Use a marketplace image as the source. Distribute to your new gallery.
Add excludeFromLatest, endOfLifeDate, and the block-deletion flags to your image version. Default to ZRS storage.
Register the Microsoft.VirtualMachineImages and the triggers feature. Attach an automatic image creation trigger to the template. Set the source reference to latest.
Build a second template that takes your golden image as its source. Attach a trigger to that one too.
Create a VM Scale Set that references the image definition and enable automatic OS upgrade with rolling upgrades and the Application Health extension.

That is the loop. Source updates flow through automatically. Bad images do not delete each other. Fleets roll forward in batches.

Resources

Azure VM Image Builder overview. The service concepts, supported OS, regions, and capabilities.
Azure Compute Gallery overview. Gallery, definition, version, replication, and sharing.
Azure VM Image Builder best practices. Identity, networking, customizers, and operational guidance from the product team.
Automatic Image Creation with Image Builder triggers. Step-by-step to wire up source-image triggers.
Create an image definition and image version. Portal, CLI, PowerShell, and REST flows for publishing artifacts.
Automatic OS image upgrades for VM Scale Sets. The closing leg of the pipeline.
Share images using Community Gallery. Public, non-commercial sharing for open-source publishers.
Azure Image Builder samples on GitHub. Reference templates, customization scripts, and end-to-end examples.

Watch the rest of the Summit

This session was one of many at the Microsoft Azure Infrastructure Summit 2026. If you want the keynotes, the IaC deep dives, the AKS sessions, and the rest of the infra track, the full playlist is here:

Microsoft Azure Infra Summit 2026 playlist

Cheers!

Pierre Roman

Available today: OpenAI’s GPT-5.6 in Microsoft 365 Copilot

xiasong — Fri, 10 Jul 2026 15:04:24 GMT

Starting today, OpenAI's GPT-5.6 family of models is available in Microsoft 365 Copilot—in Word, Excel, PowerPoint, Chat and Cowork. OpenAI and Microsoft partnered together to optimize GPT-5.6 for knowledge work across Microsoft 365 apps and make it the preferred model for Microsoft 365 Copilot. In addition to serving the models natively, Microsoft will also access OpenAI models directly through the API to bring GPT-5.6 to Microsoft 365 customers.

Knowledge work is complex—multistep, ambiguous, and spread across tools and files. With stronger reasoning for agentic, multi-step work, GPT-5.6 helps Copilot take on more of that complexity more efficiently, moving faster from initial ideas to more complete work. Microsoft 365 Copilot is AI built for work, where frontier models like GPT-5.6 are an important part of a broader system designed to deliver business value—bringing together Work IQ, Microsoft 365 apps, and the enterprise-grade security, compliance, and privacy customers expect from Microsoft.

Higher-quality work across apps you use every day

GPT-5.6 helps Copilot raise the quality of everyday work in Word, Excel, and PowerPoint, moving from rough intent to stronger drafts, clearer analysis, and richer presentation drafts.

In Word, Copilot can help turn rough ideas into more complete drafts, organize content with stronger structure and flow, and refine writing into a more polished artifact.

In Excel, GPT-5.6 helps Copilot reason through more complex analysis and move from task to outcome with less manual assembly.

In PowerPoint, Copilot can create richer presentation drafts with stronger slide content, better visual balance, and more flexibility across presentation styles.

Across these apps, GPT-5.6 helps Copilot take on more of the steps between idea and finished work, while keeping knowledge workers in control of the final outcome.

Reason through complex asks in Chat

In Copilot Chat, GPT-5.6 helps Copilot reason through more complex asks—comparing options, structuring plans, troubleshooting problems, and working through ambiguity—to turn open-ended prompts into clearer, more actionable responses.

Get complex work done in Copilot Cowork

GPT-5.6 also strengthens agentic work in Copilot Cowork, carrying complex multi-step tasks from instruction to completed results. You describe the outcome, and Cowork plans, reasons across tools and files, and runs the work end-to-end, returning a finished deliverable, not just a draft or recommendation. With GPT-5.6, Cowork can execute efficiently and produce outputs that are more complete, polished, and usable from the start. Paired with Work IQ, grounded in the systems your business runs on, Cowork brings the right context to each step so the work reflects your files, tools, and business context. You spend less time assembling the work and more time deciding what to do with it.

Get started today

The shift in how work gets done is real—and choosing the right model for the task at hand matters.

GPT-5.6 is rolling out to Copilot in Word, Excel, PowerPoint, Chat, and Copilot Cowork. Once available, Copilot may automatically use GPT-5.6 when it's best suited for the task. Where model selection is available, users can also choose GPT-5.6 directly from the model selector.

Availability may vary by region and tenant configuration; refer to Microsoft Learn documentation, the Microsoft 365 Roadmap and Microsoft 365 Copilot release notes for the latest rollout status.

For more details on the model, see OpenAI’s GPT-5.6 announcement here.

Scale without friction: Grow Marketplace revenue without growing your team

Brady-B — Fri, 10 Jul 2026 16:49:56 GMT

This is a series about how App Advisor can help software development companies streamline their build, publish, and growth through Marketplace; find the answers they need when they need them; and get curated, step-by-step guidance.  

_______________________________________________________________________________________________________________________________________________________________

As your business goals grow, expertise can become the bottleneck. Whether you're launching your first offer on Microsoft Marketplace or managing a portfolio of applications and AI agents, success can quickly become dependent on a handful of experts, consultants, or internal champions.

Every layer of people you add has the potential to add friction.

Teams wait for answers. Decisions stall. Opportunities slip. Skilled resources spend their time answering the same questions instead of driving strategic initiatives.

App Advisor was built to help software companies streamline and scale easily, through AI-powered guidance, self-service enablement, and a scalable operating model. All without adding headcount or compromising expertise.

Growth shouldn't depend on finding the right expert

Marketplace knowledge can be scattered across documentation, support channels, partner contacts, and internal subject matter experts. As organizations grow, getting the right answer can take longer than making the decision itself.

App Advisor delivers free, on-demand guidance tailored to where you are on your Marketplace journey instead of requiring specialized knowledge or access to a dedicated resource.

For instance, choosing a Marketplace offer type can be difficult, demanding diving into resources and choices personalized to how your team built your solution. In App Advisor, you can decide in minutes by answering a few questions in an interactive wizard to guide your offer type choice. This can help you make a confident choice quickly and move forward. If you want to research more, guidance is available on page and within links.

What can sometimes be a hurdle to publishing is now just a few answers away. Now, progress isn't limited by expert availability.

Turn expertise into a scalable advantage

Traditionally, supporting more agents and apps meant hiring more people, which meant introducing more processes, workflows, and decision-makers. That model introduces more variables, making it difficult to scale.

App Advisor helps your team stay lean. You get embedded AI-powered guidance and expert-backed best practices directly in the experience, helping your team progress faster, discover relevant resources, and keep moving without constant human intervention.

Within the grow stage, the Marketplace Listing Optimization gives you tailored recommendations based on Microsoft editorial best practices at the speed of AI. Instead of waiting for manual reviews or guessing what "good" looks like, you can improve your listing at your pace and publish with greater confidence.

Expertise is available anytime, to anyone, at scale.

One platform for every stage of the Marketplace journey

Business growth isn't just about launching one application.

Most software companies are managing multiple products, exploring AI opportunities, expanding go-to-market motions, and improving existing Marketplace offers; all at the same time.

App Advisor supports the entire Marketplace lifecycle—Discover, Build, Publish, and Grow—giving every team a common framework while delivering recommendations tailored to their specific stage.

Teams can:

Calculate the ROI of selling on Marketplace,
Streamline dev with click-to-deploy development patterns,
Choose the right offer type based on your technology and project,
Improve Marketplace listing quality and discoverability in seconds,
Navigate publishing requirements for your offer type with confidence,
Access sales acceleration resources and Marketplace growth recommendations.

Instead of creating different processes for different teams, App Advisor standardizes execution while remaining flexible enough to support organizations at every stage of maturity.

Reducing dependencies to accelerate momentum

Partner Development Managers, Microsoft experts, and support teams remain incredibly valuable. But rather than spending time answering basic questions, their greatest impact comes from solving strategic challenges.

By making end-to-end build-to-market expertise available through structured workflows, templates, AI-powered recommendations, and guided experiences, App Advisor frees up Microsoft resources to assist your team with their biggest challenges—not just the annoying and persistent ones.

The benefits across the organization compound:

Bottlenecks disappear.

Teams get answers faster.

Everyone keeps moving forward.

Microsoft expertise becomes available at scale.

By making the easier stuff easy to find, the quality of the relationship—and value of expertise—between your team and Microsoft resources improves dramatically. Building momentum becomes the default instead of the exception.

Scale your reach, not just operations

Internal efficiency is only part of the story. The real opportunity comes from the Marketplace ecosystem itself.

Marketplace gives software companies access to enterprise buyers across nearly every industry and geography, including approximately 98% of the Fortune 500, while connecting partners through a global co-sell ecosystem of more than 500,000 partners.

Building that kind of distribution independently would require years of investment in sales, partnerships, and operations.

Marketplace provides the reach. App Advisor helps you activate it.

Looking ahead

The fastest-growing software companies aren't always the ones with the biggest teams. They're the ones that build systems capable of scaling knowledge, execution, and opportunity.

App Advisor combines Marketplace expertise, AI-powered recommendations, self-service guidance, and structured workflows into a single experience designed to help software companies grow without growing operational complexity.

Sustainable growth isn't about hiring more people to manage more friction. It's about removing the friction so growth can scale with you.

Ready to get started? Find the exact right place to begin with App Advisor. 

Secure Native Access to Azure Kubernetes Service (AKS) Private Clusters with Azure Bastion

saikishor — Sat, 11 Jul 2026 06:39:04 GMT

Written in Collaboration with AvirupChat ShabazShaik Mohit_Kumar YuriDiogenes

Introduction:

As organizations move toward containerized workloads such as Azure Kubernetes Service (AKS), secure access to cluster resources becomes critical. Making the Kubernetes API server private, therefore, significantly reduces the attack surface. However, it also changes how engineers perform routine management tasks. Operations as simple as running kubectl logs, describing resources, or troubleshooting workloads require connectivity to the virtual network hosting the cluster.

This challenge becomes even more apparent during day-to-day operations. An engineer may have the necessary Kubernetes credentials and Azure RBAC permissions yet still be unable to access the cluster because the API server is reachable only from within the private network. Establishing VPN connectivity, using jump hosts, or deploying dedicated management workstations often becomes part of the operational workflow, adding complexity to what should be straightforward administrative tasks.

This balance between maintaining strong network isolation and enabling efficient cluster management is exactly what Azure Bastion's native client tunneling support for private AKS clusters is designed to address.

Many Azure customers already use Azure Bastion to securely access virtual machines without exposing them to the public internet. Native client tunneling now brings that same secure access model to AKS private clusters. This capability is in public preview today. Before discussing how it works, it is worth understanding the operational challenges it is designed to solve and how it's done.

Bastion for Azure Kubernetes Service (AKS) private clusters:

At its core, Azure Bastion is designed to simplify secure access to private Azure resources. Since its launch, it has provided browser-based and native client RDP and SSH connectivity to Azure VMs without exposing management ports to the internet. No public IPs on your VMs. No inbound NSG rules for port 22 or 3389. Just TLS over port 443, routed through a fully managed service that Microsoft patches, scales, and secures on your behalf.

When you establish a Bastion tunnel to your private AKS cluster, you are not signing in to an intermediary machine and running kubectl from there. You are opening an encrypted tunnel from your local machine, through Bastion, directly to the private API server endpoint. Your kubeconfig points to localhost on a dynamically assigned port, so local kubectl, helm, and scripts continue to work as they would against a public cluster.

You get the developer experience of a public cluster with the security posture of a private one as shown in Figure 1.

The high-level flow has three parts: The engineer authenticates to Azure, retrieves cluster credentials, and uses Azure Bastion to establish a managed tunnel into the private network. Local Kubernetes tools then use that tunnel to reach the private API server. This keeps the workflow familiar while removing the need for jump hosts or VPN-based access paths.

However, this raises an important question - Does making access easier also make it easier for an attacker to connect?

The short answer is no. In fact, Bastion tunneling strengthens the security posture in ways that are worth unpacking.

First, the API server itself remains private. There is no public endpoint. There is no public IP address discoverable by scanners. The only network path to the API server runs through Azure's managed infrastructure. Authentication and authorization then depend on the AKS cluster configuration.

Second, Bastion eliminates an entire class of infrastructure that itself becomes a security target. Jump box VMs, when not meticulously maintained, accumulate credentials, kubeconfig files, and browser sessions. They are machines that admins log into, which means they are machines that can be compromised. Bastion is not a machine you log into. It is an agentless, managed tunnel you pass through.

And for public clusters, there is a related but distinct benefit. Many teams use API server authorized IP ranges to restrict which source IPs can reach their public API endpoint. This is a good practice, but it breaks down quickly when your team works remotely, uses dynamic IPs, or includes contractors. Adding Bastion's stable public IP to the authorized range gives you a consistent, managed access path without the operational toil of constantly updating IP allow lists.

With the network path established through Bastion, the next question is how users are authenticated and authorized once they reach the AKS API server. That distinction matters: Bastion provides secure connectivity, while AKS access is governed by the authentication and authorization model configured on the cluster.

Authentication and authorization options:

When creating an AKS cluster, you can choose from three authentication and authorization modes, as shown in Figure below. That choice shapes everything about how access is granted, audited, and governed over the lifetime of the cluster.

⚠️Local accounts with Kubernetes RBAC is the default if you change nothing. It uses a static certificate that never expires, is shared across all administrators, and has no connection to your corporate identity provider. There is no MFA. No Conditional Access.

Note: For most production environments, Microsoft recommends using Microsoft Entra ID integrated authentication rather than local accounts to enable centralized identity, MFA, and auditing.

☑️ Microsoft Entra ID with Kubernetes RBAC moves authentication to Entra ID, which means users sign in with their corporate identity, MFA is enforced, and Conditional Access policies apply. Authorization is handled through native Kubernetes Role and ClusterRole bindings, which reference Entra ID users and groups as subjects. This works well for teams that manage cluster configuration through GitOps, because RBAC manifests live alongside other cluster YAML. The limitation is that these permissions are invisible in Azure IAM — they live only inside the cluster.

✅ Microsoft Entra ID with Azure RBAC is the model we recommend for most production environments. Authentication still flows through Entra ID with full MFA and Conditional Access support. But authorization is handled by Azure RBAC role assignments on the AKS resource itself. Permissions are visible in Azure IAM, participate in access reviews, and integrate with Privileged Identity Management for just-in-time elevation. You can assign the built-in Azure Kubernetes Service RBAC Cluster Admin, Admin, Writer, or Reader roles at either cluster scope or namespace scope. A single subscription-level role assignment can grant access to every cluster in the subscription.

The real value is the combination. Bastion provides the encrypted network tunnel. Entra ID provides the identity, MFA, and Conditional Access. Azure RBAC provides centralized, auditable authorization that your security team can review alongside every other Azure resource.

For the exact steps to configure Entra ID authentication and Azure RBAC on your AKS cluster, see the AKS identity documentation.

End-to-end flow for connectivity to AKS via Bastion:

az account set --subscription <subscription ID>

Retrieve credentials to your AKS private cluster using the commands below:

az aks get-credentials --name <AKSClusterName> --resource-group <ResourceGroupName>

Open the tunnel to your target AKS Cluster with the following command:

az aks bastion --name <aksClusterName> --resource-group <aksClusterResourceGroup> --bastion <bastionResourceId>

Now the default authentication method is Device code authentication i.e., this authentication method prompts the device code for the user to sign in from a browser session. If you want CLI only authentication, you can run the following command next.

kubelogin convert-kubeconfig -l azurecli

Then go on with your AKS connectivity:

kubectl get nodes

How to Try It:

If you are already running private AKS clusters, getting started is straightforward. You need a Standard or Premium Azure Bastion host deployed in the same VNet as your cluster (or in a peered VNet), with native client support enabled. The aks-preview and bastion CLI extensions handle the rest.

The detailed connection steps are documented on Microsoft Learn.

We Want Your Feedback

Write a comment in this blog or open an issue on the AKS GitHub repository or leave feedback directly on the Microsoft Learn documentation page. We read everything, and it genuinely influences what we prioritize.

Microsoft Foundry Model Deployment Pricing Update

Chris Hoder — Thu, 09 Jul 2026 17:22:45 GMT

Today, Microsoft Foundry is announcing updated pricing for model deployments in the EU Data Zone and in Regional deployments outside the US, effective September 1, 2026, alongside a new APAC Data Zone. The reason is choice: Foundry keeps widening your options across cost, performance, and data residency, and because delivering AI within a specific geography or country at high availability costs more than serving from a shared global pool, the updated pricing reflects both that cost and the added value these options provide.

Pricing Update starting September 1, 2026

Running AI in a specific geography or country, at high availability, costs more than running in a shared global pool. To reflect that, pricing for Data Zone and Regional deployments outside of the United States is increasing on September 1, 2026*. Global pricing stays the same and remains your most cost-efficient choice.

Table 1: Pricing Update starting September 1, 2026

Deployment	Price vs. Global **	What’s changing
Global	Same	No change
APAC Data Zone (new)	20% higher	Newly available
EU Data Zone	20% higher	Increasing
US Data Zone	10% higher	No change
Regional — US	10% higher	No change
Regional — outside the US	25% – 50% higher	Increasing

Tabel 2: Regional pricing effective September 1, 2026 (price relative to Global)

New price vs. Global	Regions
+25%	Australia, India, Indonesia*, Malaysia, New Zealand**
+30%	Austria*, Belgium, Canada, Denmark**, Germany, Italy, Mexico, Poland, South Africa, Spain, Sweden, Switzerland, UAE
+35%	Japan, Korea, Taiwan***
+40%	France, Hong Kong, Israel***, Norway, Qatar, UK
+50%	Brazil, EU North, EU West, Singapore

*How the change applies:

Standard (pay as you go): the planned premiums apply only to models launched on or after September 1, 2026. Customers who stay on their current models see no price increase; the higher EU Data Zone and Regional premiums apply only when they move to a model launched on or after September 1, 2026.
Provisioned Throughput (PTU): the increase applies to all customers with EU Data Zone or Regional PTUs outside of the US.

** For Data Zone and Regional deployments, price premiums are relative to Global pricing. Please see Azure pricing page for most current rates.

***Newly available regions at this price (no prior rate).

For exact, current rates by model and deployment type, see the Azure pricing page.

Learn more about Foundry model deployment types and regions here.

More Options across cost, performance, and data residency

Foundry’s core differentiator is choice. Foundry aims to be your platform of choice providing a single suite of offers that span not only models, performance tiers but also data processing requirements. This enables you to have control over your data all within the same, common code.

Here is where your requests can run:

Global — processing runs wherever Microsoft’s global infrastructure has capacity, built for agility and cost-efficiency.

Data Zone (US, EU, and now APAC — processing stays within the selected geography to support regional data residency requirements.

Regional — processing stays in-country for the strictest requirements.

How you run is a differentiator too. Choose Standard for flexible, agile, and economical scaling, Priority Processing for low-latency real-time apps, Provisioned Throughput (PTU) for predictable performance at scale, or Batch for high-volume jobs at the lowest cost of the four options. You can mix and match per workload. The instant model deployment experience is designed to reduce the setups friction so developers can go from model selection to first inference faster.

Foundry also keeps getting more efficient. The model router in Foundry Models matches each request to the most appropriate model, balancing quality, latency, and cost. Prompt Caching cuts redundant computation for recurring and long context interactions. PTU Spillover and quota optimization preserve service continuity through usage spikes. Together, these capabilities are designed to improve token efficiency, reduce compute cost, and shift more tuning into the platform rather than manual work.

Learn how to optimize model deployment and performance in Microsoft Foundry.

Choosing where AI processing happens

Where your AI requests are processed can affect both latency and compliance. Many organizations have data residency requirements that shape where they can run AI. Data Zone and Regional deployments let you keep processing within a chosen geography or country while using the same models and tooling available elsewhere on Azure. You remain responsible for determining whether a given configuration meets your regulatory obligations; Foundry provides deployment options that can support those requirements.

As Hongsoo Kim, Chief Data and AI Officer at Toss, put it, Foundry keeps “data processing regionally anchored while accessing advanced AI models at scale”- giving the confidence to “accelerate AI innovation responsibly.”

Build your next AI workload on Foundry

Whatever the workload calls for — lowest cost, low latency, an SLA, or strict data residency — there’s a Foundry deployment that fits. Start building today in Microsoft Foundry.

The Copilot specialization is receiving key updates—including an audit

JS5 — Thu, 09 Jul 2026 17:20:59 GMT

Microsoft is updating the Microsoft Copilot specialization to better align with market demand. Beginning July 2026, the specialization will be renamed Microsoft 365 Copilot specialization and will introduce updates across performance, skilling, and validation requirements.

The performance requirement will be shifted to account only for paid monthly active usage (MAU) growth.
The skilling requirements will be refreshed. We are removing the Microsoft 365 Certified: Administrator Expert (MS-102) certification and adding the Agentic AI Business Solutions Architect (AB-100) and AI Agent Builder Associate (AB-620) certifications to address the retirement of the Create custom agents with Microsoft Copilot Studio (APL-7008) applied skill. Please note that the Prepare security and compliance to support Copilot (APL-4002) applied skill is also retiring, and the Implement information protection in Microsoft 365 (SC-401) certification will be required.
The customer references requirement will be replaced with a third-party capabilities audit. This audit update is part of a shift to an independent, objective validation process and helps ensure that partners meet a consistent, verifiable standard for Microsoft 365 Copilot capability. The badge you’ll earn with this specialization is a visual indicator to customers that your expertise has been verified by Microsoft—and that your capabilities align to customer needs.

These updates empower partners to invest in the capabilities customers value most. Work toward earning your specialization today to demonstrate your deep technical expertise.

Review the updated requirements for the Microsoft 365 Copilot specialization, including the audit checklist.

Build a patch strategy for today’s threat pace with Microsoft

Intune_Support_Team — Fri, 10 Jul 2026 17:18:27 GMT

AI-accelerated vulnerability discovery and remediation are changing how organizations manage risk. As discussed in Pavan Davuluri’s recent blog, Microsoft is investing across the vulnerability lifecycle to help organizations identify, validate, and respond faster.

For IT and security teams, one challenge lies downstream: deploying fixes quickly across endpoints to reduce exposure. Each update needs to be evaluated, piloted, monitored, and enforced across a mixed fleet of devices and apps. Some parts of the estate can move quickly; others cannot because of compliance requirements, approved change windows, and business-critical dependencies.

As organizations adopt AI tools and agents across their environment, maintaining a current and hardened endpoint estate becomes increasingly important. In this context, patching becomes an ongoing operational discipline that combines OS, app, and driver updates with compliance enforcement, access control, and security baseline hardening.

To keep pace, organizations need a patch strategy that helps in 3 stages:

Mitigate: automate updates that can move quickly
Assess: prioritize risk based on exposure and severity
Contain: enforce compliance and limit exposure

Operationalizing a patch strategy requires coordinated capabilities across endpoint management and security tools. Microsoft Intune brings these capabilities together in a single admin center, alongside the broader Microsoft security ecosystem, and is available with qualifying Microsoft 365 subscriptions¹.

In this post, we show how organizations can use these capabilities to build a patch strategy that helps reduce the time between update release and deployment across their endpoint estate.

1. Mitigate: automate updates that can move quickly

A patch strategy is not about pushing every update everywhere at once. It’s about identifying the parts of your estate that can move quickly, then using automation, rings, monitoring, and enforcement to help those updates move with confidence. Regulations, approved change windows, validation needs, and business dependencies will shape what’s possible, but the strategy starts by separating repeatable update work from the exceptions that need deeper review.

For OS, app, and driver updates that can move quickly, modern tools can help shorten the time between update release and deployment; without manual rollouts, ticket-driven packaging, or reboot disruption.

Operationalize in Intune

Windows Autopatch orchestrates ring-based update rollouts to reduce manual effort and keep Windows devices current. To help monitor risk, the Autopatch report visualizes how quickly devices apply updates based on the configured deployment cadence. In this report, devices are categorized as current within three days of update release, at risk between three and seven days, and at critical risk beyond seven days, based on the reporting model used by Windows Autopatch. Learn more about ring-based rollout updates or how to reassess Windows OS updates using this report.
Hotpatch (enabled by default for 24H2+ in Intune) applies critical updates without requiring a reboot, helping reduce security gaps while keeping users productive.

Figure 1: Watch the latest Microsoft Mechanics episode to see how Windows Autopatch and Hotpatch help organizations accelerate update deployment, reduce operational overhead, and keep devices secure.
Intune Enterprise App Management (EAM) supports keeping Windows apps current through auto-updates, including the guided upgrade supersedence reporting, which surfaces outdated versions or version changes. EAM auto-updates are now generally available; details are included in the June Intune What’s new blog.

Figure 2: Watch how Intune helps you move from update release to deployment to accelerate responses to vulnerabilities with Windows app management.
The enhanced application inventory in the All apps page shows the app version installed on each managed Windows device, refreshed multiple times per day on most active devices, helping teams target app-specific vulnerabilities and confirming when fixes have been applied.
The Vulnerability Remediation Agent in Security Copilot uses data from Defender Vulnerability Management to prioritize Common Vulnerabilities and Exposures (CVEs) across Intune-managed Windows devices and apps, and provides recommended remediation actions within Intune. The Vulnerability Remediation Agent is currently in public preview, read the blog to learn more.

Figure 3: Watch this video to see how the Vulnerability Remediation Agent in Security Copilot, within Microsoft Intune, helps make agentic security easier to adopt and use.

Extend across your endpoint estate

Apple devices can be configured for automatic OS updates on managed devices, including enforcing updates to the latest version and deploying Background Security Improvement patches through the settings catalog. App updates can be managed by configuring volume-purchased App Store apps to update automatically and deploy updated app packages to keep apps current across macOS, iPhone, and iPad devices.
Android devices can be managed using built-in update policies in Intune, including configuring install windows and freeze periods. For corporate Android fleets, Intune also integrates with OEM firmware management solutions - including Zebra LifeGuard Over-the-Air and Samsung E-FOTA - to enable more granular update control. Managed Google Play also supports configurable app auto-update modes, allowing admins to define whether updates install automatically, on Wi-Fi only, or manually.

2. Assess: prioritize risk based on exposure and severity

The first step is reducing exposure across the parts of your estate that can move quickly. But not every system, application, or vulnerability can be addressed through broad update deployment. Teams also need a way to determine which risks require immediate action and which ones can be addressed over time.

A calendar-based approach can treat every CVE equally. However, it doesn’t account for severity, exposure, or business impact. As AI accelerates vulnerability discovery, this can lead to effort being spent on lower-risk updates while higher-risk updates remain unaddressed.

Risk-based service level objectives (SLOs) help bring prioritization to address this challenge. Instead of patching on a fixed schedule, IT and security teams can align response timeframes by severity, moving quickly on actively exploited or critical vulnerabilities, and applying a more measured approach where risk or impact is lower.

This stage creates a clearer prioritization of remediation and helps bridge the view between the security teams that identify threats and the IT teams that act on them.

Operationalize in Intune and Microsoft Defender

The security update status dashboard in Intune provides an aggregated view of update compliance across Windows clients, Windows servers, and Microsoft 365 Apps. It shows overall counts of devices in different states across Intune-endpoints and helps teams identify where remediation should be focused. These status categories reflect how quickly devices apply updates based on a configured deployment cadence and internal SLOs.

Figure 4: Security update dashboard showing patch status for Windows clients, servers, and Microsoft 365 apps.
Microsoft Defender Vulnerability Management surfaces CVEs, affected devices, vulnerable software, and recommended remediation actions, offering a shared view of risk and progress across IT and security teams.
Translate Defender recommendations into targeted Intune actions described in the mitigate section, such as updating software or moving devices through expedited remediation workflows so teams can focus on vulnerabilities that are actively exploited or most likely to affect an organization.

Extend across your endpoint estate

For Apple devices, use the Apple software update report in Intune to monitor update status across macOS, iOS, and iPadOS.
For Android, compliance reporting surfaces devices that fall behind on OS version or security patch level.

3. Contain: enforce patch compliance and limit exposure

Even with automated deployments and prioritized triage, gaps can remain. Some devices are unsupported, fall behind, operate on slower deployment rings, and others can’t be patched quickly. A patch strategy needs to focus on including containment for those surfaces.

Compliance controls, conditional access, and device hardening act as an always-on safety net that limits risks that can fall through gaps. Compliance policies and Conditional Access can use a patch state as a signal for resource access, preventing non-compliant devices from accessing corporate resources. Security baselines reduce the attack surface by limiting risky defaults and common attack patterns. Together, these controls shift enforcement from a periodic activity to a continuous condition across a fleet.

Operationalize in Intune and Defender

Use compliance policies in Intune to define what "current" means, including minimum OS build, required update levels, risk status, and encryption state.
Use Conditional Access (managed in Microsoft Entra, accessible from the Intune admin center) to control access to company resources based on user and device health. Combined with threat signals from Microsoft Defender, these policies help prevent non-compliant devices from accessing corporate resources.
Use Microsoft Defender Vulnerability Management and Microsoft Security Exposure Management insights to identify exposed assets, prioritize remediation, and apply recommended protections where patching must move more slowly.
Apply Intune security baselines to establish Microsoft-recommended configurations on Windows devices, such as disabling risky defaults, blocking common attack techniques, and reducing configuration drift. Watch this demo on security baselines being applied in the Zero Trust workshop.
Use attack surface reduction policies in Intune to deploy Microsoft Defender for Endpoint protections, such as ASR rules and network protection, that help block common attack techniques on devices that can't be patched right away.

Figure 5: Watch this Demo on how you can manage devices and implement Conditional Access with Intune.

Extend across your endpoint estate

Compliance policies and Conditional Access controls apply across Windows, macOS, iOS/iPadOS, and Android.
Intune app protection policies extend compliance requirements and data protections to managed apps used for work on personal devices and add an additional layer of data protection on corporate devices.
Use the settings catalog and configuration profiles to apply the same hardening intent on macOS, iOS/iPadOS, and Android, reducing configuration drift across platforms.

Stay ahead with a patch strategy

As vulnerability discovery and response continue to accelerate, organizations need an operational strategy that balances speed, risk, and resilience. By automating updates where possible, prioritizing remediation based on exposure, and limiting exposure through compliance and security controls, teams can reduce risk across their endpoint estate.

Intune helps simplify this approach by bringing these capabilities together alongside the rest of your Microsoft security tools and ecosystem.

Get started with Microsoft Secure Now to assess risk across your digital estate.
Explore the new security update status dashboard in Intune.
Harden the admin plane and review the best practices for securing Microsoft Intune.

¹ Licensing and requirements

Feature availability and included capabilities vary by Microsoft 365 subscription plan and feature. Some Microsoft capabilities referenced in this post may require specific licenses or additional enablement.

Advanced Microsoft Intune capabilities are now included in Microsoft 365 E5, with select capabilities available in Microsoft 365 E3 as part of updates effective July 1, 2026. Existing customers will receive a 30-day notice in the Microsoft Admin Center prior to availability, with access beginning by August 2026.

Microsoft Security Copilot and related AI capabilities may require separate licensing, learn more here.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.

This is the moment to shape what’s next for your hosting business

JillArmourMicrosoft — Thu, 09 Jul 2026 17:00:00 GMT

For hosting partners, today’s market shifts are more than a challenge—they’re an opportunity to modernize with intention and grow into what’s next. Customers are looking for partners who can deliver continuity today and a credible modernization path for tomorrow.

By acting early, you put yourself in a stronger position to preserve what works, modernize at a sustainable pace, and expand into higher‑value services—without disrupting existing relationships.

Here’s a clear path forward:

Start with clarity. Check out the one‑pager, “Turn hosting market disruption into a growth opportunity,” to align your organization on why now is the time to shift from traditional hosting to a services-led model.

Plan with confidence. The e‑book, Navigating the Next Era of Hosting, breaks down the Microsoft Adaptive Cloud strategy: how to run workloads where they make sense, manage them as a single environment, and grow into differentiated services.

Transform with support. Go from planning to action with the Microsoft Datacenter Optimization (DCO) site, which includes ongoing transition guidance, tools, FAQs, the Hybrid Cloud Partners podcast, and more.

Get started with the one-pager.

LiveKd v5.65, ProcDump v12.01, and ZoomIt v12.11

Alex_Mihaiuc — Thu, 09 Jul 2026 16:59:28 GMT

LiveKd v5.65

This update to LiveKd, a utility that allows running the kernel debugger on a live system, protects generated dump files from non-admin readers.

ProcDump v12.01

This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds bug fixes.

ZoomIt v12.11

This update to ZoomIt, a screen magnification and annotation tool, adds JPEG and WEBP snip support.

New blog articles in Microsoft Community Hub

Beyond the Canvas: The Azure Architecture Diagram Builder Becomes Agent-Ready

What’s new at a glance

From clicking to conversing: Architecture Chat

The whiteboard deliverable: Blueprint Diagrams (BETA)

A fleet of 13 models: pick the right brain per task

The headline: the Diagram Builder is now an MCP server

Grounded in Microsoft Learn, and sharper output

Highlights

Try It Today

Azure Front Door: Resiliency Series – Part 3: Tenant isolation

Welcome Back to AZ Update

Here is week 1!

Update #1 - Generally Available: Network Security Perimeter support for Azure Event Hubs

Why ITPros should care

Operational value

Real-world example with step-by-step guidance

Technical details including code examples

Comprehensive Resources

Update #2 - Generally Available: Confidential Computing support for Azure Event Hubs Dedicated

Why ITPros should care

Operational value

Real-world example with step-by-step guidance

Technical details including code examples

Comprehensive Resources

Update #3 - Generally Available: Support 5x churn in Azure Site Recovery

Why ITPros should care

Operational value

Real-world example with step-by-step guidance

Technical details including code examples

Comprehensive Resources

Update #4 - Generally Available: Microsoft Entra ID-based access for Azure Blob Storage SFTP

Why ITPros should care

Operational value

Real-world example with step-by-step guidance

Technical details including code examples

Comprehensive Resources

Introducing Layered Ingress Sharding: Achieving Single-Tenant Isolation in Multi-Tenant Services

Why Multi‑Tenant Isolation Is Still Hard at Hyperscale

From Traditional Sharding to Ingress Sharding

Introducing Layers: Isolation Through Independence

Layered Ingress Sharding

Why the Math Works

A Hidden Benefit: Identifying Bad Tenants

Beyond Azure Front Door

Closing Thoughts

mssql-python 1.11.0: Fixes for transaction semantics, Apple Silicon imports, and bulk copy

Upgrade

Highlights

with connection: now commits on success and rolls back on exception

Apple Silicon imports work on clean machines again

NULL BINARY and VARBINARY parameters bind more reliably

Bug fixes worth calling out

Shutdown and parameter-typing paths no longer hang SSH-tunnel-style forwarders

Bulk copy with service principal authentication no longer freezes

Upgrading

Thank you

July update: What’s new for partners in AI Business Solutions

News and Announcements

Incentives and Offers

Skilling and Events

Go-To-Market

Customer Success

Cross-Tenant Message Recall in Exchange Online

The intra-tenant boundary

Introducing cross-tenant Message Recall

How it works

Configuring with Exchange Online PowerShell

What senders and recipients see

Availability

Title Plan Update - July 10, 2026

📁July 10, 2026 - Title Plan Now Available

Access the latest Instructor-Led Training (ILT) updates anytime at http://aka.ms/Courseware_Title_Plan to ensure you're always working from the most current version.

New MRCA test for External user meeting join

New in Microsoft Marketplace: July 10, 2026

Get it now in our marketplace

Easily deploy virtual machine images

Go further with workshops, proofs of concept, and implementations

Contact our partners

When Arc Goes Silent: Turning Visibility Gaps into SOC Action