Power Azure SRE Agent with the tools it needs
What is the Azure SRE Agent Azure SRE Agent is an AI-powered service designed to reduce operational toil. Teams can use it to: Investigate incidents and identify probable causes. Automate health checks, compliance reviews, and other scheduled work. Answer questions such as “What changed before this service became degraded?” Propose remediations while allowing teams to require human approval. An effective investigation rarely depends on one source of information. An alert might originate in Azure Monitor, while deployment history lives in source control, telemetry stored in another observability platform, and incident records in a service-management tool. Without access to those systems, you must retrieve and transfer the information manually, adding context switching and slowing diagnosis. MCP servers can give SRE Agent tools to query telemetry, inspect deployments, retrieve database records, look up incidents, etc. SRE Agent provides native connection for some servers such as GitHub, Datadog, New Relic, and Splunk. Connector Namespace makes it easier to host additional remote MCP servers you want the agent to use. Removing remote MCP server hosting burden Connecting SRE Agent to an existing remote endpoint is straightforward. Hosting that endpoint yourself is not. You must deploy the server, provide secure HTTPS infrastructure, configure authentication, manage downstream credentials, scale the runtime, monitor its health, recover failed instances, and maintain it over time. These responsibilities are necessary, but the value is in the server’s tools not in operating another service. Azure Connector Namespace is a fully managed service for hosting connectors and MCP servers. You select the server you need and let the namespace handles the operational and maintenance tasks. The offering is currently in preview. See documentation for supported regions and other preview considerations. You’ll find a wide variety of servers in the Connector Namespace’s catalog. Some examples of useful servers for the SRE agent include: Database servers such as Azure SQL and Azure Cosmos DB Source control and CI/CD servers like GitLab Incident management servers like Jira and PagerDuty A note on what's currently in development: We're building “bring-your-own” server support, allowing you to supply your own server image while the namespace handles hosting and operations. Please keep an eye out for the blog post about this! Deploy server and connect it to SRE Agent The following example deploys the SQL MCP server in Connector Namespace and connects it to Azure SRE Agent. 1. Server deployment Prerequisite: Install the Azure Developer CLI (azd). Clone the sql-server-samples repo: git clone https://github.com/microsoft/sql-server-samples.git Navigate to the azure-sql-mcp sample cd sql-server-samples/samples/applications/azure-sql-mcp From the azure-sql-mcp folder, run the following to log into your Azure subscription and then deploy the server and related resources: azd auth login azd up The last command will prompt for the following before deployment: Prompt Suggested value Explanation Enter a unique environment name mcp-dev This name added as prefix to Azure resources created Select an Azure Subscription Pick your subscription Resources will deploy under this subscription Enter value for connectorNamespaceIdentityType UserAssigned User assigned identity is recommended as it’s not tied to resource lifecycle Enter value for deployerLoginName Enter your Azure subscription login email To give your identity access to the MCP server Enter value for the location Pick a supported region Supported regions: West Central US, Central US, East Asia, North Europe Once deployment finishes, copy the MCP endpoint for use later. It looks similar to: https://<app-name>.<region>.logic.azure.com/api/connectorGateways/123abc456defg7890/mcpServerConfigs/sql-mcp/mcp (Optional) Test deployed server in Visual Studio Code GitHub Copilot: Open command palette > search MCP: Add server > pick HTTP > enter MCP endpoint and server name > pick Local Workspace. Inside .vscode/mcp.json, click Start above server name, then allow authentication with Microsoft in the popup and log into Azure subscription account. 2. Configure MCP connector in SRE Agent Connector Namespace does not create the connection in SRE Agent. Add the server endpoint through SRE Agent’s existing MCP connection experience. Open the Azure SRE Agent portal On the left menu, go to Builder > Connectors, and select + Add connector Under Choose a connector, select the MCP tab, choose MCP server, and select Next Configure the connector: Field Value Name A descriptive name for the server Connection type Streamable-HTTP URI The hosted server endpoint from Connector Namespace Authentication method Managed identity (Selecting managed identity automatically creates an identity for the connector.) Azure AD token scope https://apihub.azure.com/.default Select Next. Before testing the connection, grant the managed identity access to the MCP server. 3. Authorize the managed identity Open the Azure portal, search for the managed identity by name. In the identity’s Overview page, click JSON View (top right) and copy the tenantId and principalId. The principal ID is also called the object ID. Open Connector Namespace portal and search for the deployed namespace. Inside the namespace, navigate to the MCP Connectors tab on the left, then select the SQL MCP server. Inside the MCP server, click Access Policies, then select Add Access Policy. Enter the tenant ID and principal ID, then select Create. 4. Test and finish the connection Return to Azure SRE Agent portal and select Test connection. After the test succeeds, select the server tools the agent should use. Select Add connector. Establishing the connection can take a minute. Select Refresh at the top of the connectors page until its status changes to Connected. The agent can now use the selected server tools in chat threads. The azd deployment from previous created and seeded a SQL database with sample blog post data, so you can ask something like: What are the top blog posts? For more details, see MCP connectors and tools in Azure SRE Agent. Focus on the server, not its infrastructure MCP servers can give Azure SRE Agent access to the additional systems it needs to investigate incidents and perform operational work effectively. However, operating every remote server yourself introduces infrastructure, security, and maintenance responsibilities that distract from that goal. Connector Namespace removes much of that friction. Your primary question becomes “Which MCP server do I want to host?” rather than “How will I deploy, secure, scale, monitor, and maintain it?” Once deployed, the hosted endpoint can be added to Azure SRE Agent through its existing MCP connection experience. That gives teams a straightforward path to extending the agent with more operational tools, without turning MCP server hosting into another platform they must build and run. Try Connector Namespace with Azure SRE Agent and share your feedback! Resources Azure SRE Agent Overview Set up an MCP connector in Azure SRE Agent Connector Namespace Overview Hosted MCP servers in Connector Namespace
From Features to Flow: How Real-World Adoption Reshaped the Azure Architecture Diagram Builder
In May, I introduced the open-source Azure Architecture Diagram Builder as a way to move from a natural-language prompt to an Azure architecture diagram, cost estimate, Well-Architected assessment, and deployment guidance. In July, I shared how the project had become agent-ready through Model Context Protocol (MCP). Those posts described what the tool could do. The more interesting story came next: what happened when people actually used it. As adoption grew, the central product question changed. It was no longer simply, Can AI generate an Azure architecture? It became: How do we help an architect choose how to begin, improve a result without losing their work, validate it responsibly, and turn it into something another person can use? That question reshaped the Azure Architecture Diagram Builder from a collection of capabilities into a guided workflow: Create → Refine → Validate & Improve → Share or Build This post explains what we learned, what changed in the product, and why the hardest part of AI-assisted architecture is not the first diagram. It is everything that comes after it. TL;DR. Growing adoption created a feedback loop. Aggregate usage showed that people moved beyond generation into validation, recommendations, exports, and deployment guidance. Privacy-safe feedback revealed recurring problems with diagram integrity, preservation of human edits, cost credibility, export quality, and validation continuity. Those signals led to a four-stage architecture journey that keeps human judgment and professional review at the center. The same lesson now shapes agent access and the next product boundary: distinguish logical proposals from evidence-backed physical architecture. Adoption created a product feedback loop As of August 5, 2026, the first two Azure Architecture Blog articles had accumulated approximately 12,100 combined views. A refreshed view of deduplicated application telemetry through August 13 recorded: Activity Aggregate count Architecture generation and refinement events 5,023 Well-Architected validations 960 Recommendations applied 175 Diagram exports 2,020 Deployment guides generated 212 As of August 13, the public repository had reached 45 stars and 14 forks. In GitHub’s current rolling 14-day window, the repository recorded 277 unique visitors and 67 unique cloners. These numbers measure different things and should not be added together. Article views are not unique readers. Application activity uses anonymous telemetry identifiers, not verified people. GitHub traffic is a rolling aggregate window. The signals are useful because of the pattern they reveal, not because they can be combined into one headline user count. Activity also accelerated during the period following the second article. Compared with the May 19–July 9 baseline, daily activity from July 10 through August 13 was approximately 7.0 times higher for architecture generation and refinement, 5.6 times higher for Well-Architected validation, and 5.9 times higher for recommendation application. The timing coincided with publication; it does not prove that the article alone caused the growth. The important product lesson was simpler: people were not stopping after the first diagram. They were testing alternatives, validating designs, applying recommendations, exporting artifacts, and asking how to move toward implementation. Generation was the entry point, not the complete job. The first guided-journey signals reinforce the need for more than one starting path. Through August 13, the new journey instrumentation recorded 880 interactions from 174 anonymous identifiers across 241 sessions. At first start, structured brief/image generation and Guided Chat were selected at almost the same frequency (158 and 156 events), while template and live-Azure import added another 68 selections. These are interaction counts, not unique people or conversion rates, and the window is still too early to claim that the journey improves completion. They are enough to show that architecture work does not begin in one uniform way. In-product Start Here panel showing the four-stage Azure Architecture Diagram Builder journey: Create, Refine, Validate and Improve, and Share or Build. Figure 1. The in-product Start Here panel explains one complete architecture loop. The stages are recommendations, not gates, and direct access to every tool remains available. Stage 1: Create — make the starting choice explicit As capabilities accumulated, the first screen became harder to interpret. Architecture Chat and structured generation were both useful, but they competed for attention. Importing an existing architecture was available, yet easy to miss. The new starting experience makes three paths explicit: Starting path Best suited for Guided Chat Exploring requirements conversationally and refining them over multiple turns Generate Diagram Providing a structured brief or image and producing a first architecture quickly Import Existing Opening an existing architecture or infrastructure artifact for analysis and editing This is not a marketing landing page placed in front of the tool. It is a small decision point inside the authoring experience. Once a path is selected, the user lands on the real canvas. The distinction matters because different architecture tasks begin with different levels of certainty. Sometimes the architect knows the target services. Sometimes the problem needs discovery. Sometimes the architecture already exists and the work is to understand or improve it. The product should acknowledge those differences instead of pretending every design starts with a perfect prompt. Start chooser presenting Guided Chat, Generate Diagram, and Import Existing as three equal entry paths. Figure 2. Three starting paths reflect three different architecture situations: discovery, structured generation, and analysis of an existing design. Stage 2: Refine — preserve human work One of the clearest feedback themes was not about adding another AI capability. It was about preventing AI from casually undoing human effort. An architect might spend time arranging a one-page diagram for a review, resizing groups, moving labels, or emphasizing a specific boundary. A subsequent AI refinement could improve the service selection while disrupting that carefully prepared layout. The design principle that emerged was straightforward: AI acceleration should preserve deliberate human work by default. Refinement now retains existing node positions, group geometry, sizes, and viewport context whenever possible. The model can change the architecture without treating every turn as permission to redraw the entire document. The same principle applies beyond geometry: Preserve the prior validation result when recommendations change the architecture. Preserve the active light or dark theme in exported artifacts. Preserve the distinction between the authoring canvas and the presentation deliverable. Preserve user-configured pricing assumptions rather than replacing them with one fixed estimate. This is a broader lesson for AI-assisted tools. A generated result is not the only source of value. The edits, judgments, and communication choices a person adds afterward are part of the artifact too. Before-and-after AADB canvases showing an AI refinement that adds Azure Front Door and WAF while retaining the positions of eight existing services and the anchors of four existing groups. Figure 3. In this controlled synthetic refinement, all eight existing service positions and four group anchors remained unchanged. The containing Application group expanded to accommodate the new edge tier, so preservation does not imply that every group dimension stays fixed. Quality is structural, not only visual A diagram can look polished while still being architecturally confusing. Early feedback exposed cases where a generated service appeared disconnected because a model referenced a display name instead of the service identifier used by the canvas. The correction was not another prompt instruction alone. The application now resolves connection endpoints across identifiers, normalized service names, and service-type aliases. It repairs valid edges, drops invalid or self-referential edges, detects remaining orphan nodes, and records aggregate integrity signals. That creates a more useful definition of diagram quality: Are the services connected as intended? Were any generated edges repaired or dropped? Are there orphaned nodes? Did refinement preserve the existing layout? Did an architecture change receive a fresh validation? Visual polish still matters, especially when an artifact leaves the editor. But structural integrity gives the product something deterministic to test and monitor. Stage 3: Validate & Improve — treat validation as a lifecycle The Azure Well-Architected Framework is most useful when validation becomes iterative rather than ceremonial. The Diagram Builder can assess a proposed design across the five Well-Architected pillars, surface findings, and apply selected recommendations. But that workflow exposed an important state-management problem: when the architecture changed, the prior validation result disappeared along with the obvious route back to revalidation. The updated experience keeps the previous report, marks it Revalidate Needed, and makes clear that the score describes an earlier state of the architecture. A new validation replaces it only after the updated design has been assessed. This distinction prevents a stale score from looking current. It also clarifies what an architecture-level assessment can and cannot prove. A diagram may show that a WAF, cache, backup service, or secondary region exists. It usually cannot prove that purge protection, diagnostic routing, encryption settings, role assignments, health probes, or failover policies are configured correctly. That is why validation findings need to distinguish between: Pattern-level gaps — missing or misplaced architectural components Configuration-level gaps — required settings that must be verified in Infrastructure as Code or the deployed environment Generated scores and recommendations help architects review a design; they do not replace an Azure Well-Architected Review, security review, deployment validation, or professional judgment. Validation result retained after architecture recommendations are applied, with a Revalidate Needed status and action. Figure 4. Architecture changes make a previous validation historical, not useless. The result remains available while the interface clearly asks for a fresh validation. Stage 4: Share or Build — design for the artifact’s destination The editing canvas and the final deliverable serve different purposes. Canvas dots, handles, navigation controls, and selection states help during authoring. They can make an exported diagram feel unfinished. The Diagram Builder now separates those concerns with Plain, Dots, and Grid export backgrounds while preserving the active light or dark theme. The same AADB architecture shown first on the editing canvas with the export menu open and then as the resulting Plain PNG without authoring controls. Figure 5. Authoring and delivery are different contexts. The upper view shows the editable canvas and its real export controls; the lower view is the Plain PNG produced from that same canvas, without editing chrome. Cost language is deliberately qualified. Azure services often combine fixed, usage-based, and configuration-dependent charges. A baseline that includes six numerically priced services but excludes 20 usage-based items is not the total cost of the architecture. The output identifies those exclusions rather than treating missing values as zero. The final stage also includes deployment guides and Infrastructure as Code. Here, honesty about artifact coverage is essential. A generated Bicep file may be a useful starter while still omitting private endpoints, diagnostic settings, failover configuration, or service-specific resources. The artifact should state what it implements, what remains conceptual, and whether Azure Resource Manager validation passed. AI-generated diagrams, costs, validation results, deployment guides, and Infrastructure as Code should all be reviewed and validated before production use. The same journey now extends to agents The MCP server introduced in the previous article makes the Diagram Builder available to agent experiences such as Microsoft Scout. The four-stage journey provides a useful way to think about agent orchestration too: Import or create one canonical architecture. Refine it without silently changing the intended topology. Validate it, apply supported improvements, and revalidate. Render or generate artifacts with explicit coverage and limitations. The current MCP surface exposes 12 tools, three resources, and three reusable prompts. It can normalize an existing architecture, validate and harden it deterministically, estimate regional costs from a dated pricing snapshot, render presentation/technical/cost views, and generate Bicep, Terraform, and deployment guidance. The calling agent still owns orchestration and reasoning; the MCP server is intended to remain a deterministic architecture capability, not a second hidden agent. The native MCP renderer can project one canonical architecture into three communication profiles: Presentation emphasizes the primary request path, reduces supporting labels, and removes pricing. Technical preserves complete connection detail for engineering inspection. Cost retains the focused composition while adding service-level pricing assumptions, a fixed-priced baseline, and explicit exclusions. These are MCP-generated SVG views, not Blueprint diagrams or screenshots of the editable web canvas. The services, connections, and groups remain the same; only the information treatment changes. The AADB MCP renderer projecting the same canonical architecture into presentation, technical, and cost SVG profiles. Figure 6. Native AADB MCP output from one 8-service, 9-connection, 4-group architecture. Presentation prioritizes the story, Technical exposes connection detail, and Cost foregrounds pricing assumptions and exclusions. Recent work on the MCP renderer added purpose-built presentation, technical, and cost profiles. More importantly, testing agent-generated artifacts reinforced an accountability principle: a polished diagram and a compiled Bicep file do not prove deployability. An agent workflow should report whether topology changed, whether validation improved, which services are represented only conceptually, and whether the generated IaC passed Azure preflight. That is more useful than an unsupported claim that a design is production-ready. Trust also includes the tool boundary itself. The hosted MCP endpoints now require a bearer token for real session operations; missing or incorrect credentials are rejected. A shared token is appropriate for the current controlled integration, but it is not the end state for enterprise multi-user access. Entra ID/OAuth, per-client authorization, rotation, and revocation remain future hardening work. Microsoft Scout response after an authenticated Azure Architecture Diagram Builder MCP workflow, showing the tools used, initial and final validation scores, cost scope, Bicep classification, rendered architecture, artifact links, coverage gaps, and no-deployment warning. Figure 7. The guided lifecycle extends beyond the web application. In this synthetic Scout run with GPT-5.6 Sol, the agent used authenticated AADB MCP tools to validate, harden, cost, render, and generate starter artifacts while explicitly reporting coverage gaps and that nothing was deployed. Learning from adoption without identifying people Product learning does not require reconstructing individual identities. The findings behind this article use aggregate, deduplicated application telemetry, public article counters, public repository totals, and paraphrased feedback themes. They do not correlate Application Insights identifiers, feedback records, GitHub accounts, or email addresses. Written feedback remains submittable without contact information. When someone explicitly opts into follow-up, the email address is stored with the feedback record in Cosmos DB and is not sent to normal product telemetry. The current 180-day expiry field is a retention marker; automated deletion must be implemented and verified before describing that retention period as enforced. Those boundaries matter for both product design and public writing: Aggregate activity rather than profiling individuals. Paraphrase themes rather than publishing comments without permission. Keep optional contact consent separate from telemetry. Avoid presenting anonymous identifiers as confirmed people. Avoid claiming that publication timing proves acquisition causality. This is not a claim of legal compliance. It is a product discipline: collect less, preserve user agency, and make only the claims the evidence supports. What changed The guided journey is the visible result, but the deeper change is how the project now evaluates progress. Earlier question Better question Did the model generate a diagram? Did it generate a connected and understandable architecture? Did the user click Validate? Was the current architecture validated, and was it revalidated after changes? Did export start? Did a professional artifact finish generating successfully? Does the IaC compile? What does it actually implement, and does Azure preflight pass? How many features exist? Can an architect understand the next useful step? The model portfolio continued to evolve as well. The production selector now contains 15 configured entries, including MAI-Thinking-1 (Public Preview). But the more consequential changes in this article are deliberately model-independent: preserve human work, keep state and provenance explicit, qualify generated artifacts, and authenticate the tools agents can call. The goal is not to remove flexibility. Architects can still open any tool directly, rearrange the canvas, reject recommendations, change pricing assumptions, or export at any point. The goal is to make the workflow coherent without pretending architecture itself is linear. The next boundary: logical versus physical architecture Recent feedback points to a harder problem than adding another model or export format. Architects working with private Azure AI landing zones need to distinguish shared platform resources from project-owned resources, preserve VNet and subnet boundaries, and reason about CIDRs, NSGs, route tables, private endpoints, DNS, and managed identities. The current Topology mode can show services and relationships, but it should not imply exact physical fidelity when those facts are absent. A useful logical diagram answers what exists and how it interacts. A physical or low-level design must answer where it is deployed, how it is isolated, and which values came from evidence. That is the next technical direction I am exploring: an evidence-aware Physical Architecture view backed by deterministic reconstruction from Terraform plan/state, ARM, or a live Azure inventory. Exact fields would be labeled as observed or resolved; AI suggestions would remain explicitly proposed; unsupported or missing inputs would be reported instead of silently invented. This capability is not shipped today, and it will require its own schema, validation rules, layout, security review, and evaluation set. That distinction matters. The lesson from adoption is not to put every architecture concern into one crowded canvas. It is to make each artifact’s purpose and evidence boundary clear. Try it, challenge it, help shape what comes next The Azure Architecture Diagram Builder remains open source, and the live experience is available today: Live app: https://aka.ms/diagram-builder Source code: github.com/Arturo-Quiroga-MSFT/azure-architecture-diagram-builder Getting started: Documentation and deployment guidance The next phase is to measure whether the guided journey helps people complete the full loop, especially recommendation-to-revalidation and artifact-generation success. In parallel, I am beginning the narrower physical-architecture investigation described above. Both efforts will use aggregate signals, reviewed fixtures, and sufficiently large cohorts rather than individual journey reconstruction. Try the workflow with a real architecture problem. Tell me where the handoffs are unclear, where the diagram loses intent, or where an artifact claims more than it implements. Those are the gaps worth fixing next. Measurement note: Article views are rounded public counters observed August 5, 2026. Application figures use deduplicated retained telemetry through August 13 and anonymous identifiers. GitHub totals and rolling 14-day traffic were observed August 13. The comparison windows are May 19–July 9 and July 10–August 13. These signals have different populations and must not be added together. Timing comparisons show concurrent activity, not causal attribution.Introducing dependency telemetry in Application Insights for Azure API Management policies
Running A(P)I platforms at-scale is not a walk in the park – As traffic flows through the system, it needs handle the load and provide insights on where the inefficiencies are. Finding the needle in a haystack Azure API Management provides a broad set of observability capabilities across its managed and self-hosted gateway offerings, although availability varies by gateway type: Azure Application Insights integration leveraging requests, traces from policies, custom metrics from policies & dependency tracking to integrate with your apps APM Request tracing with API Inspector Built-in analytics for (business) reporting (docs) Azure Monitor logs & metrics for our managed gateway or OpenTelemetry metrics for our self-hosted gateway Logging to Azure Event Hubs in your desired format through policies These capabilities are valuable, but the teams operating API platforms do not always define the APIs or author their policies. As a result, operators may lack visibility into the downstream work performed during each request: A single inbound request does not always map to a single backend request; policies can cause it to fan out into multiple downstream calls. Rate limiting happens, so calls downstream can retry and infuse latency All of these can infuse latency to the end-to-end experience for their customers and can only be diagnosed with detailed insights – They are looking for the needle in a haystack. In recent months, support cases have shown that customers can struggle to identify the source of latency when relying on Application Insights telemetry alone. Here are some examples showing high incoming latency but it’s difficult to understand the cause. Example #1: Example #2: Example #3: Introducing external dependency calls in Application Insights for policies We want to empower our customers by shifting our internal insights left to help customers be more efficient/self-diagnose API platforms at scale. I’m excited to share the first release of external dependency telemetry in Application Insights for Azure API Management policies. It covers the following policies: authentication-managed-identity authentication-token azure-openai-semantic-cache-lookup cosmosdb-request-handler forward-request get-authorization-context http-data-source invoke-dapr-binding llm-content-safety llm-semantic-cache-lookup send-request send-one-way-request send-service-bus-message sql-data-source validate-jwt This telemetry helps customers see where request time is spent and can reduce the need to open a support ticket. The examples below show how it explains the scenarios introduced earlier: Example #1 was retrying calls to the backend with a wait in between: Example #2 performed JWT validation, which required retrieving OpenID Connect metadata. It then made an initial slow backend call before the backend call visible to the customer. Example #3 combined three downstream operations in one request: validating a JWT, sending a message to Azure Service Bus, and then forwarding the request to the backend. What’s next? Improving your application landscape telemetry in Application Insights is just the beginning! We’re continuing to expand the diagnostic information available to customers in two areas: Enhance Azure Monitor diagnostic logs with additional per-request details and outbound dependency information. Add dependency telemetry for more policies and scenarios. Together, these improvements will give platform builders deeper insight into their A(P)I platforms and make that information easier to integrate with existing monitoring solutions. We’re excited to deliver this richer Application Insights telemetry, get started by reading our Azure Application Insights integration guidance. Let us know in the comments how you use it and which scenarios you would like us to cover next. Thanks for reading, TomAI Gateway tier of API Management now in public preview
Today, we are introducing the AI Gateway tier of Azure API Management, now in public preview. It gives platform teams a purpose-built experience built specifically for AI workloads - publishing and governing models and MCP servers. Controls are configured through policy cards rather than XML and expressions, and the portal experience and control plane are structured around models, MCP servers, and tools rather than APIs. (For brevity, we refer to the AI Gateway tier as AI Gateway throughout the rest of this article.) AI Gateway is built on Azure API Management, bringing proven operational capabilities to AI workloads. The resource runs in your subscription, uses your Entra tenant, and sends telemetry to destinations you control. The operating model will be familiar to existing API Management customers, but the interface is built around AI workloads. The AI Gateway tier is intended for teams that want this focused experience; other API Management tiers remain the right choice when organizations also need general-purpose API management or capabilities not included in the AI Gateway experience. A practical model for platform teams The AI Gateway gives platform teams a shared place to manage models, MCP servers, policies, and observability destinations, with access controlled through Azure RBAC. For example, a central platform group can connect a set of approved models and tools and publish them for application teams. The application teams can test those assets in the test console and build against them without routing every change through the central group. The platform group still owns the shared guardrails and can see how the assets are being used. After an asset is published, developers can create a named runtime key and begin calling the gateway immediately. Bring the models and tools you already use Most organizations don't standardize on a single model provider. Different models are selected based on quality, latency, cost, geography, or specialized capabilities. The preview supports models from Microsoft Foundry including OpenAI, Anthropic, Mistral, and other Foundry hosted models, as well as models hosted in AWS Bedrock, Google Vertex AI, OpenAI, and Anthropic. A guided wizard simplifies importing models from Microsoft Foundry. Other providers can be added by configuring a connection, with backend authentication configured as part of that connection. All published models are available under the same stable endpoint. Applications continue to use supported API formats such as OpenAI Chat Completions and Responses or Anthropic Messages directly or via SDKs. The AI Gateway extends governance beyond models to the MCP servers and tools agents use to interact with enterprise systems. You can expose an existing MCP server over SSE or Streamable HTTP, turn all or selected operations from a REST API into an MCP server by uploading its OpenAPI specification, or use more than 1,400 connector-backed tools from the Power Platform and Logic Apps library. You can also federate multiple MCP servers behind a single server, so an agent connects once and sees the tools across those servers. Backend authentication supports an API key, OAuth client credentials, managed identity, or mTLS. Governance that's built in Organizations need consistent governance across models and MCP servers without requiring every application team to implement those capabilities independently. The AI Gateway portal presents governance policies through an intuitive card-based experience rather than requiring policy XML. The same policies are expressed as JSON properties, making them easy to manage as infrastructure as code and to audit and enforce across a fleet with Azure Policy. In the public preview, those cards cover request and token rate limits, token quotas, Azure AI Content Safety, and fallback to a secondary model. Policies are applied per asset, making it clear which controls protect each model or MCP server. OpenTelemetry-based token metrics The AI Gateway emits token-usage metrics through OpenTelemetry, with attributes following GenAI and cloud semantic conventions. Metrics can be sent to Application Insights, Datadog, Splunk, Grafana Cloud, or another OTLP endpoint. The portal provides a monitoring view over Application Insights data. Better together: Microsoft Foundry and AI Gateway With AI Gateway, teams can extend the same governance controls, for example token rate limits and quotas, across models hosted in Microsoft Foundry and models hosted elsewhere. Foundry and non-Foundry models are published through gateway-managed endpoints, giving applications and agents a consistent way to access governed models regardless of where they are hosted. Foundry-hosted agents can consume curated sets of tools from Foundry toolboxes, with access to the underlying MCP servers and APIs governed through AI Gateway. Together, Microsoft Foundry and AI Gateway cover the enterprise application lifecycle: Foundry for building and running AI applications, and AI Gateway for publishing, governing, and observing models, tools, and MCP servers across your AI estate. The new AI Gateway tier will soon be available through the gateway experience in Microsoft Foundry portal. We are working toward a seamless, integrated AI Gateway experience within Foundry portal and will share more about that work separately. Available today in public preview The AI Gateway tier is available today at no cost in public preview in East US 2 and Sweden Central. Pricing will be shared separately. To provision a resource, add a model or MCP server, and make a first call click this to go to the AI Gateway tier portal and try it. If you prefer to start from code, use a sample to deploy all the required resources for a Foundry-hosted agent configured to access its model and tools through AI Gateway. We look forward to your feedback as we continue to rapidly evolve AI Gateway.
Introducing native Service Bus message publishing from Azure API Management (Preview)
We’re excited to announce a preview capability in Azure API Management (APIM) — you can now send messages directly to Azure Service Bus from your APIs using a built-in policy. This enhancement, currently in public preview, simplifies how you connect your API layer with event-driven and asynchronous systems, helping you build more scalable, resilient, and loosely coupled architectures across your enterprise. Why this matters? Modern applications increasingly rely on asynchronous communication and event-driven designs. With this new integration: Any API hosted in API Management can publish to Service Bus — no SDKs, custom code, or middleware required. Partners, clients, and IoT devices can send data through standard HTTP calls, even if they don’t support AMQP natively. You stay in full control with authentication, throttling, and logging managed centrally in API Management. Your systems scale more smoothly by decoupling front-end requests from backend processing. How it works The new send-service-bus-message policy allows API Management to forward payloads from API calls directly into Service Bus queues or topics. High-level flow A client sends a standard HTTP request to your API endpoint in API Management. The policy executes and sends the payload as a message to Service Bus. Downstream consumers such as Logic Apps, Azure Functions, or microservices process those messages asynchronously. All configurations happen in API Management — no code changes or new infrastructure are required. Getting started You can try it out in minutes: Set up a Service Bus namespace and create a queue or topic. Enable a managed identity (system-assigned or user-assigned) on your API Management instance. Grant the identity the “Service Bus data sender” role in Azure RBAC, scoped to your queue/ topic. Add the policy to your API operation: <send-service-bus-message queue-name="orders"> <payload>@(context.Request.Body.As<string>())</payload> </send-service-bus-message> Once saved, each API call publishes its payload to the Service Bus queue or topic. 📖 Learn more. Common use cases This capability makes it easy to integrate your APIs into event-driven workflows: Order processing – Queue incoming orders for fulfillment or billing. Event notifications – Trigger internal workflows across multiple applications. Telemetry ingestion – Forward IoT or mobile app data to Service Bus for analytics. Partner integrations – Offer REST-based endpoints for external systems while maintaining policy-based control. Each of these scenarios benefits from simplified integration, centralized governance, and improved reliability. Secure and governed by design The integration uses managed identities for secure communication between API Management and Service Bus — no secrets required. You can further apply enterprise-grade controls: Enforce rate limits, quotas, and authorization through APIM policies. Gain API-level logging and tracing for each message sent. Use Service Bus metrics to monitor downstream processing. Together, these tools help you maintain a consistent security posture across your APIs and messaging layer. Build modern, event-driven architectures With this feature, API Management can serve as a bridge to your event-driven backbone. Start small by queuing a single API’s workload, or extend to enterprise-wide event distribution using topics and subscriptions. You’ll reduce architectural complexity while enabling more flexible, scalable, and decoupled application patterns. Learn more: Get the full walkthrough and examples in the documentation 👉 hereUse connectors with Managed Identity in the Logic Apps Standard extension
Managed Identity is Azure’s built-in way to authenticate to Microsoft Entra-protected resources without storing credentials, secrets, or connection strings. Deployed Logic Apps have supported it for a while, but the developer inner loop was a different story. You would wire up one authentication method to run and debug locally, then swap it for another before deploying to the cloud. The Logic Apps Standard extension for Visual Studio Code now lets you create connectors that use Managed Identity as an authentication parameter and run them while you build and debug locally. This works for both Azure managed connectors and service provider connectors. When you run locally, the extension authenticates as your signed-in developer identity using the Azure default credentials pattern. After you deploy, the same connection authenticates with the app’s managed identity. Why this matters for developers You gain two things. Stronger security. Managed Identity removes the requirement to keep API keys or connection strings around to reach your target systems. As the Azure Logic Apps managed-identity guidance puts it, a managed identity “removes the need to store and manage credentials, secrets, or access tokens.” Fewer secrets in your settings mean a smaller attack surface and less to rotate. One setup for local and cloud. Many teams keep one authentication configuration for local runs and redefine it for cloud deployment, and those differences often cause deployment errors. With the Azure default credentials pattern, your app authenticates with your local sign-in while you develop, then with a managed identity after you deploy. The transition needs no code changes. One connection definition covers both environments. Prerequisites Make sure you are on these versions or later: Logic Apps Standard VS Code extension 5.961.19+ Bundle 1.165.52+ Azure CLI 2.51+ Az PowerShell module You must be logged on Azure CLI (using az login) and Az Powershell module (using Connect-AzAccount). How to enable Add the following app setting to both ./local.settings.json and ./workflow-designtime/local.settings.json: { "IsEncrypted": false, "Values": { "WORKFLOWS_AUTHENTICATION_METHOD": "managedServiceIdentity" } } Then reload the Visual Studio Code window so that both the extension and the design-time engine pick up the new setting. Both files matter. The design-time engine reads its own settings file to power the designer, so skipping it is a common reason the change does not take effect. From Logic Apps extension version 5.981.1, you can choose enable Managed Identity as an authentication method by default, by checking the following extension setting: If you are not ready to use managed identity yet, you can change the WORKFLOWS_AUTHENTICATION_METHOD value to Raw. But notice that this flag enables managed identity for the whole application, so if you are planning to use this feature you need it set to managedServiceIdentity. You might want to keep the existing behavior in case your existing CI/CD pipeline requires the Raw authentication method in connections.json or parameters.json. Also notice that this is a local only setting - it is added to local.settings.json files, which are not captured by source control. How it works This uses the Azure default credentials pattern. When your workflow needs a token, the credential chain tries a series of sources in order and stops at the first one that can issue a token. Locally, that resolves to your developer identity, such as your Azure CLI az login session, your Visual Studio Code sign-in, or Azure PowerShell. After you deploy, it resolves to the app’s managed identity, which can be system-assigned or user-assigned. The configuration stays the same across both environments. Whichever identity you use, your local user while developing or the managed identity once deployed, it needs the right RBAC roles on the resources it accesses. If a connection returns an authorization error, check the role assignment on the target resource first. The WORKFLOWS_AUTHENTICATION_METHOD flag behaves differently for each connector family. The next two sections cover both. Deep dive: Azure managed connectors For managed connectors, the flag does two things. It removes the requirement for a local connection key to authorize your logic app to talk to the managed connector, its access control layer (ACL). The change is transparent: the designer shows that you now have access to the connector. You can confirm it by inspecting the connection’s access policies. It authenticates the connector to the end system using the managed identity, or your user context when you run locally. You pick Managed Identity as the authentication type when you create the connection. Creating an Azure Blob Storage (managed) connection with Authentication Type set to “Logic Apps Managed Identity.” One limitation applies today. The Managed Identity implementation for managed connectors does not generate dynamic values inside the designer. You can still configure the connector, but you supply custom values instead of picking from dynamically populated dropdowns. Deep dive: Service provider connectors Service provider connectors support dynamic parameters today. You create the connection, choose Managed Identity as the authentication type, and keep using the designer’s dynamic values as usual, such as entering the fully qualified namespace for a Service Bus connection. Creating a Service Bus (service-provider) connection with Managed Identity. The connector supports dynamic parameters such as the Fully Qualified Namespace. Try it and let us know If you build integrations on Logic Apps Standard, update to the latest extension, set WORKFLOWS_AUTHENTICATION_METHOD to managedServiceIdentity, and give your connectors a passwordless local inner loop. This small setting removes secrets from your configuration and keeps authentication consistent from your laptop to the cloud. Have feedback, or a scenario you would like to see supported, such as dynamic values for managed connectors? Share it with the Logic Apps Aviators community at aka.ms/aistechcommunity. Your input shapes the roadmap. Learn more Authenticate connections with managed identities in Azure Logic Apps Create Standard logic app workflows with Visual Studio Code DefaultAzureCredential overview (Azure Identity client library)Logic Apps Aviators Newsletter - August 2026
In this issue: Ace Aviator of the Month News from our product group News from our community Ace Aviator of the Month August 2026's Ace Aviator: Sonny Gillissen LinkedIn: https://www.linkedin.com/in/sonnygillissen/ What's your role and title? What are your responsibilities? Integration Architect / Cluster Lead I'm responsible for running Integration projects at our customers, and next to that I'm leading our team of Integration Experts by embedding our mission and vision deeply in the roots of our team. Can you give us some insights into your day-to-day activities and what a typical day in your role looks like? My day typically consists out of working together with my customer to validate our integration solutions and form next steps to provide the best fit. This could be meeting with the business to gather requirements, or check in with the team to find the best approach. From an internal perspective I'm working on our go-to-market to keep it aligned with the company's vision and movements in the market, together with our team of Integration Experts. What motivates and inspires you to be an active member of the Aviators/Microsoft community? The fact that it such an active community, and people are very much willing to help each other is what drives me te be an active member too. Especially when you could help someone with your expertise is what really makes my day and provides all the energy to keep outperforming myself, every single day. Looking back, what advice do you wish you had been given earlier that you'd now share with those looking to get into STEM/technology? You don't have to do everything alone. When working with techhology, it may feel like you're the only one at times, especially when you're hitting that one niche problem. But in fact, others can have such a positive impact, so keep asking. What has helped you grow professionally? First of, I really believe having a team of experts around you that you can collaborate with helped a lot. But on the other hand, actively sharing knowledge and digging into problems of others is what really helped me grow. Not only professionally, also as person. If you had a magic wand that could create a feature in Logic Apps, what would it be and why? This question was easier to answer when there wasn't a thing like Logic Apps Automation, as I believe this was my magic wand before: putting the power of integration in everyone's hand. But, with that said, I think it would be cool of you can have an “Logic Apps Agent” that creates and maintains your envisioned integration by itself, or with it’s Logic App co-workers (of course with some checkin’ in to you at times). In my opinion this would really bring the power of Logic Apps to literally everyone. News from our product group AI Gateway tier of API Management now in public preview The public-preview AI Gateway tier of Azure API Management provides a purpose-built experience for publishing and governing AI models, MCP servers, and tools. It supports models from Microsoft Foundry and other providers, connector-backed tools, card-based governance policies, Azure RBAC, and OpenTelemetry token-usage metrics. Changing the engine while the plane is flying: migrating 60,000 apps under live load This engineering account describes migrating roughly 60,000 Integration Account Function apps from end-of-life runtimes to Azure Functions v4 isolated worker. The team used shadow traffic, parity checks, progressive regional rollout, configuration-based rollback, privacy-preserving telemetry, and a stop-before-delete retirement process. Hybrid Logic Apps on RKE2: a self-managed cluster with MetalLB This walkthrough shows how to deploy Azure Logic Apps Hybrid on a self-managed RKE2 Kubernetes cluster using MetalLB. It covers Azure Arc, the Container Apps extension, custom locations, connected environments, ingress, and RKE2-specific fixes involving inotify limits, CoreDNS configuration, and the missing kube-dns service alias. Announcing Flat File Schema Generation support in Azure Logic Apps Standard Azure Logic Apps Standard now provides a preview built-in action that generates BizTalk-compatible flat-file XSD schemas at runtime from sample payloads. It supports common delimited and fixed-width formats and can feed generated schemas into Flat File Encoding or Decoding actions. Hybrid Logic Apps Deployment on Red Hat OpenShift This guide explains how to deploy Azure Logic Apps Hybrid on self-managed Red Hat OpenShift or Azure Red Hat OpenShift. It covers Azure Arc, SMB storage, OpenShift security context constraints, the Container Apps extension, custom locations, connected environments, ingress choices, DNS configuration, and troubleshooting. Coding with Logic Apps Standard: Local Functions This article introduces Local Functions in Azure Logic Apps Standard, which let developers write, debug, and deploy custom .NET code alongside workflows in the same project. Workflow-scoped code can share the Logic App’s deployment, scaling, security, and operational boundary without requiring a separate Azure Functions resource. Common scenarios include message validation, payload enrichment, custom parsing, business rules, and BizTalk modernization. The article also explains when Local Functions are preferable to independently hosted Azure Functions and how they fit into a unified CI/CD process. News from our community What's New with Logic Apps Post by Gabriel Yang The article reviews how announcements from Integrate 2026 move Azure Logic Apps toward a central role in enterprise automation and AI orchestration. It covers Logic Apps Automation, AI-assisted workflow authoring, Knowledge as a Service, direct Azure AI Foundry Agent invocation, the Logic Apps Standard SDK for C#, and Azure Connector Namespace access from custom applications. Together, these capabilities reduce infrastructure and integration complexity while retaining governance and scalability. The broader value is a more accessible orchestration layer connecting enterprise systems, knowledge, agents, and operational business processes. Monitoring Is Not Reconciliation Post by Al Ghoniem, MBA The article distinguishes technical monitoring from business reconciliation in enterprise integrations. Successful Logic Apps runs, Service Bus metrics, and API responses show that known work executed, but cannot prove every expected transaction reached the target correctly. Effective reconciliation compares expected and actual states using independent reference sets, stable business identifiers, appropriate timing windows, and risk-based matching depth. It also requires liveness checks, explicit ownership, and controlled recovery decisions. The approach helps detect missing, duplicate, late, or inconsistent transactions before customers, auditors, or downstream controls expose them. Power Automate's Big Brother - Azure Functions Connector Namespaces Video by Sean Astrakhan The video demonstrates using Azure Functions connector namespaces to trigger Python code from services such as Dataverse, Outlook, and SharePoint. A Dataverse record-creation scenario invokes a function that populates an expiration date, with GitHub Copilot helping author, deploy, and test the solution. The example also highlights the need to direct Copilot toward connector namespaces instead of older HTTP-trigger and webhook patterns. This approach combines managed connector access with pro-code flexibility, reducing separate flow and connection requirements while making Azure Functions more approachable for integration developers. Building Stateful Agentic AI Workflows with Azure Standard Logic Apps Post by Sakshi Mittal The guide explains how stateful agentic workflows extend Azure Logic Apps Standard beyond fixed API orchestration. It compares autonomous agents for repetitive background tasks with conversational agents for interactive scenarios, then outlines prerequisites such as AI model access, connectors, RBAC, managed identities, and Application Insights. It contrasts adaptive agent state with conventional workflow run state and reviews benefits including automation, scale, and contextual decisions. It also highlights trade-offs around cost, nondeterminism, debugging, privacy, latency, and governance, helping teams choose an appropriate pattern before production. Logic Apps Automation Preview Post by Steef-Jan Wiggers This assessment examines Logic Apps Automation as a managed, single-tenant experience with Microsoft-managed capacity, a project-and-application hierarchy, agent tooling, sandboxed code execution, and real-time run history. A failure-triage example shows how agents can use runbook knowledge and structured outputs while deterministic branches control tickets and retries. The article also identifies preview limitations, including missing CI/CD, ownership transfer, audit visibility, and uncertain network support. Its central recommendation is to pilot nonregulated workloads while defining project ownership, app-level access, governance, and deployment requirements before broader enterprise adoption. Azure Logic Apps Standard | Testing Series Post by Andrew Wilson The article introduces a practical testing series for Azure Logic Apps Standard, addressing reliance on manual runs and run-history inspection as workflow estates grow. It proposes layered validation covering testable workflow design, mocked action outputs, unit tests derived from workflow definitions in Visual Studio Code, integration tests, and agent-assisted testing. The approach emphasizes deterministic boundaries, separation of orchestration from connector-heavy implementation, observability through tracking and correlation, and behavior-focused environment parity. These practices aim to create faster feedback, clearer regression detection, and repeatable confidence across frequent workflow changes and deployments. Mastering Error Handling and Retry Design in Logic Apps Post by Parth T. Distributed workflows routinely face timeouts, throttling, network interruptions, and unavailable dependencies, making resilience a core Logic Apps design concern. The article outlines how to identify likely failure points, use fallback paths and compensating actions, and apply bounded retries with exponential backoff and idempotent operations. It also emphasizes thorough logging, correlation identifiers, stakeholder notifications, and deliberate testing of failure scenarios such as invalid responses and partial execution. These practices help teams prevent cascading failures, improve diagnosis, and maintain stable business processes when transient or permanent faults occur. Introduction to Knowledge Base as a Service KBaaS | Built-In Knowledge for Azure Logic Apps Video by Srikanth Gunnala Building retrieval-augmented agents normally requires document chunking, embeddings, a vector store, retrieval logic, and orchestration. This video introduces Knowledge Base as a Service in Azure Logic Apps, which manages those components behind a built-in knowledge-base experience. It demonstrates connecting Azure Cosmos DB and Azure OpenAI, uploading documentation, and attaching the resulting knowledge base to a conversational agent. An internal API documentation assistant provides the practical scenario, showing how an agent can answer questions with responses grounded in uploaded source material while reducing custom RAG infrastructure and setup work. Knowledge Base as a Service in Azure Logic Apps Post by Steef-Jan Wiggers Knowledge retrieval for Logic Apps agents has traditionally required a separately configured search index, indexer, data source, chunking strategy, and embeddings pipeline. This walkthrough explains how the preview Knowledge Base as a Service capability instead parses, chunks, summarizes, vectorizes, and stores uploaded content through Azure Cosmos DB and Azure OpenAI. An HR policy agent demonstrates grounded answers, citations, and appropriate fallback for out-of-scope questions. The article also provides deployment steps, a Bicep-based sample, and practical notes on portal persistence, connection configuration, model availability, authentication, and workflow schema requirements. Vibe Coding Logic Apps in Azure: Automating Complex Workflows with AI Assistance Post by Marcel Broschk The article examines how natural-language, AI-assisted development can accelerate Azure Logic Apps workflow creation without replacing engineering judgment. It covers the native workflow assistant, GitHub Copilot scaffolding, structured prompts, agent-and-workflow patterns, MCP servers, and AI-oriented designs such as retrieval-augmented generation. It also recommends repository-level Copilot instructions, automated tests, static analysis, security controls, and human review. The approach helps integration teams move from intent to deployable workflows faster while retaining responsibility for architecture, authentication, error handling, governance, and operational reliability. Are Azure Logic Apps really low-code or no-code? Post by Chris Bradshaw The article evaluates whether Azure Logic Apps is genuinely no-code and concludes that low-code is the more accurate description. Simple connector-based workflows may require no coding, but production integrations commonly involve expressions, JSON editing, error handling, transformations, infrastructure as code, deployment pipelines, and governance. It offers practical guidance for choosing Logic Apps for orchestration and visible workflows, Azure Functions for custom logic and performance, or a hybrid architecture combining both. This framing helps teams match each service to the problem rather than relying on marketing labels. Azure Logic Apps at Integrate 2026: The Announcements Post by Steef-Jan Wiggers The article reviews five Azure Logic Apps announcements from Integrate 2026 and their implications for integration architects. It covers Logic Apps Automation, Knowledge as a Service, native Azure AI Foundry agent integration, the Logic Apps Standard SDK, and Azure Connector Namespace. Together, these capabilities simplify managed workflow hosting, retrieval-augmented generation, agent orchestration, code-first C# development, and connector reuse outside the workflow runtime. The analysis positions Logic Apps as an enterprise AI connectivity and orchestration layer and recommends revisiting hosting, knowledge retrieval, and SDK adoption decisions. Azure Logic Apps Agent Loop Production Operations Post by Steef-Jan Wiggers Production agent loops require more than successful workflow runs. This article explains how Standard Logic Apps can use Application Insights, run history, and KQL queries to monitor requests, dependencies, exceptions, tool calls, token use, and execution duration. It compares Standard and Consumption pricing, outlines tool, throttling, and conversation-history limits, and describes repeatable deployment through source-controlled workflow definitions, zip deployment, Azure CLI, and environment-specific settings. The guidance helps teams evaluate operational readiness, cost behavior, observability, and deployment practices before moving agentic workflows into production. Event-Driven Automation Post by Uttam Chaturvedi File-arrival notifications can be automated with an Azure Logic Apps Consumption workflow. This walkthrough creates a private Blob Storage container, configures a blob-created trigger, sends file metadata to a REST endpoint through an HTTP action, and emails the team through Office 365 Outlook. It also covers resource organization, testing, run history, security, pricing, and possible extensions such as Teams notifications, SQL persistence, Azure Functions, approvals, and CI/CD deployment. The pattern demonstrates event-driven integration without manually operated scripts or continuously running servers. Azure Logic Apps Tracking Properties – A Complete Team Guide (Part 2) Post by Sandro Pereira Tracking Properties improve Logic Apps observability by adding relevant business and technical context to action telemetry. This guide shows how to configure them on individual actions through the designer’s Settings pane or the trackedProperties section in code view. Values may be static, dynamic, or combined, although expressions must be entered manually without IntelliSense and should be validated carefully. Recommended practices include tracking useful identifiers, standardizing property names, keeping values concise, and excluding credentials or personal data, making Log Analytics queries, dashboards, monitoring, and troubleshooting more consistent. Navigating Cost Pitfalls in Logic App Consumption Plans Post by Parth T. Consumption-based Logic Apps can accumulate unexpected charges through frequent polling, premium connectors, redundant actions, large loops, unnecessary runs, retries, API calls, and oversized payloads. This article recommends event-based triggers, appropriate polling intervals, trigger conditions, simpler workflow logic, filtered or batched processing, and reduced connector calls. It also advises continuous monitoring with Azure Monitor and Cost Management, budgets and alerts, periodic execution reviews, managed identities, and documented architectures. These practices support more predictable spending while preserving workflow performance, scalability, governance, and operational visibility. Streamlining Logic Apps: The Importance of Versioning and CI/CD Post by Parth T. Reliable Logic Apps delivery requires disciplined change tracking and automated deployment rather than manual updates. This article explains how version control supports traceability, collaboration, audits, troubleshooting, and rollback, while CI/CD validates, tests, and promotes workflow changes consistently across environments. Recommended practices include semantic versioning, Git repositories, feature branches, ARM or Bicep infrastructure definitions, parameterized environment settings, Key Vault secrets, approval gates, release notes, monitoring, and rollback plans. Together, these methods reduce deployment risk and downtime while improving release speed, consistency, governance, and maintainability.Sentinel Foundry - MCP Server (Github Community Release)
I’ve been cooking something that a lot of people in SOC have been struggling with — especially on the engineering side of Microsoft Sentinel. Thanks to the Microsoft Security team for shaping the capabilities of Sentinel even better with Sentinel Data Lake & Modern SecOps. Today’s the day I can finally share it. Note: This is not an official Microsoft product, but it is designed to make the Sentinel Build even better (complement) with much more intelligence. 🚀 Sentinel Foundry is now in public preview with 43 tools. (Sentinel Foundry - MCP Server) It’s an MCP server built to act like the brain of a strong Sentinel engineer — helping make building, improving, and operating Sentinel far more practical, faster, and honestly more enjoyable. For a lot of teams, the challenge is not understanding what Sentinel can do. The hard part is the engineering work around it: -> Deciding what data should actually be ingested -> Building a clean, scalable Sentinel foundation -> Writing useful detections instead of noisy ones -> Balancing security value with cost -> Turning ideas into deployable engineering outputs That is exactly why I built Sentinel Foundry to help communities grow stronger. It helps with the real engineering tasks behind Sentinel — from architecture thinking to detection design, deployment planning, ingestion strategy, automation ideas, and many of the workflows outlined in the GitHub project. How does it work? Here’s one of the flagship prompts I ran with it: “Give me a complete security posture report for our workspace. Score each pillar and tell me what to prioritise.” And within seconds, it produced a structured engineering blueprint that would normally take a lot longer to pull together manually. You can see the example prompts here in what it can do: https://github.com/prabhukiranveesam/Sentinel-Foundry#what-can-it-do I want building Sentinel to feel less like repetitive engineering overhead — and more like real security engineering that is fast, creative, and enjoyable. If you work with Sentinel as a SOC L2 analyst, engineer, detection engineer, consultant, or architect, I’d genuinely love for you to try it and tell me what you think. 🔗 Public Preview: https://github.com/prabhukiranveesam/Sentinel-Foundry This is just the start of an AI era — and I’m excited to keep shaping it with more powerful features over the coming days. This is very easy to set up and will be available to all of you at no cost during this month as part of the public preview, and your feedback is extremely valuable to shape this as a powerful solution.
Data Connectors Storage Account and Function App
Several data connectors downloaded via Content Hub has ARM deployment templates which is default OOB experience. If we need to customize we could however I wanted to ask community how do you go about addressing some of the infrastructure issues where these connectors deploy storage accounts with insecure configurations like infrastructure key requirement, vnet intergration, cmk, front door etc... Storage and Function Apps. It appears default configuration basically provisions all required services to get streams going but posture configuration seems to be dismissing security standards around hardening these services.Announcing Flat File Schema Generation support in Azure Logic Apps Standard
We’re excited to announce the preview of Flat File Schema Generation for Azure Logic Apps Standard. This new built-in action helps integration teams move faster by generating BizTalk compatible flat-file XSD schemas directly from sample flat-file payloads, reducing the manual effort required to model CSV, delimited, and positional files before encoding or decoding them in workflows. Why this matters Flat files continue to power enterprise mission critical integrations, from partner feeds and batch exports to finance ledgers, operational reports, and legacy system exchanges. While Azure Logic Apps already helps teams encode and decode flat files, creating the required flat-file schema has often been a separate design-time step. With Flat File Schema Generation, you can now accelerate that onboarding experience by generating a starter schema from real sample data within the workflow itself. What’s new The new Flat File Schema Generation action generates a flat-file XSD schema from sample content that you pass into the action. The generated schema includes BizTalk-compatible flat-file annotations, making it suitable for downstream Flat File Encoding and Flat File Decoding actions in Azure Logic Apps Standard workflows. Runtime schema generation: Generate schemas directly from sample flat-file payloads in the workflow. Delimited and positional support: Create schemas for common CSV, semicolon-delimited, tab-delimited, and fixed-width files. BizTalk-compatible annotations: Use generated schemas with the existing flat-file processing model familiar to BizTalk and enterprise integration teams. Flexible naming: Configure root element names, namespaces, record names, delimiters, and field positions to match your integration needs. How it works You provide a representative sample payload, specify whether the file structure is delimited or positional, and configure the relevant parsing details such as field delimiters, record delimiters, header handling, or fixed-width field positions. Once you run the workflow, the action returns the generated XSD schema as XML output, which can then be passed into subsequent flat-file operations or stored as part of your onboarding flow. Get started To try the preview, add the Flat File Schema Generation action to a Logic Apps Standard workflow, provide a sample flat-file payload, choose the record structure, and configure the field or record settings that match your format. Use the generated schema output with Flat File Decoding or Encoding in the same workflow or incorporate it into your broader onboarding process for flat-file integrations. Reference document: Encode, Decode, or Generate Schemas for Flat Files - Azure Logic Apps | Microsoft Learn. A walkthrough of generating a flat-file schema from sample data Use the following walkthrough to try the preview end to end with a simple customer order file. The same pattern can be adapted for semicolon-delimited, tab-delimited, or fixed-width positional files. Delimited sample: For this example, assume a trading partner sends a comma-separated order file with a header row and repeating order records. Sample file: OrderId,CustomerName,OrderDate,Amount,Region 10001,Contoso Retail,2026-07-01,1250.75,North 10002,Fabrikam Foods,2026-07-02,890.00,West 10003,Northwind Traders,2026-07-03,2400.50,South Configuration values Parameter Example value Record Structure Delimited Has header Yes Record delimiter newline Field delimiter , Field delimiter order Infix Escape character Double quote, if the source file uses quoted values Root element name (Advanced Parameters) Orders Record name (Advanced Parameters) Order Target namespace (Advanced Parameters) http://schemas.contoso.com/orders In the Azure portal, open your Logic Apps Standard resource and select the workflow where you want to generate the schema. Add a trigger, such as When an HTTP request is received, or use any trigger/action that provides the sample flat-file content. Add a new action and search for Flat File. Select the Flat File Schema Generation action. In the action, provide the sample flat-file content. Select the file structure type. For this example, choose Delimited. Enter the schema metadata under advanced parameters, such as the root element name, record name, and target namespace. Configure the delimiter settings, including the field delimiter and record delimiter. If the first row contains column names, enable the option to use the first row as headers. Save and run the workflow. Open the workflow run history and review the action output. The action returns a generated XSD schema with flat-file annotations. Review the generated schema, validate field names and inferred data types, and use the schema with Flat File Decoding or Flat File Encoding in your workflow. Positional sample: Fixed-width customer order file Use this example when the source flat file doesn’t use delimiters. In a positional, or fixed-width, file each field starts and ends at a known character position. The schema generation action needs those field positions so it can split each record correctly. Sample positional file: 10001CONTOSO00120260701000125075NORTH 10002FABRIKAM0120260702000089000WEST· 10003NORTHWIND120260703000240050SOUTH Note: The dot symbol in the second record represents a trailing space used for fixed-width padding. Replace it with an actual space in your real sample payload. Field position map Field Start position Length Justification Example value OrderId 1 5 Right 10001 CustomerCode 6 10 Left CONTOSO001 OrderDate 16 8 Right 20260701 Amount 24 9 Right 000125075 Region 33 5 Left NORTH Configuration values for the positional sample Parameter Example value Record Structure Positional Has Header No Record delimiter newline Field positions Use the field names, lengths, and justification values from the field position map. Root element name (Advanced Parameters) Orders Record name (Advanced Parameters) Order Target namespace (Advanced Parameters) http://schemas.contoso.com/orders/positional Step-by-step walkthrough for positional files In the Azure portal, open your Logic Apps Standard resource and select the workflow where you want to generate the schema. Add a trigger, such as When an HTTP request is received, or use an existing action that provides the fixed-width file content. Add a new action and search for Flat File. Select the Flat File Schema Generation action. Paste the positional sample payload into the sample content input. Make sure every record has the same total length. For the structure type, choose Positional. Enter the schema metadata, including root element name, record name, and target namespace. Configure the record delimiter. For this example, use newline. Add the field positions in order: OrderId length 5, CustomerCode length 10, OrderDate length 8, Amount length 9, and Region length 5. Set justification for each field. Use Right for numeric or date-like fields and Left for text fields that may contain trailing space padding. Save and run the workflow. Open the workflow run history and review the generated XSD schema output. Confirm that the field names, order, lengths, and positional annotations match the source record layout. Use the generated schema with Flat File Decoding to parse incoming fixed-width files into XML, or with Flat File Encoding to generate outbound fixed-width files. Limitations and known issues Limitation Description Type inference uses a single record. The first non-empty data record determines column types. Single record type only The action generates one repeating record structure and doesn't support heterogeneous record layouts. No nested or hierarchical records The generated schema is flat, meaning you have a root element with one repeating child record and fields. Positional boundaries aren't automatically detected. You must provide exact field lengths in field Positions. UTF-8 code page only Generated schema sets codepage="65001" and doesn't expose encoding selection. Escape-character behavior is literal. Escape handling matches literal value and skips only the next single character. recordName default If unspecified, defaults to {RootElementName}_Record. Designer justification input fieldPositions[].justification supports only Left and Right. Looking ahead This preview is another step toward making Azure Logic Apps Standard, a more complete and productive platform for enterprise integration modernization. Whether you are onboarding new partner feeds, modernizing BizTalk-style flat-file processing, or automating recurring operational files, Flat File Schema Generation helps reduce setup friction and get integration workflows moving faster.
