AI Gateway tier of API Management now in public preview
Today, we are introducing the AI Gateway tier of Azure API Management, now in public preview. It gives platform teams a purpose-built experience built specifically for AI workloads - publishing and governing models and MCP servers. Controls are configured through policy cards rather than XML and expressions, and the portal experience and control plane are structured around models, MCP servers, and tools rather than APIs. (For brevity, we refer to the AI Gateway tier as AI Gateway throughout the rest of this article.) AI Gateway is built on Azure API Management, bringing proven operational capabilities to AI workloads. The resource runs in your subscription, uses your Entra tenant, and sends telemetry to destinations you control. The operating model will be familiar to existing API Management customers, but the interface is built around AI workloads. The AI Gateway tier is intended for teams that want this focused experience; other API Management tiers remain the right choice when organizations also need general-purpose API management or capabilities not included in the AI Gateway experience. A practical model for platform teams The AI Gateway gives platform teams a shared place to manage models, MCP servers, policies, and observability destinations, with access controlled through Azure RBAC. For example, a central platform group can connect a set of approved models and tools and publish them for application teams. The application teams can test those assets in the test console and build against them without routing every change through the central group. The platform group still owns the shared guardrails and can see how the assets are being used. After an asset is published, developers can create a named runtime key and begin calling the gateway immediately. Bring the models and tools you already use Most organizations don't standardize on a single model provider. Different models are selected based on quality, latency, cost, geography, or specialized capabilities. The preview supports models from Microsoft Foundry including OpenAI, Anthropic, Mistral, and other Foundry hosted models, as well as models hosted in AWS Bedrock, Google Vertex AI, OpenAI, and Anthropic. A guided wizard simplifies importing models from Microsoft Foundry. Other providers can be added by configuring a connection, with backend authentication configured as part of that connection. All published models are available under the same stable endpoint. Applications continue to use supported API formats such as OpenAI Chat Completions and Responses or Anthropic Messages directly or via SDKs. The AI Gateway extends governance beyond models to the MCP servers and tools agents use to interact with enterprise systems. You can expose an existing MCP server over SSE or Streamable HTTP, turn all or selected operations from a REST API into an MCP server by uploading its OpenAPI specification, or use more than 1,400 connector-backed tools from the Power Platform and Logic Apps library. You can also federate multiple MCP servers behind a single server, so an agent connects once and sees the tools across those servers. Backend authentication supports an API key, OAuth client credentials, managed identity, or mTLS. Governance that's built in Organizations need consistent governance across models and MCP servers without requiring every application team to implement those capabilities independently. The AI Gateway portal presents governance policies through an intuitive card-based experience rather than requiring policy XML. The same policies are expressed as JSON properties, making them easy to manage as infrastructure as code and to audit and enforce across a fleet with Azure Policy. In the public preview, those cards cover request and token rate limits, token quotas, Azure AI Content Safety, and fallback to a secondary model. Policies are applied per asset, making it clear which controls protect each model or MCP server. OpenTelemetry-based token metrics The AI Gateway emits token-usage metrics through OpenTelemetry, with attributes following GenAI and cloud semantic conventions. Metrics can be sent to Application Insights, Datadog, Splunk, Grafana Cloud, or another OTLP endpoint. The portal provides a monitoring view over Application Insights data. Better together: Microsoft Foundry and AI Gateway With AI Gateway, teams can extend the same governance controls, for example token rate limits and quotas, across models hosted in Microsoft Foundry and models hosted elsewhere. Foundry and non-Foundry models are published through gateway-managed endpoints, giving applications and agents a consistent way to access governed models regardless of where they are hosted. Foundry-hosted agents can consume curated sets of tools from Foundry toolboxes, with access to the underlying MCP servers and APIs governed through AI Gateway. Together, Microsoft Foundry and AI Gateway cover the enterprise application lifecycle: Foundry for building and running AI applications, and AI Gateway for publishing, governing, and observing models, tools, and MCP servers across your AI estate. The new AI Gateway tier will soon be available through the gateway experience in Microsoft Foundry portal. We are working toward a seamless, integrated AI Gateway experience within Foundry portal and will share more about that work separately. Available today in public preview The AI Gateway tier is available today at no cost in public preview in East US 2 and Sweden Central. Pricing will be shared separately. To provision a resource, add a model or MCP server, and make a first call click this to go to the AI Gateway tier portal and try it. If you prefer to start from code, use a sample to deploy all the required resources for a Foundry-hosted agent configured to access its model and tools through AI Gateway. We look forward to your feedback as we continue to rapidly evolve AI Gateway.Use connectors with Managed Identity in the Logic Apps Standard extension
Managed Identity is Azure’s built-in way to authenticate to Microsoft Entra-protected resources without storing credentials, secrets, or connection strings. Deployed Logic Apps have supported it for a while, but the developer inner loop was a different story. You would wire up one authentication method to run and debug locally, then swap it for another before deploying to the cloud. The Logic Apps Standard extension for Visual Studio Code now lets you create connectors that use Managed Identity as an authentication parameter and run them while you build and debug locally. This works for both Azure managed connectors and service provider connectors. When you run locally, the extension authenticates as your signed-in developer identity using the Azure default credentials pattern. After you deploy, the same connection authenticates with the app’s managed identity. Why this matters for developers You gain two things. Stronger security. Managed Identity removes the requirement to keep API keys or connection strings around to reach your target systems. As the Azure Logic Apps managed-identity guidance puts it, a managed identity “removes the need to store and manage credentials, secrets, or access tokens.” Fewer secrets in your settings mean a smaller attack surface and less to rotate. One setup for local and cloud. Many teams keep one authentication configuration for local runs and redefine it for cloud deployment, and those differences often cause deployment errors. With the Azure default credentials pattern, your app authenticates with your local sign-in while you develop, then with a managed identity after you deploy. The transition needs no code changes. One connection definition covers both environments. Prerequisites Make sure you are on these versions or later: Logic Apps Standard VS Code extension 5.961.19+ Bundle 1.165.52+ Azure CLI 2.51+ Az PowerShell module You must be logged on Azure CLI (using az login) and Az Powershell module (using Connect-AzAccount). How to enable Add the following app setting to both ./local.settings.json and ./workflow-designtime/local.settings.json: { "IsEncrypted": false, "Values": { "WORKFLOWS_AUTHENTICATION_METHOD": "managedServiceIdentity" } } Then reload the Visual Studio Code window so that both the extension and the design-time engine pick up the new setting. Both files matter. The design-time engine reads its own settings file to power the designer, so skipping it is a common reason the change does not take effect. From Logic Apps extension version 5.981.1, you can choose enable Managed Identity as an authentication method by default, by checking the following extension setting: If you are not ready to use managed identity yet, you can change the WORKFLOWS_AUTHENTICATION_METHOD value to Raw. But notice that this flag enables managed identity for the whole application, so if you are planning to use this feature you need it set to managedServiceIdentity. You might want to keep the existing behavior in case your existing CI/CD pipeline requires the Raw authentication method in connections.json or parameters.json. Also notice that this is a local only setting - it is added to local.settings.json files, which are not captured by source control. How it works This uses the Azure default credentials pattern. When your workflow needs a token, the credential chain tries a series of sources in order and stops at the first one that can issue a token. Locally, that resolves to your developer identity, such as your Azure CLI az login session, your Visual Studio Code sign-in, or Azure PowerShell. After you deploy, it resolves to the app’s managed identity, which can be system-assigned or user-assigned. The configuration stays the same across both environments. Whichever identity you use, your local user while developing or the managed identity once deployed, it needs the right RBAC roles on the resources it accesses. If a connection returns an authorization error, check the role assignment on the target resource first. The WORKFLOWS_AUTHENTICATION_METHOD flag behaves differently for each connector family. The next two sections cover both. Deep dive: Azure managed connectors For managed connectors, the flag does two things. It removes the requirement for a local connection key to authorize your logic app to talk to the managed connector, its access control layer (ACL). The change is transparent: the designer shows that you now have access to the connector. You can confirm it by inspecting the connection’s access policies. It authenticates the connector to the end system using the managed identity, or your user context when you run locally. You pick Managed Identity as the authentication type when you create the connection. Creating an Azure Blob Storage (managed) connection with Authentication Type set to “Logic Apps Managed Identity.” One limitation applies today. The Managed Identity implementation for managed connectors does not generate dynamic values inside the designer. You can still configure the connector, but you supply custom values instead of picking from dynamically populated dropdowns. Deep dive: Service provider connectors Service provider connectors support dynamic parameters today. You create the connection, choose Managed Identity as the authentication type, and keep using the designer’s dynamic values as usual, such as entering the fully qualified namespace for a Service Bus connection. Creating a Service Bus (service-provider) connection with Managed Identity. The connector supports dynamic parameters such as the Fully Qualified Namespace. Try it and let us know If you build integrations on Logic Apps Standard, update to the latest extension, set WORKFLOWS_AUTHENTICATION_METHOD to managedServiceIdentity, and give your connectors a passwordless local inner loop. This small setting removes secrets from your configuration and keeps authentication consistent from your laptop to the cloud. Have feedback, or a scenario you would like to see supported, such as dynamic values for managed connectors? Share it with the Logic Apps Aviators community at aka.ms/aistechcommunity. Your input shapes the roadmap. Learn more Authenticate connections with managed identities in Azure Logic Apps Create Standard logic app workflows with Visual Studio Code DefaultAzureCredential overview (Azure Identity client library)Logic Apps Aviators Newsletter - August 2026
In this issue: Ace Aviator of the Month News from our product group News from our community Ace Aviator of the Month August 2026's Ace Aviator: Sonny Gillissen LinkedIn: https://www.linkedin.com/in/sonnygillissen/ What's your role and title? What are your responsibilities? Integration Architect / Cluster Lead I'm responsible for running Integration projects at our customers, and next to that I'm leading our team of Integration Experts by embedding our mission and vision deeply in the roots of our team. Can you give us some insights into your day-to-day activities and what a typical day in your role looks like? My day typically consists out of working together with my customer to validate our integration solutions and form next steps to provide the best fit. This could be meeting with the business to gather requirements, or check in with the team to find the best approach. From an internal perspective I'm working on our go-to-market to keep it aligned with the company's vision and movements in the market, together with our team of Integration Experts. What motivates and inspires you to be an active member of the Aviators/Microsoft community? The fact that it such an active community, and people are very much willing to help each other is what drives me te be an active member too. Especially when you could help someone with your expertise is what really makes my day and provides all the energy to keep outperforming myself, every single day. Looking back, what advice do you wish you had been given earlier that you'd now share with those looking to get into STEM/technology? You don't have to do everything alone. When working with techhology, it may feel like you're the only one at times, especially when you're hitting that one niche problem. But in fact, others can have such a positive impact, so keep asking. What has helped you grow professionally? First of, I really believe having a team of experts around you that you can collaborate with helped a lot. But on the other hand, actively sharing knowledge and digging into problems of others is what really helped me grow. Not only professionally, also as person. If you had a magic wand that could create a feature in Logic Apps, what would it be and why? This question was easier to answer when there wasn't a thing like Logic Apps Automation, as I believe this was my magic wand before: putting the power of integration in everyone's hand. But, with that said, I think it would be cool of you can have an “Logic Apps Agent” that creates and maintains your envisioned integration by itself, or with it’s Logic App co-workers (of course with some checkin’ in to you at times). In my opinion this would really bring the power of Logic Apps to literally everyone. News from our product group AI Gateway tier of API Management now in public preview The public-preview AI Gateway tier of Azure API Management provides a purpose-built experience for publishing and governing AI models, MCP servers, and tools. It supports models from Microsoft Foundry and other providers, connector-backed tools, card-based governance policies, Azure RBAC, and OpenTelemetry token-usage metrics. Changing the engine while the plane is flying: migrating 60,000 apps under live load This engineering account describes migrating roughly 60,000 Integration Account Function apps from end-of-life runtimes to Azure Functions v4 isolated worker. The team used shadow traffic, parity checks, progressive regional rollout, configuration-based rollback, privacy-preserving telemetry, and a stop-before-delete retirement process. Hybrid Logic Apps on RKE2: a self-managed cluster with MetalLB This walkthrough shows how to deploy Azure Logic Apps Hybrid on a self-managed RKE2 Kubernetes cluster using MetalLB. It covers Azure Arc, the Container Apps extension, custom locations, connected environments, ingress, and RKE2-specific fixes involving inotify limits, CoreDNS configuration, and the missing kube-dns service alias. Announcing Flat File Schema Generation support in Azure Logic Apps Standard Azure Logic Apps Standard now provides a preview built-in action that generates BizTalk-compatible flat-file XSD schemas at runtime from sample payloads. It supports common delimited and fixed-width formats and can feed generated schemas into Flat File Encoding or Decoding actions. Hybrid Logic Apps Deployment on Red Hat OpenShift This guide explains how to deploy Azure Logic Apps Hybrid on self-managed Red Hat OpenShift or Azure Red Hat OpenShift. It covers Azure Arc, SMB storage, OpenShift security context constraints, the Container Apps extension, custom locations, connected environments, ingress choices, DNS configuration, and troubleshooting. Coding with Logic Apps Standard: Local Functions This article introduces Local Functions in Azure Logic Apps Standard, which let developers write, debug, and deploy custom .NET code alongside workflows in the same project. Workflow-scoped code can share the Logic App’s deployment, scaling, security, and operational boundary without requiring a separate Azure Functions resource. Common scenarios include message validation, payload enrichment, custom parsing, business rules, and BizTalk modernization. The article also explains when Local Functions are preferable to independently hosted Azure Functions and how they fit into a unified CI/CD process. News from our community What's New with Logic Apps Post by Gabriel Yang The article reviews how announcements from Integrate 2026 move Azure Logic Apps toward a central role in enterprise automation and AI orchestration. It covers Logic Apps Automation, AI-assisted workflow authoring, Knowledge as a Service, direct Azure AI Foundry Agent invocation, the Logic Apps Standard SDK for C#, and Azure Connector Namespace access from custom applications. Together, these capabilities reduce infrastructure and integration complexity while retaining governance and scalability. The broader value is a more accessible orchestration layer connecting enterprise systems, knowledge, agents, and operational business processes. Monitoring Is Not Reconciliation Post by Al Ghoniem, MBA The article distinguishes technical monitoring from business reconciliation in enterprise integrations. Successful Logic Apps runs, Service Bus metrics, and API responses show that known work executed, but cannot prove every expected transaction reached the target correctly. Effective reconciliation compares expected and actual states using independent reference sets, stable business identifiers, appropriate timing windows, and risk-based matching depth. It also requires liveness checks, explicit ownership, and controlled recovery decisions. The approach helps detect missing, duplicate, late, or inconsistent transactions before customers, auditors, or downstream controls expose them. Power Automate's Big Brother - Azure Functions Connector Namespaces Video by Sean Astrakhan The video demonstrates using Azure Functions connector namespaces to trigger Python code from services such as Dataverse, Outlook, and SharePoint. A Dataverse record-creation scenario invokes a function that populates an expiration date, with GitHub Copilot helping author, deploy, and test the solution. The example also highlights the need to direct Copilot toward connector namespaces instead of older HTTP-trigger and webhook patterns. This approach combines managed connector access with pro-code flexibility, reducing separate flow and connection requirements while making Azure Functions more approachable for integration developers. Building Stateful Agentic AI Workflows with Azure Standard Logic Apps Post by Sakshi Mittal The guide explains how stateful agentic workflows extend Azure Logic Apps Standard beyond fixed API orchestration. It compares autonomous agents for repetitive background tasks with conversational agents for interactive scenarios, then outlines prerequisites such as AI model access, connectors, RBAC, managed identities, and Application Insights. It contrasts adaptive agent state with conventional workflow run state and reviews benefits including automation, scale, and contextual decisions. It also highlights trade-offs around cost, nondeterminism, debugging, privacy, latency, and governance, helping teams choose an appropriate pattern before production. Logic Apps Automation Preview Post by Steef-Jan Wiggers This assessment examines Logic Apps Automation as a managed, single-tenant experience with Microsoft-managed capacity, a project-and-application hierarchy, agent tooling, sandboxed code execution, and real-time run history. A failure-triage example shows how agents can use runbook knowledge and structured outputs while deterministic branches control tickets and retries. The article also identifies preview limitations, including missing CI/CD, ownership transfer, audit visibility, and uncertain network support. Its central recommendation is to pilot nonregulated workloads while defining project ownership, app-level access, governance, and deployment requirements before broader enterprise adoption. Azure Logic Apps Standard | Testing Series Post by Andrew Wilson The article introduces a practical testing series for Azure Logic Apps Standard, addressing reliance on manual runs and run-history inspection as workflow estates grow. It proposes layered validation covering testable workflow design, mocked action outputs, unit tests derived from workflow definitions in Visual Studio Code, integration tests, and agent-assisted testing. The approach emphasizes deterministic boundaries, separation of orchestration from connector-heavy implementation, observability through tracking and correlation, and behavior-focused environment parity. These practices aim to create faster feedback, clearer regression detection, and repeatable confidence across frequent workflow changes and deployments. Mastering Error Handling and Retry Design in Logic Apps Post by Parth T. Distributed workflows routinely face timeouts, throttling, network interruptions, and unavailable dependencies, making resilience a core Logic Apps design concern. The article outlines how to identify likely failure points, use fallback paths and compensating actions, and apply bounded retries with exponential backoff and idempotent operations. It also emphasizes thorough logging, correlation identifiers, stakeholder notifications, and deliberate testing of failure scenarios such as invalid responses and partial execution. These practices help teams prevent cascading failures, improve diagnosis, and maintain stable business processes when transient or permanent faults occur. Introduction to Knowledge Base as a Service KBaaS | Built-In Knowledge for Azure Logic Apps Video by Srikanth Gunnala Building retrieval-augmented agents normally requires document chunking, embeddings, a vector store, retrieval logic, and orchestration. This video introduces Knowledge Base as a Service in Azure Logic Apps, which manages those components behind a built-in knowledge-base experience. It demonstrates connecting Azure Cosmos DB and Azure OpenAI, uploading documentation, and attaching the resulting knowledge base to a conversational agent. An internal API documentation assistant provides the practical scenario, showing how an agent can answer questions with responses grounded in uploaded source material while reducing custom RAG infrastructure and setup work. Knowledge Base as a Service in Azure Logic Apps Post by Steef-Jan Wiggers Knowledge retrieval for Logic Apps agents has traditionally required a separately configured search index, indexer, data source, chunking strategy, and embeddings pipeline. This walkthrough explains how the preview Knowledge Base as a Service capability instead parses, chunks, summarizes, vectorizes, and stores uploaded content through Azure Cosmos DB and Azure OpenAI. An HR policy agent demonstrates grounded answers, citations, and appropriate fallback for out-of-scope questions. The article also provides deployment steps, a Bicep-based sample, and practical notes on portal persistence, connection configuration, model availability, authentication, and workflow schema requirements. Vibe Coding Logic Apps in Azure: Automating Complex Workflows with AI Assistance Post by Marcel Broschk The article examines how natural-language, AI-assisted development can accelerate Azure Logic Apps workflow creation without replacing engineering judgment. It covers the native workflow assistant, GitHub Copilot scaffolding, structured prompts, agent-and-workflow patterns, MCP servers, and AI-oriented designs such as retrieval-augmented generation. It also recommends repository-level Copilot instructions, automated tests, static analysis, security controls, and human review. The approach helps integration teams move from intent to deployable workflows faster while retaining responsibility for architecture, authentication, error handling, governance, and operational reliability. Are Azure Logic Apps really low-code or no-code? Post by Chris Bradshaw The article evaluates whether Azure Logic Apps is genuinely no-code and concludes that low-code is the more accurate description. Simple connector-based workflows may require no coding, but production integrations commonly involve expressions, JSON editing, error handling, transformations, infrastructure as code, deployment pipelines, and governance. It offers practical guidance for choosing Logic Apps for orchestration and visible workflows, Azure Functions for custom logic and performance, or a hybrid architecture combining both. This framing helps teams match each service to the problem rather than relying on marketing labels. Azure Logic Apps at Integrate 2026: The Announcements Post by Steef-Jan Wiggers The article reviews five Azure Logic Apps announcements from Integrate 2026 and their implications for integration architects. It covers Logic Apps Automation, Knowledge as a Service, native Azure AI Foundry agent integration, the Logic Apps Standard SDK, and Azure Connector Namespace. Together, these capabilities simplify managed workflow hosting, retrieval-augmented generation, agent orchestration, code-first C# development, and connector reuse outside the workflow runtime. The analysis positions Logic Apps as an enterprise AI connectivity and orchestration layer and recommends revisiting hosting, knowledge retrieval, and SDK adoption decisions. Azure Logic Apps Agent Loop Production Operations Post by Steef-Jan Wiggers Production agent loops require more than successful workflow runs. This article explains how Standard Logic Apps can use Application Insights, run history, and KQL queries to monitor requests, dependencies, exceptions, tool calls, token use, and execution duration. It compares Standard and Consumption pricing, outlines tool, throttling, and conversation-history limits, and describes repeatable deployment through source-controlled workflow definitions, zip deployment, Azure CLI, and environment-specific settings. The guidance helps teams evaluate operational readiness, cost behavior, observability, and deployment practices before moving agentic workflows into production. Event-Driven Automation Post by Uttam Chaturvedi File-arrival notifications can be automated with an Azure Logic Apps Consumption workflow. This walkthrough creates a private Blob Storage container, configures a blob-created trigger, sends file metadata to a REST endpoint through an HTTP action, and emails the team through Office 365 Outlook. It also covers resource organization, testing, run history, security, pricing, and possible extensions such as Teams notifications, SQL persistence, Azure Functions, approvals, and CI/CD deployment. The pattern demonstrates event-driven integration without manually operated scripts or continuously running servers. Azure Logic Apps Tracking Properties – A Complete Team Guide (Part 2) Post by Sandro Pereira Tracking Properties improve Logic Apps observability by adding relevant business and technical context to action telemetry. This guide shows how to configure them on individual actions through the designer’s Settings pane or the trackedProperties section in code view. Values may be static, dynamic, or combined, although expressions must be entered manually without IntelliSense and should be validated carefully. Recommended practices include tracking useful identifiers, standardizing property names, keeping values concise, and excluding credentials or personal data, making Log Analytics queries, dashboards, monitoring, and troubleshooting more consistent. Navigating Cost Pitfalls in Logic App Consumption Plans Post by Parth T. Consumption-based Logic Apps can accumulate unexpected charges through frequent polling, premium connectors, redundant actions, large loops, unnecessary runs, retries, API calls, and oversized payloads. This article recommends event-based triggers, appropriate polling intervals, trigger conditions, simpler workflow logic, filtered or batched processing, and reduced connector calls. It also advises continuous monitoring with Azure Monitor and Cost Management, budgets and alerts, periodic execution reviews, managed identities, and documented architectures. These practices support more predictable spending while preserving workflow performance, scalability, governance, and operational visibility. Streamlining Logic Apps: The Importance of Versioning and CI/CD Post by Parth T. Reliable Logic Apps delivery requires disciplined change tracking and automated deployment rather than manual updates. This article explains how version control supports traceability, collaboration, audits, troubleshooting, and rollback, while CI/CD validates, tests, and promotes workflow changes consistently across environments. Recommended practices include semantic versioning, Git repositories, feature branches, ARM or Bicep infrastructure definitions, parameterized environment settings, Key Vault secrets, approval gates, release notes, monitoring, and rollback plans. Together, these methods reduce deployment risk and downtime while improving release speed, consistency, governance, and maintainability.Sentinel Foundry - MCP Server (Github Community Release)
I’ve been cooking something that a lot of people in SOC have been struggling with — especially on the engineering side of Microsoft Sentinel. Thanks to the Microsoft Security team for shaping the capabilities of Sentinel even better with Sentinel Data Lake & Modern SecOps. Today’s the day I can finally share it. Note: This is not an official Microsoft product, but it is designed to make the Sentinel Build even better (complement) with much more intelligence. 🚀 Sentinel Foundry is now in public preview with 43 tools. (Sentinel Foundry - MCP Server) It’s an MCP server built to act like the brain of a strong Sentinel engineer — helping make building, improving, and operating Sentinel far more practical, faster, and honestly more enjoyable. For a lot of teams, the challenge is not understanding what Sentinel can do. The hard part is the engineering work around it: -> Deciding what data should actually be ingested -> Building a clean, scalable Sentinel foundation -> Writing useful detections instead of noisy ones -> Balancing security value with cost -> Turning ideas into deployable engineering outputs That is exactly why I built Sentinel Foundry to help communities grow stronger. It helps with the real engineering tasks behind Sentinel — from architecture thinking to detection design, deployment planning, ingestion strategy, automation ideas, and many of the workflows outlined in the GitHub project. How does it work? Here’s one of the flagship prompts I ran with it: “Give me a complete security posture report for our workspace. Score each pillar and tell me what to prioritise.” And within seconds, it produced a structured engineering blueprint that would normally take a lot longer to pull together manually. You can see the example prompts here in what it can do: https://github.com/prabhukiranveesam/Sentinel-Foundry#what-can-it-do I want building Sentinel to feel less like repetitive engineering overhead — and more like real security engineering that is fast, creative, and enjoyable. If you work with Sentinel as a SOC L2 analyst, engineer, detection engineer, consultant, or architect, I’d genuinely love for you to try it and tell me what you think. 🔗 Public Preview: https://github.com/prabhukiranveesam/Sentinel-Foundry This is just the start of an AI era — and I’m excited to keep shaping it with more powerful features over the coming days. This is very easy to set up and will be available to all of you at no cost during this month as part of the public preview, and your feedback is extremely valuable to shape this as a powerful solution.
Data Connectors Storage Account and Function App
Several data connectors downloaded via Content Hub has ARM deployment templates which is default OOB experience. If we need to customize we could however I wanted to ask community how do you go about addressing some of the infrastructure issues where these connectors deploy storage accounts with insecure configurations like infrastructure key requirement, vnet intergration, cmk, front door etc... Storage and Function Apps. It appears default configuration basically provisions all required services to get streams going but posture configuration seems to be dismissing security standards around hardening these services.Announcing Flat File Schema Generation support in Azure Logic Apps Standard
We’re excited to announce the preview of Flat File Schema Generation for Azure Logic Apps Standard. This new built-in action helps integration teams move faster by generating BizTalk compatible flat-file XSD schemas directly from sample flat-file payloads, reducing the manual effort required to model CSV, delimited, and positional files before encoding or decoding them in workflows. Why this matters Flat files continue to power enterprise mission critical integrations, from partner feeds and batch exports to finance ledgers, operational reports, and legacy system exchanges. While Azure Logic Apps already helps teams encode and decode flat files, creating the required flat-file schema has often been a separate design-time step. With Flat File Schema Generation, you can now accelerate that onboarding experience by generating a starter schema from real sample data within the workflow itself. What’s new The new Flat File Schema Generation action generates a flat-file XSD schema from sample content that you pass into the action. The generated schema includes BizTalk-compatible flat-file annotations, making it suitable for downstream Flat File Encoding and Flat File Decoding actions in Azure Logic Apps Standard workflows. Runtime schema generation: Generate schemas directly from sample flat-file payloads in the workflow. Delimited and positional support: Create schemas for common CSV, semicolon-delimited, tab-delimited, and fixed-width files. BizTalk-compatible annotations: Use generated schemas with the existing flat-file processing model familiar to BizTalk and enterprise integration teams. Flexible naming: Configure root element names, namespaces, record names, delimiters, and field positions to match your integration needs. How it works You provide a representative sample payload, specify whether the file structure is delimited or positional, and configure the relevant parsing details such as field delimiters, record delimiters, header handling, or fixed-width field positions. Once you run the workflow, the action returns the generated XSD schema as XML output, which can then be passed into subsequent flat-file operations or stored as part of your onboarding flow. Get started To try the preview, add the Flat File Schema Generation action to a Logic Apps Standard workflow, provide a sample flat-file payload, choose the record structure, and configure the field or record settings that match your format. Use the generated schema output with Flat File Decoding or Encoding in the same workflow or incorporate it into your broader onboarding process for flat-file integrations. Reference document: Encode, Decode, or Generate Schemas for Flat Files - Azure Logic Apps | Microsoft Learn. A walkthrough of generating a flat-file schema from sample data Use the following walkthrough to try the preview end to end with a simple customer order file. The same pattern can be adapted for semicolon-delimited, tab-delimited, or fixed-width positional files. Delimited sample: For this example, assume a trading partner sends a comma-separated order file with a header row and repeating order records. Sample file: OrderId,CustomerName,OrderDate,Amount,Region 10001,Contoso Retail,2026-07-01,1250.75,North 10002,Fabrikam Foods,2026-07-02,890.00,West 10003,Northwind Traders,2026-07-03,2400.50,South Configuration values Parameter Example value Record Structure Delimited Has header Yes Record delimiter newline Field delimiter , Field delimiter order Infix Escape character Double quote, if the source file uses quoted values Root element name (Advanced Parameters) Orders Record name (Advanced Parameters) Order Target namespace (Advanced Parameters) http://schemas.contoso.com/orders In the Azure portal, open your Logic Apps Standard resource and select the workflow where you want to generate the schema. Add a trigger, such as When an HTTP request is received, or use any trigger/action that provides the sample flat-file content. Add a new action and search for Flat File. Select the Flat File Schema Generation action. In the action, provide the sample flat-file content. Select the file structure type. For this example, choose Delimited. Enter the schema metadata under advanced parameters, such as the root element name, record name, and target namespace. Configure the delimiter settings, including the field delimiter and record delimiter. If the first row contains column names, enable the option to use the first row as headers. Save and run the workflow. Open the workflow run history and review the action output. The action returns a generated XSD schema with flat-file annotations. Review the generated schema, validate field names and inferred data types, and use the schema with Flat File Decoding or Flat File Encoding in your workflow. Positional sample: Fixed-width customer order file Use this example when the source flat file doesn’t use delimiters. In a positional, or fixed-width, file each field starts and ends at a known character position. The schema generation action needs those field positions so it can split each record correctly. Sample positional file: 10001CONTOSO00120260701000125075NORTH 10002FABRIKAM0120260702000089000WEST· 10003NORTHWIND120260703000240050SOUTH Note: The dot symbol in the second record represents a trailing space used for fixed-width padding. Replace it with an actual space in your real sample payload. Field position map Field Start position Length Justification Example value OrderId 1 5 Right 10001 CustomerCode 6 10 Left CONTOSO001 OrderDate 16 8 Right 20260701 Amount 24 9 Right 000125075 Region 33 5 Left NORTH Configuration values for the positional sample Parameter Example value Record Structure Positional Has Header No Record delimiter newline Field positions Use the field names, lengths, and justification values from the field position map. Root element name (Advanced Parameters) Orders Record name (Advanced Parameters) Order Target namespace (Advanced Parameters) http://schemas.contoso.com/orders/positional Step-by-step walkthrough for positional files In the Azure portal, open your Logic Apps Standard resource and select the workflow where you want to generate the schema. Add a trigger, such as When an HTTP request is received, or use an existing action that provides the fixed-width file content. Add a new action and search for Flat File. Select the Flat File Schema Generation action. Paste the positional sample payload into the sample content input. Make sure every record has the same total length. For the structure type, choose Positional. Enter the schema metadata, including root element name, record name, and target namespace. Configure the record delimiter. For this example, use newline. Add the field positions in order: OrderId length 5, CustomerCode length 10, OrderDate length 8, Amount length 9, and Region length 5. Set justification for each field. Use Right for numeric or date-like fields and Left for text fields that may contain trailing space padding. Save and run the workflow. Open the workflow run history and review the generated XSD schema output. Confirm that the field names, order, lengths, and positional annotations match the source record layout. Use the generated schema with Flat File Decoding to parse incoming fixed-width files into XML, or with Flat File Encoding to generate outbound fixed-width files. Limitations and known issues Limitation Description Type inference uses a single record. The first non-empty data record determines column types. Single record type only The action generates one repeating record structure and doesn't support heterogeneous record layouts. No nested or hierarchical records The generated schema is flat, meaning you have a root element with one repeating child record and fields. Positional boundaries aren't automatically detected. You must provide exact field lengths in field Positions. UTF-8 code page only Generated schema sets codepage="65001" and doesn't expose encoding selection. Escape-character behavior is literal. Escape handling matches literal value and skips only the next single character. recordName default If unspecified, defaults to {RootElementName}_Record. Designer justification input fieldPositions[].justification supports only Left and Right. Looking ahead This preview is another step toward making Azure Logic Apps Standard, a more complete and productive platform for enterprise integration modernization. Whether you are onboarding new partner feeds, modernizing BizTalk-style flat-file processing, or automating recurring operational files, Flat File Schema Generation helps reduce setup friction and get integration workflows moving faster.
Write Logic Apps in C#: introducing the Logic Apps Standard SDK
The workflow you always wished you could write in code If you build on Logic Apps Standard, you already know the deal: the runtime is excellent at the unglamorous parts of integration - connecting to systems, retrying, scaling, keeping run history you can actually debug. What you sometimes wanted was a different front door. You're a .NET developer. You live in C#, source control, and pull requests. And for a long time, authoring a workflow meant leaving all of that behind for a visual designer and a JSON file. That's the gap the new Logic Apps Standard SDK closes. It lets you define Logic Apps Standard workflows in code - strongly typed, IntelliSense-guided C# - without giving up a single thing the runtime already does for you. What is the Logic Apps Standard SDK? The Logic Apps Standard SDK (Microsoft.Azure.Workflows.Sdk) is a NuGet package that gives you a fluent, code-first way to build workflow definitions in C#. Instead of dragging actions onto a canvas, you compose a workflow with method chaining: a trigger, then the actions that follow it, all the way to a response. Worth saying clearly, because people ask: this is a new way to define workflows - not a new runtime. The workflows you write with the SDK compile down to the same definitions and run on the same Logic Apps Standard runtime you use today. Same connectors. Same hosting. Same rich run history and monitoring. You're changing the authoring experience, not the engine underneath it. Why this matters for developers When your workflow lives in C#, it behaves like the rest of your code. A few things fall out of that almost for free: Type safety and IntelliSense - connector operations, triggers, and outputs are discoverable as you type, and the compiler catches mistakes before you run anything. Real source control and reviews - workflows diff like code, get reviewed in pull requests, and version alongside the services they orchestrate. Familiar tooling - refactor, debug with F5, and lean on the .NET ecosystem you already know. Extensibility on your terms — Compose your workflow declaratively with the fluent builder, then drop into plain imperative C# wherever a step needs logic that might be too complex to implement declaratively - loops, branching, a call into your own library, all encapsulated in a step of your workflow - without leaving the file or the language. And it isn't limited to one style of work. The SDK covers both enterprise integration workflows - the connect-systems-and-move-data scenarios Logic Apps is known for - and agentic workflows, where a conversational or autonomous AI agent drives the steps. Both are first-class in the same SDK, built from the same building blocks. There's one more angle worth calling out, because it's becoming hard to ignore: coding agents are simply better at writing imperative code than declarative JSON. And the reason is the same set of guardrails that helps you. Strong typing and a compilation step mean the code an agent produces is syntactically correct out of the gate — the type system and the compiler do the checking, so you don't have to. Layer unit tests on top and you've covered north of 90% of what matters; what's left is integration testing. Getting an LLM to the same level of accuracy against declarative JSON means building dedicated tooling to stand in for everything the compiler gives you for free. With code-first workflows, those guardrails are just there — which makes this a natural fit for an agent-assisted way of building. Getting started Everything here lives in the Logic Apps extension for VS Code. You'll want the Logic Apps Standard VS Code extension version 5.961.10 or later, which includes all the components you need to create code first workflows. Beyond that, the prerequisites are the ones you'd expect - VS Code with the Logic Apps extension, an Azure subscription you can create resources in, and a working comfort with C# and .NET. From a clean start, you're a handful of steps from a running workflow: Create the workspace — launch the Logic Apps extension and choose Create new Logic Apps workspace. Pick a folder, name the workspace and project, and when prompted for the workflow type, choose Logic Apps codeful - that's the code-first option that uses the SDK. Pick a workflow kind - name your first workflow and choose how it runs: Stateful, Autonomous agents (Preview), or Conversational agents (Preview). The agent options are where the agentic scenarios live. Enable connectors - when prompted, select Use connectors from Azure, choose your subscription and resource group, and pick Connection Keys for authentication. Managed identity is still in development, so connection keys are the way in for now. Find your way around - the project opens with Program.cs, which builds and starts the host, plus a workflow file (like workflow1.cs) where your trigger and actions are defined. The SDK compiles those definitions and runs them on the Logic Apps runtime. Run it - press F5 (or right-click Program.cs and pick Overview). The runtime starts locally and an overview page opens where you can fire triggers, watch run history, and inspect inputs and outputs. That last part is worth dwelling on: run history for SDK workflows uses the same rich visual view as designer-built ones. You author in code, but you monitor and troubleshoot exactly as you always have. A look at the capabilities Connectors and triggers Every workflow starts with a trigger and runs a series of actions. The SDK exposes both through two entry points - WorkflowTriggers and WorkflowActions - each split into BuiltIn and Managed. Built-in triggers and actions run directly in the runtime: HTTP request, recurrence, and the conversational agent trigger; actions like Compose, HTTP, Response, and custom code. Managed connectors give you the full Logic Apps connector catalog - Service Bus, SharePoint, SQL, and hundreds more - typed and ready to call. The managed surface is generated from the same connector definitions the designer uses, so the operations you know are right there: // Built-in trigger var trigger = WorkflowTriggers.BuiltIn.CreateHttpTrigger(); // Managed connector action — full catalog, strongly typed var getItems = WorkflowActions.Managed .Sharepointonline("sharepoint") .GetItems( dataset: () => "https://contoso.sharepoint.com", table: () => "orders-list-id") .WithName("GetOrders"); The fluent API streamlines the definition This is where it comes together. You compose a workflow by chaining operations with .Then(...). The shape of your code mirrors the shape of your workflow - read it top to bottom and you read the execution path. trigger .Then(validateOrder) .Then(getOrders) .Then(sendResponse); Control flow is part of the same fluent model. Built-in structures like Condition (if/else) and ForEach - along with Switch, Until, Scope, and Terminate - are just actions you chain in, each taking a small factory for the branch or loop body: var checkTotal = WorkflowActions.BuiltIn.Control.Condition( expression: () => order.Total > 1000, trueBranch: () => requireApproval, falseBranch: () => autoApprove ).WithName("CheckOrderValue"); And ForEach takes the collection to iterate and a factory that builds the body for each item: var processLines = WorkflowActions.BuiltIn.Control.ForEach( items: () => order.LineItems, actions: (item) => new WorkflowBuiltInActions() .Compose(inputs: () => $"Line: {item}").WithName("HandleLine") ).WithName("ProcessLineItems"); Need parallel branches that fan back in? The same Then pattern handles branching and join - no JSON wiring, no run-after blocks to hand-edit. Extending workflows with custom code Some logic doesn't belong in a connector or an expression - it's just code. The CustomCode action lets you drop a real C# method into the middle of a workflow. It receives a WorkflowContext, so you can read the trigger payload or any earlier action's results and return a strongly typed value the next step can use: var enrich = WorkflowActions.BuiltIn.CustomCode<string>(async (context) => { var trigger = await context.GetTriggerResults(); var order = await context.GetActionResults("GetOrders"); // your logic, your libraries, your types return "enriched"; }).WithName("EnrichOrder"); That's the escape hatch that keeps you in flow: when a step needs custom transformation, validation, or a call into your own libraries, you write a method instead of bending an expression to do something it was never meant to. Handling failures: try/catch with run-after Real workflows have to deal with things going wrong, and the SDK gives you the same try/catch shape Logic Apps has always had - expressed in code. The .Then(...) overload takes a FlowStatus[] run-after condition, so a handler runs only when the step before it ends in a status you name. Wrap the risky work in a Scope (your try), then chain a handler that runs after it Failed or TimedOut (your catch): var tryProcess = WorkflowActions.BuiltIn.Control.Scope(() => callPaymentApi.Then(saveOrder) ).WithName("ProcessPayment"); var handleFailure = WorkflowActions.BuiltIn .Compose(inputs: () => "Payment failed — compensating") .WithName("HandleFailure"); trigger .Then(tryProcess) .Then(handleFailure, runAfter: new[] { FlowStatus.Failed, FlowStatus.TimedOut }); The status set is the whole vocabulary: Succeeded, Failed, Skipped, and TimedOut. Combine them however a step needs - a cleanup action that should run no matter what can list every status; a finally is just the union. The same idea scales to fan-in. When several parallel branches converge, the per-predecessor RunAfter overload lets the join wait on each branch independently - so you can require some to succeed and tolerate others failing: leftChain .Join(rightChain) .Then(merge, runAfter: new[] { new RunAfter(leftChain, FlowStatus.Succeeded), new RunAfter(rightChain, FlowStatus.Succeeded), }); Putting it together Here's a small but complete shape - an HTTP-triggered order workflow that validates input, branches on order value, loops over line items, runs custom code, and replies. The core steps live in a Scope so a single failure handler can catch anything that goes wrong, and a clean reply only runs when the work succeeds. Notice it's all one readable chain: namespace LogicApps { using Microsoft.Azure.Workflows.Sdk; using Microsoft.Azure.Workflows.Sdk.Connectors.Msnweather; using System.Net; public class OrderWorkflow : IWorkflowProvider { /// <summary> /// Gets the HTTP request/response workflow definition. /// </summary> public FlowDefinition[] GetWorkflows() { // --- Trigger ---------------------------------------------------- var trigger = WorkflowTriggers.BuiltIn.CreateHttpTrigger(); // --- Managed connector action (full catalog, strongly typed) ---- // Reused verbatim from the confirmed stateful1.cs pattern. var getWeather = WorkflowActions.Managed.Msnweather("msnweather").CurrentWeather( location: () => "98058", units: () => unitsInput.Imperial).WithName("GetWeather"); // --- Custom code: real C# in the middle of the workflow --------- var enrich = WorkflowActions.BuiltIn.CustomCode<string>(async (context) => { var triggerResults = await context.GetTriggerResults(); var weather = await context.GetActionResults("GetWeather"); // your logic, your libraries, your types return "enriched"; }).WithName("EnrichOrder"); // --- ForEach over a collection (control flow via .Control) ------- var processLines = WorkflowActions.BuiltIn.Control.ForEach( items: () => trigger.TriggerOutput.Body["lineItems"], actions: (item) => WorkflowActions.BuiltIn .Compose(inputs: () => $"Line: {item}").WithName("HandleLine") ).WithName("ProcessLineItems"); // --- Condition (if/else) (control flow via .Control) ------------ var checkTotal = WorkflowActions.BuiltIn.Control.Condition( expression: () => true, trueBranch: () => processLines, falseBranch: () => WorkflowActions.BuiltIn .Compose(inputs: () => "Auto-approved").WithName("AutoApprove") ).WithName("CheckOrderValue"); // --- Scope groups the core steps so one handler catches failures - var processOrder = WorkflowActions.BuiltIn.Control.Scope(() => checkTotal .Then(getWeather) .Then(enrich) ).WithName("ProcessOrder"); // --- Responses -------------------------------------------------- var ok = WorkflowActions.BuiltIn.Response( responseBody: () => "Order processed").WithName("Reply"); var failed = WorkflowActions.BuiltIn.Response( statusCode: () => HttpStatusCode.InternalServerError, responseBody: () => "Order failed").WithName("ReplyFailed"); // --- Assemble --------------------------------------------------- // Happy path runs after the Scope Succeeded; the handler runs after // Failed or TimedOut. trigger .Then(processOrder) .Then(ok, runAfter: new[] { FlowStatus.Succeeded }) .Then(failed, runAfter: new[] { FlowStatus.Failed, FlowStatus.TimedOut }); return new[] { WorkflowFactory.CreateStatefulWorkflow("OrderWorkflow", trigger) }; } } } That last stretch is the best-practice shape in miniature: the happy-path Reply runs only after the Scope Succeeded, while a separate handler catches Failed or TimedOut and returns a 500 - no exception plumbing, just run-after conditions. You implement IWorkflowProvider, hand your trigger graph to WorkflowFactory as a stateful, stateless, or agent workflow, and the host registers it. Run it with F5 and the Logic Apps runtime starts locally - same as any Standard project. Before you build: preview realities I'd rather you go in clear-eyed. While the SDK is in public preview, keep these in mind: Service Provider connectors aren't supported yet - that connector type is coming in a future release. Dynamic schemas aren't supported - support is planned. Custom code supports callback methods only - inline lambdas aren't available in this version. Define and name actions before referencing them - name an action before using it as a dependency elsewhere. Managed identity authentication is in development - use connection keys for connectors in the meantime. Try it, and tell us what you think If you've ever wanted your workflows to live where the rest of your code lives - in C#, in source control, in your pull requests - this is for you. Install the Logic Apps extension for VS Code, create a Logic Apps codeful project, and build your first workflow in code. This is a preview, which means your feedback genuinely shapes where it goes - which capabilities come next, where the rough edges are. Bring issues, feature requests and feedback to our GitHub page. I read it. Let's make code-first workflows something you actually want to use. Related content Create Standard workflow projects with the SDK Logic Apps Standard SDK class libraryIntroducing native Service Bus message publishing from Azure API Management (Preview)
We’re excited to announce a preview capability in Azure API Management (APIM) — you can now send messages directly to Azure Service Bus from your APIs using a built-in policy. This enhancement, currently in public preview, simplifies how you connect your API layer with event-driven and asynchronous systems, helping you build more scalable, resilient, and loosely coupled architectures across your enterprise. Why this matters? Modern applications increasingly rely on asynchronous communication and event-driven designs. With this new integration: Any API hosted in API Management can publish to Service Bus — no SDKs, custom code, or middleware required. Partners, clients, and IoT devices can send data through standard HTTP calls, even if they don’t support AMQP natively. You stay in full control with authentication, throttling, and logging managed centrally in API Management. Your systems scale more smoothly by decoupling front-end requests from backend processing. How it works The new send-service-bus-message policy allows API Management to forward payloads from API calls directly into Service Bus queues or topics. High-level flow A client sends a standard HTTP request to your API endpoint in API Management. The policy executes and sends the payload as a message to Service Bus. Downstream consumers such as Logic Apps, Azure Functions, or microservices process those messages asynchronously. All configurations happen in API Management — no code changes or new infrastructure are required. Getting started You can try it out in minutes: Set up a Service Bus namespace and create a queue or topic. Enable a managed identity (system-assigned or user-assigned) on your API Management instance. Grant the identity the “Service Bus data sender” role in Azure RBAC, scoped to your queue/ topic. Add the policy to your API operation: <send-service-bus-message queue-name="orders"> <payload>@(context.Request.Body.As<string>())</payload> </send-service-bus-message> Once saved, each API call publishes its payload to the Service Bus queue or topic. 📖 Learn more. Common use cases This capability makes it easy to integrate your APIs into event-driven workflows: Order processing – Queue incoming orders for fulfillment or billing. Event notifications – Trigger internal workflows across multiple applications. Telemetry ingestion – Forward IoT or mobile app data to Service Bus for analytics. Partner integrations – Offer REST-based endpoints for external systems while maintaining policy-based control. Each of these scenarios benefits from simplified integration, centralized governance, and improved reliability. Secure and governed by design The integration uses managed identities for secure communication between API Management and Service Bus — no secrets required. You can further apply enterprise-grade controls: Enforce rate limits, quotas, and authorization through APIM policies. Gain API-level logging and tracing for each message sent. Use Service Bus metrics to monitor downstream processing. Together, these tools help you maintain a consistent security posture across your APIs and messaging layer. Build modern, event-driven architectures With this feature, API Management can serve as a bridge to your event-driven backbone. Start small by queuing a single API’s workload, or extend to enterprise-wide event distribution using topics and subscriptions. You’ll reduce architectural complexity while enabling more flexible, scalable, and decoupled application patterns. Learn more: Get the full walkthrough and examples in the documentation 👉 here
