Microsoft Leads a New Era of Software Supply Chain Transparency
Microsoft announces the general availability of Microsoft’s Signing Transparency (MST) – a first-of-its-kind capability that brings unprecedented visibility and trust to our software supply chain. With this release, Microsoft is leading the industry by recording the build of critical cloud services into a publicly readable and verifiable SCITT standard (Supply Chain Integrity, Transparency, and Trust) compliant ledger. This means every production software build for in scope services like Azure Attestation and Azure Managed HSM (Hardware Security Module), Azure confidential ledger, Microsoft Signing Transparency itself (and others over time) – is now logged in an immutable, tamper-evident record. Only builds that are in the MST ledger are deployed to production; this gives customers confidence that the supply chain for these critical services can be audited at anytime. Notably, the MST ledger is fully open source and built to align with the emerging IETF SCITT standard. By embracing SCITT’s principles and open protocols, Microsoft ensures that MST not only secures our own ecosystem but also contributes to a broader industry movement toward standardized supply chain transparency. The open-source MST ledger serves as a verifiable trust anchor that any organization or researcher can inspect, audit, or even integrate with their own tooling. MST itself meets the highest levels of transparency, backed by a tamper-proof confidential ledger, open-source, and independently verified. Specifically, we are making the foundation of our trust model transparent and accessible to everyone – reinforcing that trust must be earned through proof, not just promises. This launch marks a major milestone in our commitment to Zero Trust principles, extending “never trust, always verify” all the way into the build itself. Building on a public preview introduced late last year, MST’s general availability delivers verifiable transparency at the software level. It transforms traditional code signing with an additive trust layer that is accessible via an open verification model. Every new software update is accompanied by a publicly auditable proof of integrity, enabling security teams to proactively confirm that each update is authentic and unaltered. To help organizations get the most out of this capability, we are also introducing a free tool to explore the contents – Ledger Explorer – an offline tool that allows security teams to examine MST ledger entries, verify cryptographic proofs, and even validate the ledger’s integrity independently. This tool, combined with MST’s open design, ensures that every Microsoft customer – and the broader community – can hold us accountable in real time for the software we run on their behalf. Key Benefits of Microsoft’s Signing Transparency (MST) Verified Code Integrity – Every software release is cryptographically logged in MST’s ledgers. This makes each build tamper-evident and traceable. If an attacker attempts to inject malicious code or sign an unauthorized update, it will be evident through the well-defined validation step built into the SCITT standard. Organizations gain the assurance that code integrity can be independently confirmed at any time. Independent Verification & Zero Trust – MST enables customers and auditors to verify software authenticity on their own, without having to solely rely on vendor attestations. For each update, Microsoft provides a transparency “receipt” (proof of logging) that you can use to prove the update was officially published and unaltered. This fosters a “don’t just trust, verify” approach, empowering security teams to double-check everything running in their environment aligns with what Microsoft intended. Audit-Trail & Compliance – The transparency ledger creates a permanent, auditable timeline of code deployments. Every entry is a record of what was released and when, backed by cryptographic proofs. This simplifies compliance reporting and accelerates forensic analysis. In the event of an incident, you can quickly audit the ledger to see if any unexpected code was introduced. For highly regulated industries, MST offers concrete evidence of software integrity and policy compliance over time. Leadership & Open Standards – We are delivering real transparency now, encouraging a future where all critical software is released with verifiable integrity. MST’s open source implementation and SCITT-compliant design exemplify our commitment to openness and collaboration. We believe widespread adoption of these standards will strengthen supply chain security for everyone, making trust verification a universal practice. Next Steps Microsoft’s Signing Transparency is more than a new security feature and shapes the advances in trust technology. As threats grow more sophisticated, we must evolve the way we assure our customers about the software they depend on. With MST now generally available, we are leading by example: proving that it is possible to open up the traditionally opaque process of software deployment and turn it into a source of strength and trust, i.e. empowering each person with verifiable transparency. We invite the industry to join us on this journey and get started by reading the documentation and exploring Ledger Explorer today! Together, by embracing transparency and open standards, we can turn “trust but verify” from a slogan into an everyday reality for digital infrastructure.The Startup Stage: Powered by Microsoft for Startups at European AI & Cloud Summit
🚀 The Startup Stage: Powered by Microsoft for Startups Take center stage in the AI and Cloud Startup Program, designed to showcase groundbreaking solutions and foster collaboration between ambitious startups and influential industry leaders. Whether you're looking to engage with potential investors, connect with clients, or share your boldest ideas, this is the platform to shine. Why Join the Startup Stage? Pitch to Top Investors: Present your ideas and products to key decision-makers in the tech world. Gain Visibility: Showcase your startup in a vibrant space dedicated to innovation, and prove that you are the next game-changer. Learn from the Best: Hear from visionary thought leaders and Microsoft AI experts about the latest trends and opportunities in AI and cloud. AI Competition: Propel Your Startup Stand out from the crowd by participating in the European AI & Cloud Startup Stage competition, exclusively designed for startups leveraging Microsoft AI and Azure Cloud services. Compete for prestigious awards, including: $25,000 in Microsoft Azure Credits. A mentoring session with Marco Casalaina, VP of Products at Azure AI. Fast-track access to exclusive resources through the Microsoft for Startups Program. Get ready to deliver a pitch in front of a live audience and an expert panel on 28 May 2025! How to Apply: Ensure your startup solution runs on Microsoft AI and Azure Cloud. Register as a conference and submit your Competiton application form before the deadline: 14 April 2025 at European Cloud and AI Summit. Be Part of Something Bigger This isn’t just an exhibition—it’s a thriving community where innovation meets opportunity. Don’t miss out! With tickets already 70% sold out, now’s the time to secure your spot. Join the European AI and Cloud Startup Area with a booth or launchpad, and accelerate your growth in the tech ecosystem. Visit the [European AI and Cloud Summit](https://ecs.events) website to learn more, purchase tickets, or apply for the AI competition. Download the sponsorship brochure for detailed insights into this once-in-a-lifetime event. Together, let’s shape the future of cloud technology. See you in Düsseldorf! 🎉New capabilities help simplify and streamline the experience with Microsoft Dev Box
It’s hard to believe that Microsoft Dev Box has already been generally available for almost four months. In this time, we have been blown away by the excitement from administrators and developers about a VDI service purpose-built for developer productivity. With all the real-world usage has also come feedback and suggestions, and we’ve been busy working on new features and capabilities to further improve the Dev Box experience—for devs, admins, and platform engineers alike. From new prebuilt images to streamlined setup, networking, and management features, we’re excited to share the latest Dev Box updates available today and in preview. Read on to learn more. Giving dev teams self-service customization with guardrails While we've put a lot of work into making the dev experience great with Dev Box, we’ve heard from IT and platform engineers that there’s still room to improve the admin experience. Dev Box cuts down on the time admins spend setting up physical workstations, but creating a variety of images to support different teams still takes too much time. Dev teams may know what tools they need for their projects, but they often lack the expertise to build images themselves. That means creating custom images requires an inefficient back-and-forth between dev leads and admins to align on project needs—which becomes even less sustainable when scaling across teams. To address these challenges, Dev Box now offers configuration-as-code customization in private preview. Config-as-code significantly reduces the burden on IT admins and platform engineers by giving developers more granular control of their Dev Box configurations—while still maintaining centralized governance. Enterprise admins can establish guardrails that specify what software and tools are approved for use, then delegate config-as-code file creation to dev teams. Dev Box automatically enforces guardrails defined by the admins while applying config-as-code files. To scale image creation even further, dev teams can store approved config-as-code files in their own source code repositories for ease of access and reuse. Platform engineers and admins can also use repos to store guardrails for customization—Dev Box already integrates with Azure DevOps repositories, and we’re actively working towards integrations with GitHub repositories as well. For other scenarios, such as private package manager support, admins can configure KeyVault with Dev Box to store secrets, and leverage KeyVault to pre-configure private assets during the Dev Box customization process. With config as code-based customization, dev teams can now tailor their dev boxes to the exact requirements of their project, while platform engineers can focus on enforcing governance and security at scale. Dev Box customization empowers dev teams to truly own their workstations, making onboarding even faster while unlocking advanced use cases like splitting different tasks across multiple, purpose-built Dev Box instances. Config-as-code customization give devs tons of freedom to personalize dev boxes—from choosing OS settings and installing additional tools to updating tools in the base VM image with additional extensions. By creating devbox.yaml files with their existing scripts and package managers, devs can even roll out settings across their Visual Studio or Visual Studio Code environments. Dev teams can use these customizations to combine tasks and get the right configuration for their unique needs. For example, some options include: Personalizing your environment with a custom theme and other Windows settings Setting up a Dev Drive for faster performance Installing additional software with WinGet and other package managers Adding the GitHub Copilot extension and others to Visual Studio 2022 Configuration-as-code is currently available in private preview. Sign up for the private preview today. Dev Box Compatible Docker Desktop images Even as config-as-code customization lessens the burden on admins, there are other ways we can help platform engineers and IT admins streamline image creation. One way of doing this is to provide prebuilt images that can be used to create general templates to suit a variety of projects. Already, we offer specialized Visual Studio images built for Dev Box. Now, we’re excited to expand our image offerings with new prebuilt images that include Docker Desktop. These images are the result of a new collaboration between Microsoft and Docker and make it that much easier to use Dev Box to build cloud native applications. The images come with everything you need to build containerized applications with Visual Studio and Docker Desktop. Start using Docker Desktop for Dev Box today. Streamlining Dev Box setup with simplified networking and the quick create template We want to continue to streamline the configuration and setup process to ensure the Dev Box experience is satisfying for devs and admins alike. With its advanced networking capabilities, Dev Box gives IT teams comprehensive control in their ability to secure Dev Box instances. But creating new Virtual Networks (VNets) from scratch requires specialized networking knowledge and can be time-consuming when teams are split across multiple geographies that each need their own separate VNet. Microsoft-hosted network is a new feature in Microsoft Dev Box that provides admins with the option to use a prebuilt Microsoft-hosted network, rather than having to build a new VNet from scratch. Microsoft-hosted networks enable admins to significantly streamline Dev Box deployment process when they don’t need advanced network settings and rely on Microsoft for routing network traffic. Microsoft-hosted networks give admins more options and flexibility when setting up dev boxes, helping streamline the process when needed. Using Microsoft-hosted networks can be especially useful for organizations that want to operate in a Zero Trust model, as it makes it easier to quickly set up multiple networks and keep workloads isolated on separate dev boxes with their own unique permissions. We’re also excited to announce new quick-create templates that provide new users and admins with a single step Dev Box deployment that creates everything you need to get started with Dev Box. This template supports a variety of common Dev Box use cases, making it easy for anyone to configure and deploy Dev Box. This is especially useful for new admins who are unfamiliar with the Dev Box configuration process and can even make it easier for dev leads to create their own project dev boxes. After running the deployment template, you’ll have everything you need up and running to visit devportal.microsoft.com and create your first dev box. Continued learnings from deploying Dev Box across Microsoft If you’ve been following our blogs, you know we at Microsoft are committed to going all-in with Dev Box. We’ve been using Dev Box at Microsoft since January 2022 when we piloted the service with our Office 365 organization. At Build, we had already increased our rollout to 10,000 developers, and today, we’ve ramped up further to 15,000 active developers. So far, we’re hearing great things about the transition to Dev Box. Through initial feedback, we’ve seen overall satisfaction numbers top 80%, with 65% of developers using Dev Box as their primary development environment. Over the past four months, we’ve been gathering data on our internal Dev Box usage. Initial results show that several development tasks are significantly faster on Dev Box than on physical machines. Across teams, build times are significantly faster: 43% faster CloudBuild repo build times 16% faster PowerBI repo build times 2% faster OneDrive SyncClient 13% faster AzureCompute-Move This data is encouraging, and we hope to see more like it as we continue to scale Dev Box internally at Microsoft. Get started with Microsoft Dev Box today We look forward to hearing how these new features will help devs, admins, and platform engineers enjoy even more simplified, streamlined experiences on Dev Box. For those interested, you try Dev Box today. To find out how to get started with Dev Box, check our docs pages. Finally, learn about Microsoft Dev Box through our recent Ignite session, or get access to our new features like configuration-as-code customization and the quick create template.Microsoft Dev Box – the superpower Financial Services development teams are quickly discovering
Developer productivity and developer experience are top of the mind issues for engineering and technology leaders – as the battle for talent intensifies and we brace ourselves for uncertain macroeconomic climate, while AI continues to present once-in-a-generation opportunities of market dominance and digital differentiation. We acknowledge that software engineering is a team sport. A great sports team delivers the best performance when all the team members play to their strength. Similarly, in software development, we need our engineers to focus on the tasks that only they can do / code, and only they can write. In Australia and New Zealand, specifically in the Financial Services industry (FSI), engineering leaders recognise this and continue to invest in developer experience and happiness, while also leaving no stone unturned to ensure productivity is a competitive differentiator. This need for speed does not dilute the need for FSI to conform to strict regulatory and prudential control, enforce zero-trust, granular security and embed enterprise control and governance throughout the SDLC phases – as it pertains to the creation of software and digital differentiation. To simplify the development experience further, Microsoft has combined the best of Azure and Microsoft 365 to create Microsoft Dev Box, an on-demand, self-service cloud development workstation that's ready-to-code. It is observed that developer velocity is accelerated when Dev Box is paired with best-in-class dev tools such as Visual Studio, VS Code, and GitHub Copilot.
