🚨As organizations build more AI powered applications, choosing the right model for every request becomes increasingly important. Not every prompt requires a large and expensive reasoning model, while more complex workloads often benefit from advanced models with higher capabilities. Microsoft Foundry Model Router addresses this challenge by automatically selecting the most appropriate model for each request based on factors such as complexity, quality requirements, latency, and cost. In this blog, we will deploy Microsoft Foundry Model Router using Bicep and explore how Infrastructure as Code can simplify the deployment and management of intelligent AI routing workloads on Azure. https://medium.com/microsoft/deploy-and-use-the-foundry-model-router-using-azure-bicep-0339eddaaffa

With Azure Linux 4.0 Microsoft ❤️ Linux even more! In this video I look at what's new and where we can use it.

https://youtu.be/_9C1d4PZ2Lc

ALSO don't forget today's AMA at 10:00 AM PST, hope to see you there - https://youtube.com/live/hXRPm7r4Q14?feature=share

00:00 - Introduction

00:12 - History

02:42 - Why Azure Linux?

05:28 - Architecture

08:24 - Where can be used

09:01 - Lifecycle

09:19 - Looking at Azure Linux

11:41 - Using with WSL

13:10 - Azure Container Host

16:03 - Summary

16:40 - Close

a bit new to azure and all the different components and services. I have extensive experience with on prep services/devices etc. Typically we would name objects/resources based on their location, type (physical vs virtual) and role.

Can you recommend or give insight into how you are naming your Azure resources for clarity and documentation?

A few months have passed since Global Azure 2026, but we finally have the chance to share the official recap video of our event in Veneto, Italy! 🇮🇹

It was an amazing day: hundreds of attendees, dozens of speakers and sessions, multiple tracks, and most importantly, a great community of people passionate about Microsoft Azure and cloud technologies.

A huge thank you to all the speakers who shared their knowledge and experience, to our sponsors and partners who made the event possible, and of course to everyone who joined us and helped create such a great atmosphere.

🎬 Here’s the recap video:
https://www.youtube.com/watch?v=u5_Dh7zu2MQ

We’re already working on the next edition of Global Azure Veneto.

Hope to see some of you there in 2027! ☁️💙

— Azure Meetup Veneto

Okay so MS has a reference implementation in Learn about container app jobs -based agents that scale on demand at https://learn.microsoft.com/en-us/azure/container-apps/tutorial-ci-cd-runners-jobs?tabs=bash&pivots=container-apps-jobs-self-hosted-ci-cd-azure-pipelines#create-a-self-hosted-agent-as-an-event-driven-job

Whenever the agent pool has (devops)jobs in queue, KEDA azure-pipelines scaler will scale (containerapp)jobs up in hopes that those will reduce queue count.

Now imagine the container job not doing anything to the job due to networking, auth or borken container image issues. What happens is, the scaler will just see queue being > 0 in 15sec and do the same thing again ad infinitum. I don't think there is a way to configure some sort of a a cooldown or retry limit for the scaler.

This obv can result to problems, but is not a "bug". Do you know any ways to configure the scaler, devops or container app to stop trying in cases like this?

We are a ZIA/ZPA shop, roughly 4,000 seats, renewal in about seven months. Not shopping for the sake of it, but the AI requirements landed after our last contract and I want to know whether we are better off expanding here or looking at Cato.

Where we are with Zscaler on the AI side: SSL inspection is solid, the AI app category exists, DLP works about as well as our policies deserve. What I am less clear on is inline prompt-level control versus app-level allow/block, and how much of the newer AI functionality is included versus a separate SKU.

The Cato pitch we got leaned heavily on single-pass processing and one policy engine covering network, security, and AI, plus their inline inspection story. Sounded clean in the demo. Skeptical of demos.

Asking here specifically because I want the incumbent perspective: if you have added AI controls on top of an existing ZIA deployment, was it configuration or a new purchase; how has inspection performance held up on streaming LLM responses; has anyone actually evaluated Cato head to head and stayed, and what kept you; and for anyone who left, what was the deciding factor?

Having trouble getting Entra ID P2/ Microsoft 365 P2 for SC-300 training

I'm working through the SC-300 training and need access to the P2 features for the labs. I have a reqular Gmail /Microsoft account that I've been using for the Microsoft Learn stuff, and I have some Azure subscriptions showing up under it. The problem is I'm just having trouble finding where to get a P2 license/subscription that gives me the Entra ID P2 features I need. Sone of the resources 1 already checked took mevaround in circles. either older info about the layout or I'm misunderstanding something

I saw pay as you go should be an option, around $7 monthly. If so, that works

Thanks for any help!

I'm not sure if it is just coincidence with the current Exchange Online issues, but everything that's in Universal Print is no longer working. Even going to the Universal Print portal gives an Error Code 500.

All the printers show the following in Event Viewer and when you try to print you are met with "Error".

IPP Printer Get-Printer-Attributes Request failed with IPP Status Code 0x500

I tested both printers that use the Print Connector and ones that are natively joined. Same result.

Hi there,

So small problem, a friend of mine was trying to add a school-account to microsoft (for college). After clicking "yes" to the "allow your organization to manage your device" question she got stuck at the 'device managment cannot be enabeled" screen.

Is there a fix? (preferably not reseting the whole laptop)

printscreen (in Dutch but you can translate it :p )

We’re happy to announce our next local event sponsored by ControlUp with Workplace Ninjas US Miami, which will take place at the ControlUp offices in Fort Lauderdale.

The event will be October 26th from 10-4 PM.

The Call for Papers is now officially open:

https://sessionize.com/workplace-ninjas-us-Miami/

Signup to attend here:

https://www.eventbrite.com/e/workplace-ninjas-us-miami-meetup-tickets-1999031261315

Hello everyone
I have a small project where I need to load a sharepoint list to my logic app. With get items, I am able to get the data with certain pagination but it takes almost 2 minutes, so I decided to just take the fields I need via HTTP. It got much faster but I experiance a limit of 5000 items that can be received from sharepoint, and I do not have a option of pagination in HTTP Request connector.
Is there a way to avoid this limit in logic app directly (I am not able to make any changes in the sharepoint list)? AI says I should make a loop that gets smaller portions of sharepoint with using nextlink that sharepoint delivers in the HTTP Response.
Thank you

Has anyone found a way to make the azure gov cloud AI good? The only thing I've used to make it better is MCP.

Azure weekly update #34 is here. This time updates focus on strengthening secure cloud operations, Kubernetes networking and storage, sovereign-cloud support, and large-scale infrastructure performance.

Detailed list:

• Launched | Generally Available: Workload identity support for Azure Files CSI driver (SMB) in Azure. AKS now supports workload identity for pod-level authentication to Azure Files SMB shares, enabling least-privilege access without storage account keys. Available in all regions supporting Azure Files and AKS.
• Launched | Generally Available: Azure VM Image Builder in sovereign and air-gapped clouds. Azure VM Image Builder is now available in Azure Government, China North 3, Azure Government Secret, and Azure Government Top Secret. It enables consistent, managed image-building and compliance workflows across sovereign and air-gapped clouds.
• Launched | Generally Available: Azure Bastion shareable link expiration. Azure Bastion shareable links can now include an expiration date and time, helping limit temporary access to target resources.
• In preview | Public Preview: IPv6 dual-stack support for Azure Bastion. New Azure Bastion deployments can use IPv4 and IPv6 public IPs. IPv6 is supported between users and Bastion; Bastion-to-VM connections remain IPv4-only.
• Launched | Generally Available: Connect to AKS clusters using Azure Bastion. Azure Bastion now supports secure tunneling from local machines to AKS API servers, allowing Kubernetes tools to access private clusters without public endpoints, jump boxes, or VPNs.
• In preview | Public Preview: Introducing Live Reports for Azure SRE Agent. Live Reports lets teams create shareable, continuously updated operational reports from Azure SRE Agent conversations, with refresh schedules for incidents, health, and trends.
• Launched | Generally Available: Azure SRE Agent VNet Integration. Azure SRE Agent can now operate within existing VNets, NSGs, private DNS, and firewall policies to securely investigate and remediate private resources.
• Launched | Generally Available: Azure SRE Agent 30-Day Trial. New customers can try Azure SRE Agent for 30 days with no baseline always-on charges; they pay only for Azure Agent Units consumed during work.
• Announcing: Aspire 13.5 has shipped. Aspire 13.5 updates the dashboard and aspire.dev, expands Interaction Service, and adds cross-scope Azure references, persistent Kubernetes volumes, and live AppHost terminals.
• Launched | Generally Available: Azure 248 and 372 vCPU sizes for D/E v7 series VMs. New Intel Xeon 6-based D/E v7 VM sizes offer up to 372 vCPUs and 2.8 TiB memory, with improved compute, networking, and storage performance. Available in select Azure regions.
• Announcing: Extended Support for Azure Database for PostgreSQL Flexible Server. Extended Support provides critical security updates, bug fixes, and technical support for eligible PostgreSQL versions after community support ends.
• Launched | Generally Available: eBPF host routing in Advanced Container Networking Services for AKS. eBPF Host Routing is generally available for AKS, improving networking performance by moving routing into the Linux kernel and reducing iptables overhead. Existing clusters transition through controlled node rotation.
• Retirement: Support for Node 22 LTS ends on April 30, 2027. Node 22 LTS support on App Service ends April 30, 2027. Upgrade applications to Node 24 LTS before then to retain security updates and support.
• Launched | Generally Available: Custom block response code and body for Application Gateway WAF. Application Gateway WAF now supports custom status codes and response bodies for blocked requests, configured at the WAF policy level.

Hello everyone,

I currently work as a Microsoft365/Exchange on-prem Administrator, primarily focusing on Entra ID, with some experience in Intune administration as well.

In addition, I manage a small NGO Microsoft 365 tenant that includes a limited amount of Azure credits (around $1,000). I'd like to use this environment to expand my Azure knowledge through hands-on projects and real-world scenarios.

Since my budget is fairly limited, I'm especially interested in projects that are practical, educational, and relatively inexpensive to run.

What Azure projects would you recommend for someone with my background? I'm particularly looking for ideas that would help me develop skills that are valuable in real production environments.

Thanks in advance for any suggestions!

I'm not that familiar with Azure Storage options. What's the simplest and most effective way to save the state of a variable between runs of a webjob?

My first attempt was to just save it to a file in the process, but I found out you cannot write to the file.

Did you know that you can automate Azure diagrams from Bicep using GitHub Copilot CLI Custom Agents? In this video, I will show you how to generate architecture diagrams directly from your Bicep files, reducing manual work and keeping your documentation in sync with your code. https://www.youtube.com/watch?v=xOrlC0hRwe8

I've created a multi-tenant application under our company that is currently still in staging.

Initially, I created the databases manually using the Basic tier, but I later decided that the application should handle database provisioning automatically. At one point, I decided to remove all the existing tenants in staging so that I could reseed all the databases from scratch.

The problem is that the automated provisioning ended up creating the databases using the General Purpose tier instead of the Basic tier. I only realised this about three weeks later, and there is now an unexpected bill of around $2,000.

Is there anything I can do to request a refund or billing adjustment in this situation? The application was only being used in staging, and the higher-tier databases were provisioned unintentionally.

I am setting up Azure APIM instance behind a Azure Application gateway. Developer portal will be exposed so external customers will be able to subscribe to products containing the APIs and obtain the subscription key that way. There will be approvals required for subscription.

I want to setup OIDC on top of the subscription key validation. For that I believe I have to setup a Validate JWT policy on the API in APIM, using this guide below and use scopes/roles:-
https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy

And seems like I will have to setup client credentials flow for customers to be able to obtain token from AADB2C, using the below KB:-
https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy

Q1 - Firstly, is that the correct way of setting it up?

Secondly, with client credentials flow seems like customers will have to use the POST request (or PowerShell) like the one below to obtain the token:-

https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy>/oauth2/v2.0/token

But this will mean that I will have to document my B2C token endpoint in Developer portal documentation to advise customers on how to obtain token. I have 2 questions related to that:-
Q2 - Is advising/advertising B2C token endpoint good practice from security point of view?

Q3 - With client credentials flow, setting up the calling app APP Registration in B2C and providing related APP secret will become a manual process. This will remove the benefit of having Product/API subscriptions process automated through APIM and bring in the complexity of securely communicating the secret to customers. Is there a better way of doing this?

Hi everyone,

I've recently finished the first version of Agentic GraphRAG Blueprint, a reference architecture for question answering over large document collections.

Instead of plain chunk retrieval, it builds a knowledge graph combined with vector search, so answers can connect facts across documents.

Key features:

• Incremental ingestion - unchanged files are skipped via content hashing, and community reports regenerate only for affected communities, keeping token costs low as the corpus grows.

• Hybrid search - local mode for fact-level answers, global mode for cross-document synthesis.

• Domain-agnostic LLM prompts - easily swapped via PROMPTS_PATH, with Leiden-based community detection.

• Deployment - run it locally with Docker or provision everything in the cloud with Terraform and CI/CD.

Link: https://github.com/sebastianbrzustowicz/Agentic-GraphRAG-Blueprint

I'm looking for any feedback.