All news with #azure tag

🔐 Huntress reported a 155x increase in password spraying in H1 2026, driven by a campaign abusing Azure CLI and IPv6 BYOIP ranges from LSHIY LLC. The attacker leveraged reused credentials and the deprecated ROPC OAuth grant to bypass MFA protections that were not applied to this flow. Rampant login attempts led to dozens of compromises while attackers rotated providers and IP ranges to evade blocking. Huntress recommends disabling ROPC, enforcing broad MFA and conditional access, and limiting Azure CLI access to necessary admins.

🔷 Microsoft was named a Leader in the 2026 Gartner® Magic Quadrant™ for Cloud-Native Application Platforms, marking its third consecutive year in that quadrant. The post highlights how Azure’s platform consolidates application modernization, AI toolchains, operations, and security into a single foundation. It describes services like Azure App Service, Container Apps, Azure Functions, and API Management as core components enabling production AI workloads and agentic applications. Customer examples illustrate real-world production usage and operational impact.

🟦 Customer feedback and PeerSpot recognitions highlight five priorities for Microsoft Databases: reliability, scalability, operational simplicity, developer productivity, and AI readiness. Reviews from SQL Server, Azure SQL Database, Azure Cosmos DB, and Azure Database for PostgreSQL users emphasize uptime, ease of migration, performance, and integration with Azure services. These insights guide Microsoft’s investments to help customers modernize and build AI-powered applications while maintaining security and governance.

🔧 Microsoft attributed the large July 23 outage to a bug in its automated network maintenance request system that removed IP routes from more devices than intended, disrupting Azure and Microsoft 365 services, especially for customers routed through the West US region. The incident began at 10:44 AM ET and was resolved after a rollback completed at 2:26 PM ET, with full recovery of all services by 3:41 PM ET. Microsoft is conducting a full internal review and will publish a final post-incident report.

🚀 Microsoft describes a multi-agent AI system within the Secure Future Initiative (SFI) that continuously evaluates and hardens its cloud services. The system combines code, configuration, identity, network, and runtime evidence to find composite vulnerabilities and assess layered defenses. It generates assurance trees tailored to each service and produces high-quality, actionable findings that speed remediation. Microsoft reports the system compresses deep security reviews from weeks to hours and that over 90% of findings were validated by engineers.

🔧 Azure reframes resiliency beyond simple availability metrics to emphasize sustained operation, recoverability, and trust under real-world constraints. The platform combines zone-first design, data protection, and cyber recovery with observability and automation to help customers meet sovereignty and regulatory needs. New tooling like Azure Infrastructure Resiliency Manager and the Resiliency Agent shift guidance to executable, IaC-driven remediation.

🔐 Azure announces public preview of external key management for Managed HSM, enabling customers to keep key material on HSMs they own and operate outside Microsoft infrastructure. The feature connects Azure cryptographic operations to external HSMs via a dedicated API endpoint while keeping keys from ever residing in Azure. It targets scenarios with strict regulatory or contractual data-sovereignty requirements and shifts more operational responsibility to customers.

🧪 Azure Chaos Studio Workspaces is now in public preview, offering scenario-focused chaos engineering to validate application resilience. It provides curated outage scenarios (Zone Down, DNS Outage, SQL failover, etc.), a drag-and-drop Scenario Designer, and a managed Workspace that discovers resources and recommends applicable tests. Runs produce structured drill reports and integrations with GitHub Copilot and Model Context Protocol for automated workflows.

📣 Azure Files provides fully managed file storage tailored for modern Linux workloads, combining familiar file access with built-in performance, resilience, and security. The service supports AI inferencing, cloud-native Kubernetes deployments, and enterprise migrations by exposing standard NFS and SMB endpoints and integrating with Azure services. New features like zonal placement, provisioned v2, and faster provisioning improve scale, latency, and cost management for shared file scenarios.

🔍 Microsoft highlights tighter integration for PostgreSQL on Azure by embedding performance tools directly into Visual Studio Code. The PostgreSQL extension centralizes query authoring, server metrics, Azure‑specific telemetry, and Azure Advisor recommendations to shorten detection-to-resolution time. Enhanced query plan visualization and AI‑assisted analysis help teams troubleshoot and tune queries faster, while schema‑aware authoring and Entra ID integration support secure, consistent workflows at enterprise scale.

🧭 Agentic cloud operations use AI-powered agents to turn continuous observability into governed, auditable actions across the cloud lifecycle. Microsoft describes how Azure Copilot’s observability agent—now generally available—analyzes telemetry, traces dependencies, and surfaces grouped signals and contextual recommendations to speed incident resolution and reduce noise. Built-in governance and policy guardrails ensure actions respect controls and remain human-reviewed, while cost and usage intelligence integrate into developer tools to enable continuous optimization.

🔍 This post summarizes three business-focused takeaways from Microsoft Build 2026 for leaders evaluating AI adoption. It explains how Microsoft is shifting from standalone models to a shared enterprise intelligence layer—Microsoft IQ—that connects business data and processes across systems. The article highlights Azure’s agent platform and Foundry updates for production-grade deployment, governance, and performance, emphasizing that AI is expected to deliver measurable outcomes now.

🔐 Security researchers and agencies are warning that phishing campaigns are increasingly targeting Microsoft 365 OAuth device codes and access tokens to bypass multifactor authentication. New commercial services like Kali365 and older kits such as EvilTokens automate token capture, AI‑generated lures, and large-scale campaign management. The FBI and vendors urge admins to restrict device code flows, apply conditional access, monitor token misuse, and adopt identity‑centric controls beyond MFA.

🔧 This third post in the Azure IaaS series argues that cloud performance must be managed as a coordinated system across compute, storage, and networking rather than as isolated resource choices. It highlights platform features like Azure Boost, Ultra Disk, and Premium SSD v2 that offload processing, tune I/O, and decouple capacity from throughput. The article examines requirements for AI, cloud-native, and business-critical workloads and explains how Azure services such as AKS, Azure Container Storage, ExpressRoute, and advanced networking (eBPF/Cilium, Accelerated Networking) combine to deliver consistent, scalable, and recoverable performance.

🔒 Microsoft says it disrupted a malware-signing-as-a-service operation that abused its Azure Artifact Signing platform to generate fraudulent short-lived code-signing certificates used by ransomware gangs and other cybercriminals. The actor, tracked as Fox Tempest, created over 1,000 certificates and hundreds of Azure tenants and subscriptions. Microsoft seized the signspace[.]cloud domain, took virtual machines offline, revoked certificates, and filed a lawsuit in the Southern District of New York.

🔐 Microsoft reports that a threat actor tracked as Storm-2949 is abusing Self-Service Password Reset (SSPR) and social engineering to steal Microsoft Entra ID credentials and bypass MFA for privileged users. The attackers trick targets into approving authentication prompts, reset passwords, remove MFA, and enroll Microsoft Authenticator on attacker devices. Using Microsoft Graph and custom scripts they enumerate tenants, exfiltrate files from OneDrive and SharePoint, and pivot into Azure to harvest secrets from Key Vaults, storage accounts, and SQL databases. Microsoft recommends least privilege, conditional access, phishing-resistant MFA for admins, limiting RBAC, and extended Key Vault logging to mitigate these attacks.

🔐 Microsoft Threat Intelligence details how Storm-2949 converted targeted identity compromise into a broad cloud breach, exfiltrating data from Microsoft 365 and production workloads in Azure. The actor abused SSPR-based social engineering to bypass MFA, performed directory discovery via Graph API, and leveraged management-plane operations to retrieve Key Vault secrets and download large volumes of data. Organizations should adopt behavior-based detections such as Microsoft Defender and tighten RBAC and administrative controls to detect and mitigate similar identity-driven cloud attacks.

🔒 A security researcher alleges Microsoft quietly changed Azure Backup for AKS behavior after rejecting his March disclosure and blocking a CVE, arguing the issue required pre-existing administrative access. The reported flaw purportedly allowed a user with only the Backup Contributor role to gain cluster-admin privileges via Trusted Access. Microsoft maintains the behavior was expected and that no product changes were made, yet the researcher observed new permission checks and a shift to manual Trusted Access configuration after disclosure. CERT/CC validated the bug but the CVE process stalled, leaving defenders with limited visibility.

🔒 Azure IaaS combines a layered defense-in-depth architecture with Microsoft’s Secure Future Initiative—secure by design, secure by default, and secure in operation—to protect compute, networking, storage, and operations. Hardware roots of trust, measured boot, and host isolation reduce platform exposure while VM protections such as Trusted Launch and confidential computing guard workloads at runtime. Network defaults enforce least privilege and private connectivity, and centralized telemetry in Azure Monitor and Defender for Cloud enables continuous detection and response.

🔐 Microsoft is open-sourcing the firmware, drivers, and software stack for the Azure Integrated HSM, a tamper-resistant hardware security module built into new Azure servers and engineered to meet FIPS 140-3 Level 3. The move, announced at the OCP EMEA Summit, includes publishing validation artifacts and launching an OCP workgroup to guide ongoing development. Azure says the HSM protects keys in hardware so they never appear in host or guest memory, reducing classes of exfiltration attacks, and will be available in Azure V7 VMs globally in the coming weeks.