Browse All News (654)

Allison explains how the GitHub Copilot usage metrics API now separates local BYOK and enterprise custom model usage from Copilot-hosted models. The update adds user-level and aggregate reporting without changing existing totals, with important limitations around client telemetry, token counts, model names, and historical data.

Allison announces Dependabot version update support for Agent Package Manager, helping keep AI agent skills, prompts, and instructions current through pull requests. The update handles supported Git dependencies and existing lockfiles, is available across all GitHub plans, and covers version updates rather than security updates.

shilmenon describes expanded Microsoft Fabric mirrored catalog support for Azure Databricks materialized views and streaming tables. Fabric provides read-only access without copying data, while Databricks retains ownership of source processing. The update covers external-access prerequisites, catalog synchronization, SQL querying, and Power BI reporting through Direct Lake.

Richard Lander explains how NuGet packages can carry version-matched agent skills alongside library binaries. He demonstrates tools for discovering and copying those skills into repositories, compares package delivery with Git-based approaches, and discusses model evaluation, token costs, and the security implications of agents consuming package documentation.

tompeplow demonstrates how OneLake supports agent-driven data engineering through hosted MCP servers, endpoint discovery, and shortcuts. Using GitHub Copilot, the examples explore mirrored databases, document permissions, combine external data in a Lakehouse, and run SQL and Spark analytics while working within existing access permissions.

bytecascade explains how Reference Data Join in Microsoft Fabric Eventstream enriches live telemetry with context from OneLake Delta tables. A cold-chain example demonstrates visual and SQL joins, reference-data refresh intervals, and downstream routing, while outlining the trade-offs between enriching events in motion and joining them after ingestion.

Microsoft Security Research and Jiacen Xu examine a fake-download campaign that bundles proxyware, distributed-computing software, and unwanted utilities through trojanized installers. They explain its staging and callback patterns, scheduled-task persistence, and Microsoft Defender hunting queries, with guidance for correlating evidence across an entire installer session rather than individual payload attempts.

grakhra compares Microsoft Fabric integration options for Snowflake and Databricks, explaining when to use mirroring, OneLake shortcuts, shared Iceberg storage, or pipelines. The guide distinguishes replication from in-place access and outlines how Fabric data agents connect governed analytics data to custom experiences in Copilot Studio and AI Foundry.

Yun Jung Choi explains how six specialized Azure plugins extend AI-agent workflows for AKS troubleshooting, cost analysis, Advisor recommendations, graph queries, Azure Local, and Foundry IQ knowledge bases. The guide includes example prompts, installation commands for supported clients, and approval requirements for resource changes and disruptive operations.

Alex Perrault explores how Arnis turns OpenStreetMap data into Minecraft worlds and how its sole maintainer, Louis Erbkamm, uses GitHub Copilot to investigate bugs and review contributions. Copilot sub-agents help examine sensitive parts of the codebase and suggest corner cases for regression testing.

Allison describes a new GitHub REST API endpoint that looks up a resource’s cost center without listing and scanning every cost center. The endpoint accepts a resource type and name, returns the cost center’s ID and name, and limits access according to enterprise billing permissions.

Allison announces GitHub Copilot support in JetBrains Air, enabling local and cloud coding tasks through the Agent Client Protocol. The update supports parallel sessions and in-context review using existing Copilot subscriptions, with isolated cloud execution and limitations around plan selection, usage visibility, and administrative spending controls.

Allison outlines CodeQL 2.27.3 updates for GitHub code scanning, including Python 3.15 support, JSON data extensions, and improved analysis across languages. The release also adds an opt-in threat model for LLM-generated data and introduces GitHub Actions control flow changes that may require updates to custom queries.

Allison announces that Dependabot now supports Python 3.15, allowing projects to upgrade while continuing to receive dependency updates. Support is available to all github.com users and will also be included in GitHub Enterprise Server 3.24.

Allison explains how GitHub Desktop 3.6.10 and later use short-lived, automatically refreshing authentication tokens for eligible accounts. The gradual rollout reduces leaked-token exposure without manual renewal for Git operations or API requests. Existing sessions remain signed in, but existing tokens are not automatically migrated, and GitHub Enterprise Server is excluded.

sbaynes shares how Microsoft's Copilot Cowork team used coding agents, written specifications, automated reviews, and human checkpoints to build and migrate a live service. The article explains practical controls for parallel development, security boundaries, trustworthy tests, and a Python-to-Rust migration, including measured gains and remaining limitations.

Microsoft Security Research, Yair Tsarfaty and Or Begam analyze which vulnerabilities attackers actually exploit and why system-takeover flaws deserve priority. Their findings connect exploitation patterns and patching delays with practical use of Microsoft Defender exposure scores and attack path analysis to reduce risk beyond patching alone.

MichalBar explains how Copilot in Microsoft Fabric generates editable Real-Time Dashboards from natural-language descriptions and Eventhouse data. The preview workflow lets users refine a dashboard plan before creation, then inspect queries and customize visuals. A stadium example connects transit arrivals with gate activity and queue lengths.

Allison explains how GitHub’s code security and secret risk assessments now distinguish findings in protected and unprotected repositories. The update helps organization admins and security managers identify gaps in security coverage, with availability in GitHub Enterprise Cloud and GitHub Team and planned secret assessment support in Enterprise Server 3.24.

Allison outlines GitHub Actions’ upcoming default block on pull_request_target events in public repositories, with enforcement moved to December 2, 2026. Two November brownouts will help maintainers identify affected workflows. The update explains how to review blocked runs and explicitly permit workflows while accounting for risks to repository secrets.

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

Kristen Womack reviews October’s Azure Developer CLI releases, covering deployment previews, Container Apps express support, environment value removal, and extension-aware pipelines. The recap also explains stable extension APIs, breaking Go API changes, reliability fixes, and new templates for deploying semantic search and streaming AI applications to Azure.

Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori examine two intrusions that escalated from help desk impersonation to AD CS certificate abuse. Their analysis explains ESC1 and ESC8 attack paths, contrasting containment outcomes, and practical Microsoft Defender hunting queries and hardening measures for certificate-backed identity compromise.

Waldek Mastykarz examines whether naming a workspace folder ‘eval’ changes GitHub Copilot CLI behavior. Across about 900 runs with four models, the name increased agents’ suspicion that they were being tested without producing statistically significant behavioral differences. The analysis explains the experiment’s controls, limitations, and practical guidance for evaluation harnesses.

spurthikommajos explains how Microsoft Fabric Eventstream’s preview support for workspace-level private connectivity lets custom applications publish events without public internet access. The article covers Azure private endpoints, workspace-scoped network restrictions, setup prerequisites, and supported analytics destinations, including important capacity requirements and ingestion limitations.

yaelbiss explains how Microsoft Fabric’s preview Allow workspace settings editing policy restricts sensitive encryption and networking changes without removing workspace administrator responsibilities. The article covers security-group-based rules, development and production boundaries, audit logging, and allow-list behavior that administrators should test before activating policies across a tenant.

spurthikommajos introduces preview support for variable libraries in Microsoft Fabric Eventstream. Connection and item references let teams reuse eventstream definitions across development, staging, and production, while each workspace supplies its own resource values. The article explains configuration steps, deployment prerequisites, and how references remain intact through Git integration and deployment pipelines.

amitch and Shehab Amin explain how Sail connects Spark-compatible workloads to Microsoft OneLake without copying data. They demonstrate lakehouse transformations, Python-based embedding generation, and scoped access through LakeSail Cloud Sessions, while outlining compatibility checks and limitations of the reported performance and cost comparisons.

Allison details three additional IP ranges for GitHub webhook deliveries, now included in the Meta API. Teams using static network allowlists need to add the prefixes to avoid rejecting deliveries. Allowlists kept current through the Meta API require no changes, and the additions apply across all github.com plans.

amitch and coauthor Iddo Avneri explain how Microsoft OneLake shortcuts expose lakeFS-managed data in Microsoft Fabric without copying datasets. Branch-following shortcuts provide current data, while commit-pinned shortcuts preserve reproducible snapshots. The article covers connection configuration, Delta table queries, validation results, and the tested configuration’s read-only limitation.

Salim Chawro introduces Hardware Audit Logging for Azure Cloud HSM, which records supported management operations directly from the hardware. Signed audit data and certificates enable independent verification, while Azure Monitor Log Analytics delivery supports investigations and monitoring. The feature is rolling out across public regions and is automatically enabled on new resources where available.

Microsoft Threat Intelligence examines how North Korean threat actors use AI to accelerate reconnaissance, identity deception, malware development, and operational scaling. The report distinguishes observed activity from suspected AI use, explains why operations remain human-directed, and provides Microsoft Defender detections and practical guidance for protecting identities, endpoints, and software repositories.

nareshvenkat introduces Project Osmos, a data engineering agent for Microsoft Fabric that investigates datasets, executes PySpark, and validates results. Persistent, shared tasks retain project context while teams define operating boundaries, review evidence, and guide changes. Tasks can be initiated through GitHub Copilot CLI, Claude Code, or Codex.

Daniel Roth outlines Microsoft’s collaboration with Syncfusion on Blazor, including a free, MIT-licensed component toolkit and merged framework and scaffolding fixes. He also covers testing contributions for .NET 11 and proposed setup tooling and AI assistant skills, distinguishing available improvements from contributions still under review.

LeeBenjamin introduces the generally available Govern experience in Microsoft Fabric’s OneLake catalog and the new Govern Skills collection. Together, they provide centralized estate insights, policy controls, and AI-assisted governance checks, with evidence-based recommendations and confirmation before sensitive changes through tools such as GitHub Copilot.

The Visual Studio Code Team outlines changes in VS Code 1.145 Insiders, including improved worktree cleanup, experimental previews of web apps on remote agent hosts, and new agent-session controls. The updates also address keyboard accessibility for MCP authentication prompts and add symbol breadcrumbs for unsaved files.

Satya Nadella outlines GitHub updates announced at Universe, including Copilot Fusion performance and cost claims, a unified Copilot harness in Foundry, and Copilot Projects for coordinating multiple agents across repositories. The post also notes plans to expand GitHub capacity and strengthen its architecture.

SMATIN explains preview improvements to scalar user-defined functions in Microsoft Fabric Data Warehouse, including broader loop control and query support. Existing functions gain supported capabilities automatically, while new inlineability checks provide diagnostics and an explicit override for functions intentionally used without inlining.

Lynn Dai introduces Trusted Publishing for Visual Studio Marketplace, enabling extension releases from GitHub Actions and Azure Pipelines without long-lived personal access tokens. The article explains federated identity setup, GitHub policy activation, Azure Pipelines service connections, and how to migrate existing publishing workflows while verifying access before removing stored secrets.

Jeff Hollan, Viswajeeet Balaji, and Anthony Chu introduce the Microsoft Copilot harness public preview in Foundry Agent Service and generally available resilience for hosted agents. They demonstrate reusable skills and declarative deployment, explain recovery responsibilities and preview limitations, and outline consumption-based runtime billing beginning December 1, 2026.