Deep Dive
push_pin
Pinned
Jul 8, 2026
The AI Gateway in Azure API Management: A Control Plane for Enterprise AI
One control plane for enterprise AI — how APIM's AI gateway gives security, network, and infrastructure teams governance over models, MCP tools, and agents. The full v2 surface.
Deep Dive
push_pin
Pinned
Jul 9, 2026
Zero-Secrets Architecture on Azure: Managed Identity for AI Agents
The governance case for keyless Azure: why shared keys are a liability, how managed identity plus RBAC fixes it, and how security, network, and platform teams enforce it.
Latest Updates
All updates →
The Learning Loop Is the Moat: An Architect's Read on Nadella's Reverse Information Paradox
Microsoft Foundry's Production-Agent Release: A Solution Architect's Read
Zed and DeltaDB: Version Control Between Commits
Magentic-UI + Fara-7B: A Local-First Computer-Use Agent You Can Actually Run
Microsoft Agent Framework Makes Tool and File Access Approval-by-Default
Dev Tunnels: Test Webhooks and Share Local Apps Without a Deploy
Microsoft Ignite 2025: Microsoft Foundry - The Unified Enterprise AI Platform
Build Custom MCP Catalogs with Docker: Enterprise Control for AI Tooling
Recent Journal Entries
Explore Full Journal →
Every Evaluator in the Azure AI Evaluation SDK, and When to Use Each
A reference to all 39 evaluators in Azure's AI Evaluation SDK — quality, RAG, agent, safety, and custom — organized by which ones you can actually import, and which only exist in the cloud catalog.
The OBO Chain Through MCP: Passing User Identity from an Agent to Microsoft Graph
How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.
Choosing the Right Agent Identity: Managed Identity, Entra Agent ID, OBO, or Service Principal
The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.
The Keyless Cookbook: Managed Identity for Every Azure Service Your Agent Touches
The exact RBAC role, disable-local-auth switch, and DefaultAzureCredential snippet for every Azure hop an agent uses — OpenAI, AI Search, Cosmos, SQL, Blob, Key Vault, and more.
AI Security: Prompt Injection, Jailbreaks, and Guardrails
Prompt injection, indirect injection, jailbreaks, and data exfiltration via tools — the real threats and defense layers that work in production AI systems.
MAF v1 — Deployment with Docker and Compose
Package the agent stack with one multi-target Dockerfile, one Compose file, and a dev.sh script with health gates locally.
MAF v1 — Prompt engineering (Python + .NET)
Structure prompts around identity, grounding, task rules, role context, and YAML composition so agents stay consistent over time.
MAF v1 — E-commerce repo guided tour (Python + .NET)
Every MAF concept from the prior chapters, mapped to the exact file and line where it lives in the live e-commerce repo.
MAF v1 — Evaluation framework (Python + .NET)
Build an eval pipeline with golden datasets, scoring, smoke/full modes, and CI gates to catch prompt regressions before release.