Deep Dive
push_pin
Pinned
Jul 8, 2026
The AI Gateway in Azure API Management: A Control Plane for Enterprise AI
One control plane for enterprise AI — how APIM's AI gateway gives security, network, and infrastructure teams governance over models, MCP tools, and agents. The full v2 surface.
Deep Dive
push_pin
Pinned
Jul 9, 2026
Zero-Secrets Architecture on Azure: Managed Identity for AI Agents
The governance case for keyless Azure: why shared keys are a liability, how managed identity plus RBAC fixes it, and how security, network, and platform teams enforce it.
Latest Updates
All updates →
The Learning Loop Is the Moat: An Architect's Read on Nadella's Reverse Information Paradox
Microsoft Foundry's Production-Agent Release: A Solution Architect's Read
Zed and DeltaDB: Version Control Between Commits
Magentic-UI + Fara-7B: A Local-First Computer-Use Agent You Can Actually Run
Microsoft Agent Framework Makes Tool and File Access Approval-by-Default
Dev Tunnels: Test Webhooks and Share Local Apps Without a Deploy
Microsoft Ignite 2025: Microsoft Foundry - The Unified Enterprise AI Platform
Build Custom MCP Catalogs with Docker: Enterprise Control for AI Tooling
Recent Journal Entries
Explore Full Journal →
Observability for AI Agents on Azure: OpenTelemetry GenAI to the Agent Dashboard
A deep dive on tracing AI agents on Azure Monitor with OpenTelemetry GenAI semantic conventions — the invoke_agent → chat → execute_tool span tree, the APIM AI-gateway token layer, MCP boundary tracing, and the KQL to reconstruct what an agent actually did.
The Agent Harness
The harness is the loop around a model that calls tools, manages context, gates actions, and decides when to stop. Its defaults are the product.
Every Evaluator in the Azure AI Evaluation SDK, and When to Use Each
A reference to all 39 evaluators in Azure's AI Evaluation SDK — quality, RAG, agent, safety, and custom — organized by which ones you can actually import, and which only exist in the cloud catalog.
The OBO Chain Through MCP: Passing User Identity from an Agent to Microsoft Graph
How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.
Choosing the Right Agent Identity: Managed Identity, Entra Agent ID, OBO, or Service Principal
The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.
The Keyless Cookbook: Managed Identity for Every Azure Service Your Agent Touches
The exact RBAC role, disable-local-auth switch, and DefaultAzureCredential snippet for every Azure hop an agent uses — OpenAI, AI Search, Cosmos, SQL, Blob, Key Vault, and more.
AI Security: Prompt Injection, Jailbreaks, and Guardrails
Prompt injection, indirect injection, jailbreaks, and data exfiltration via tools — the real threats and defense layers that work in production AI systems.
MAF v1 — Deployment with Docker and Compose
Package the agent stack with one multi-target Dockerfile, one Compose file, and a dev.sh script with health gates locally.
MAF v1 — Prompt engineering (Python + .NET)
Structure prompts around identity, grounding, task rules, role context, and YAML composition so agents stay consistent over time.