Category
Azure
19 posts filed under Azure.
The Auth Chapter Every MCP Tutorial Skips: Real SSO for Microsoft Graph
How a production MCP server signs into Microsoft 365 with real SSO: public client + PKCE, delegated permissions, On-Behalf-Of, and 85 Graph tools kept safe.
Groundedness Detection vs Groundedness Evaluation: Two Azure Products, One Name
Azure has two features named Groundedness — a runtime detection API that blocks ungrounded answers, and an offline evaluator that scores them in CI.
The Production Guardrail Stack: Presidio + Azure Content Safety + NeMo Guardrails Around a MAF Agent
How to compose PII redaction (Presidio), Azure AI Content Safety, and NeMo Guardrails as layered middleware around a Microsoft Agent Framework agent.
Defense-in-Depth for AI Agents on Azure: Prompt Shields, Spotlighting, and the Coverage Gap
What Azure's Prompt Shields and Spotlighting actually block against jailbreaks and prompt injection — and the gap: they don't fire on agent tool calls.
Cost Control for LLM Apps: Caching, Batching, Model Tiers
Cut your Azure OpenAI bill with model-tier routing, the four caches, output discipline, and batching. The levers that move the bill, in order of impact.
Observability for AI Agents on Azure: OpenTelemetry GenAI to the Agent Dashboard
Tracing AI agents on Azure Monitor with OpenTelemetry GenAI conventions — the invoke_agent → chat → execute_tool span tree and the KQL to reconstruct it.
Every Evaluator in the Azure AI Evaluation SDK, and When to Use Each
A reference to all 39 evaluators in Azure's AI Evaluation SDK — quality, RAG, agent, safety, and custom — organized by which you can actually import.
The OBO Chain Through MCP: Passing User Identity from an Agent to Microsoft Graph
How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how OBO and RBAC secure the chain.
The Learning Loop Is the Moat: An Architect's Read on Nadella's Reverse Information Paradox
Satya Nadella's Reverse Information Paradox says AI buyers leak their edge just by using the model. Control and Choice are architecture decisions.
Choosing the Right Agent Identity: Managed Identity, Entra Agent ID, OBO, or Service Principal
The first design decision for any Azure AI agent is which identity it uses — a decision matrix across managed identity, Entra Agent ID, and OBO.
The Keyless Cookbook: Managed Identity for Every Azure Service Your Agent Touches
The exact RBAC role, disable-local-auth switch, and DefaultAzureCredential snippet for every Azure hop an agent uses — OpenAI, AI Search, Cosmos, SQL.
Microsoft Foundry's Production-Agent Release: A Solution Architect's Read
Foundry made hosted agents GA and put agent identity first with Entra Agent ID — but governance tooling is still preview and there's no SLA yet.
