Azure

The first design decision for any Azure AI agent is which identity it uses. A decision matrix across managed identity, Entra Agent ID, on-behalf-of, and service principals.

The exact RBAC role, disable-local-auth switch, and DefaultAzureCredential snippet for every Azure hop an agent uses — OpenAI, AI Search, Cosmos, SQL, Blob, Key Vault, and more.

Microsoft’s Build 2026 announcement, Frontier models and production agents advancing Microsoft Foundry for the agentic era, reframes Foundry from a model catalog into a place you run production agents. The headline that makes it real: hosted agents in Foundry Agent Service are now generally available, and the catalog spans both OpenAI and Anthropic frontier models (1,900+ on Microsoft Learn, not the “11,000” some coverage repeats).

The governance case for keyless Azure: why shared keys are a liability, how managed identity plus RBAC fixes it, and how security, network, and platform teams enforce it.

If you read the Cloudflare Tunnel post, you know the problem: localhost does not accept webhooks, OAuth providers reject http://localhost as a redirect URI, and showing a client a work-in-progress means a deploy. Cloudflare Tunnel solves it, but it wants a Cloudflare account and domain setup.

Every Microsoft integration I have shipped starts at the same gate. Call the Graph API, wire up SharePoint, add “Sign in with Microsoft” to an app, and none of it works until you have an App Registration. Get it wrong and nothing downstream authenticates, which is why this is the one setup step I slow down for instead of clicking through.

.NET Architecture at Scale: Visual Guide to Modern Design Patterns # I keep a page like this open in a browser tab. When a team asks which pattern fits a new service, I would rather point at a decision tree and a comparison table than argue it from memory for the third time that month. So I wrote the reference I wanted: the 16 patterns I actually reach for in .NET systems, each with its diagram, a code sketch, and the trade-off it forces on you.

The short version # Four ways to get a file into Azure Blob Storage from a .NET and Angular app, and when each one earns its keep: