Microsoft
Developer Blogs
Get the latest information, insights, and news from Microsoft.
Highlights
Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime
Azure DevOps Remote MCP Server is generally available
Pull request annotations on work item cards
Latest posts
What’s New in vcpkg (Jul 2026)
These updates include major SBOM improvements in vcpkg-tool, 302 updated ports including multiple major library upgrades, and other minor improvements and bug fixes.
Azure Developer CLI extension framework is GA: build dev workflows for apps using Azure
What parts of building and shipping on Azure still take too many steps? Maybe you want a command that starts a project with your organization’s approved architecture and infrastructure. Maybe you need to connect deployments to an internal service catalog, run security checks before provisioning, or guide developers through a process that currently lives across scripts and documentation. When we first introduced the azd extension framework, we invited developers to think about that wish list. The framework was still taking shape in beta, and we wanted to learn which workflows developers and platform teams ne...
August Patches for Azure DevOps Server
We are releasing new patches for our self‑hosted product, Azure DevOps Server. We strongly recommend that all customers stay up to date with the latest, most secure version of Azure DevOps Server. The most recent release, Azure DevOps Server, is available on the download page. The following versions have been patched. For more details on these updates, see the release notes: ⬇️Azure DevOps Server Patch Download ✅Verifying Installation To verify that the patch is installed, run the following command on the Azure DevOps Server machine using the patch installer you downloaded: Replace with the name of the...
.NET 11 Preview 7 is now available!
Find out about the new features in .NET 11 Preview 7 across libraries, runtime, SDK, C#, ASP.NET Core, .NET MAUI, Entity Framework Core, F#, and Windows Forms.
.NET and .NET Framework August 2026 servicing releases updates
A recap of the latest servicing updates for .NET and .NET Framework for August 2026.
Today I will… manage Git Submodules without leaving the IDE
If you've worked with Git submodules for any length of time, you probably have a love-hate relationship with them. They're genuinely useful for pulling a shared library, an SDK, or common build scripts into your project. But actually working with them usually means tabbing over to a terminal and trying to remember whether it's this time all while a perfectly good IDE sits right in front of you, shrugging. That's the part we wanted to fix. Starting in Visual Studio 18.9, Git submodules are a first-class part of the IDE no more bouncing out to the command line just to keep your dependencies in order. It's been one...
Remove and Package Lifetime
MSIX uses a Garbage Collection (GC) design for staged package lifetime and destaging. Throughout this article: Package Core Principles A staged package can't be destaged while any references to it exist. This is a direct consequence of MSIX's core architectural principles: Consequently, removing a package's payload from disk is not a direct result of a single API call. Instead, package payloads are automatically destaged when they are no longer needed. Even then, destaging may not occur immediately. Some actions that remove a reference don't directly trigger Deployment activity. In these cases,...
The little-known winstart.bat batch file
It had been there long before Windows 95, but nobody remembered.
Build Locally, Ship to Cloud for $0: Azure SQL for Modern App Developers
As app developers, our primary focus is building great user experiences, designing APIs, and shipping features quickly. What we don't want is database friction—wasting hours configuring local DB instances, writing verbose migration scripts by hand, or worrying about unexpected cloud bills while prototyping. Today, we are making database development fast, intelligent, and completely free. By combining the Azure SQL Developer Container for local offline development, AI Agent Skills to automate your ORM and data layer, and the Azure SQL Database Free Tier, you can build locally and ship to production in minutes f...
Intelligent Terminal 0.2 is here with local model support
We're back, and this is our first minor version bump: 0.1 to 0.2! It's our biggest release yet. This update adds support for local models, lets you run a different agent in each tab with , brings OpenCode into the built-in agent lineup, runs your agent inside WSL where your work actually lives, and makes the Agent Pane richer to navigate and easier to read. It also sharpens Autofix and fixes a long list of reliability issues. You can grab the update from the Microsoft Store, via , or by heading to the release page on GitHub. Let's dive in! Local model support is here! We've heard you: one of the most common ...
How can I perform a CopyFile in unbuffered mode?
Try one of the fancier alternatives to <CODE>CopyFile</CODE>.
I Enabled RBAC and Everything Broke. What Did I Do Wrong?
We covered the roles your Azure Cosmos DB app needs in our previous post. Now let’s look at what happens after you’ve assigned those roles, switched identities, disabled keys and suddenly staring at a . As we continue this security series, we’ll walk through the most common causes, how to diagnose them, and how to get back to green quickly. The situation You did everything right. You gave your app a managed identity, assigned a data role, switched your code over to , and turned off key-based auth like all the good security guidance told you to. Then you deploy, and every single call comes back with this: Res...
Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 5
Cheating with <CODE>std::unique_ptr</CODE>.
Test reporting in Microsoft.Testing.Platform: from red build to root cause
Microsoft.Testing.Platform brings failures into GitHub Actions and Azure DevOps, uses pipeline history to separate regressions from flakes, and preserves usable reports when a test host crashes.
Announcing the preview of the Work IQ Developer Tools
Software is shifting from apps built for people to agents that can reason over context and act on someone's behalf. Microsoft 365 Copilot put that shift in front of hundreds of millions of users, and Work IQ gave agents a production-ready intelligence layer to build on. What's been missing is the path in between: getting from an idea to a production agent running in front of customers. Today we're announcing the developer preview of Work IQ Developer Tools (WIQD), the agentic experience for Microsoft 365 Copilot extensibility that takes any plugin (skills, connectors, declarative agents) from an empty folder t...
Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 4
Moving things around if possible.
Pull request annotations on work item cards
It's now easier to track development progress without leaving your Kanban board. Azure Boards now displays pull request annotations directly on work item cards, making it easy to see at a glance when work is actively moving through code review. With pull request status visible directly on the board, your team can quickly understand the state of development without opening a work item or switching to Azure Repos. Whether you're in a stand-up, planning your next sprint, or simply reviewing the board, you can immediately identify which work items have active pull requests. If you prefer a cleaner board, you can ...
You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token
We're excited to announce the Azure DevOps service connection, a new way to access Azure DevOps from your pipelines using a Microsoft Entra workload identity (a service principal or managed identity) instead of a Personal Access Token (PAT) or session token. This post walks through what it is, how to set it up, and the many places you can use it, including several capabilities we've added based on your feedback. Why use an Azure DevOps service connection? Using an Azure DevOps service connection improves the security of your pipelines in several ways: Because the connection authenticates as a Microsoft ...
Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 3
Forcing an object into the global interface table.
Azure DevOps Remote MCP Server is generally available
Today, we're excited to announce the general availability of the Azure DevOps MCP Server 🎉 The Azure DevOps MCP Server gives AI assistants secure, contextual access to your Azure DevOps projects so they can help you plan, build, and ship software more effectively. With the Azure DevOps remote MCP Server, you can get started without installing or hosting anything yourself. Simply connect your AI assistant directly to the Azure DevOps hosted endpoint by using streamable HTTP transport and start working with your projects in minutes. Getting Started Getting started in simple. Depending on the tools that you are u...
Beyond Chat: live Speech-to-Text with Foundry Local and C#
Build a live speech-to-text app in C# with Foundry Local, a compact Nemotron model, and local model lifecycle management.
Build Production-Ready Agents with the GitHub Copilot Harness and Agent Framework
Developers increasingly want to build agents that can reason about code, modify files, execute commands, interact with developer tools, and work across entire repositories. While GitHub Copilot already provides a powerful coding harness for these scenarios, developers often need additional capabilities such as observability, middleware, approval workflows, enterprise governance, and integration with broader agent ecosystems. The GitHub Copilot integration in Microsoft Agent Framework brings these worlds together. You can now use GitHub Copilot's agentic harness as the execution engine for your agents while conti...
Remove Is Not Uninstall
Just as There is no Install – it’s ‘Stage’ and ‘Register’ explained that Install is not truly an installation operation in MSIX, Remove is similarly not an uninstall operation. This can be surprising - sometimes even alarming - to developers coming from traditional installer technologies such as MSI, where uninstalling software typically implies: In MSIX, that model simply does not exist. Remove = Deregister + (Maybe) Destage From MSIX Deployment's perspective, a package lifecycle consists of four fundamental operations: There's a symmetry here. Stage and Register do the work necessary to make ...
Build Azure Skills Faster with Cloud Academy, a Visual Studio Subscriber Benefit
If you've been looking for a practical way to build Azure skills, Cloud Academy (a QA company) gives Visual Studio subscribers hands-on learning that fits into busy schedules. Whether you're new to Azure, expanding your cloud expertise, working towards certifications or preparing for more advanced projects, this benefit helps you learn by doing. What you'll find in Cloud Academy The Cloud Academy benefit gives Visual Studio subscribers a flexible learning experience that adapts to different learning styles and schedules, providing: With the Cloud Academy benef...
Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 2
Using a reference stored in the global interface table.
Building an operations assistant on Azure that waits for approval before it acts
Grounding an assistant in runbooks is straightforward. The harder part begins when the model proposes an action that requires authorization. An operations assistant needs stronger controls as soon as it can act. Answering "which runbook covers this alert" is a search problem. Opening an incident from that same conversation is a control-plane problem, and that is where a helpful prototype quietly turns into something you would not want on call. I built a deliberately narrow reference app to sit on that boundary and see what breaks. It runs on Azure Container Apps, retrieves Markdown runbooks thro...
Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime
NuGet API key durations will be reduced to 30 days starting August 17th. This change will significantly strengthen the integrity of the NuGet supply chain.
Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 1
Looking for a COM reference that is between strong and weak.
From generated code to trusted code with a unit-test agent
Meet the open-source polyglot testing agent that learns from a repository, writes unit tests, and checks that they build and pass.
Making an agile version of a Windows Runtime delegate in C++/WinRT, part 10
What failure of the context callback means.
A deep dive into Power Pages Enhanced Authorization
Dataverse Native Authorization Model for Power Pages How mapped identities, security roles, and record filters move external-user authorization closer to the data. We’re introducing a major update to the Power Pages security model: authorization for external users is now enforced natively in Dataverse. Customers can opt in to this feature as they transition to the new model. This architecture moves Power Pages authorization closer to the data by translating Power Pages concepts into Dataverse-native security constructs. Instead of relying on Power Pages at runtime to reconstruct authorization for every request...
Introducing WPA MCP: Early Preview of AI-assisted trace analysis in Windows Performance Analyzer
Windows Performance Analyzer (WPA) is one of the most powerful tools available for understanding system performance on Windows. It helps engineers investigate Event Tracing for Windows (ETW) traces across CPU, memory, disk, networking, scheduling, input, and many other areas of the operating system. That power also comes with complexity. A single trace can contain a huge amount of data, and finding the right signal often requires knowing which WPA tables to open, which columns matter, how to filter the right time range, and how to connect multiple pieces of evidence into a root cause. We are working on WPA ...
Azure Developer CLI (azd) July 2026
This is the July round-up for the Azure Developer CLI (). Five releases shipped since the last post: 1.27.0, 1.27.1, 1.28.0, 1.28.1, and 1.29.0. Below is what's new, what changed, and what we fixed, with links to the pull requests if you want to dig in. Have feedback or questions? Join the release discussion on GitHub. Highlights: 🌐 Microsoft Foundry at the AI Engineer World's Fair In Pablo Castro's (Microsoft) "On AI and Knowledge" session at the AI Engineer World's Fair, the Microsoft Foundry team showed their command-line experience built on top of the extension platform. I...
Building agent teams with Agent Framework, GitHub Copilot CLI and Squad
Microsoft Agent Framework supports creating agents that use the GitHub Copilot SDK as their backend. GitHub Copilot agents provide access to powerful coding-oriented AI capabilities, including shell command execution, file operations, URL fetching, Model Context Protocol (MCP) server integration, and can be integrated into your existing development pipeline. We recently shipped this integration to v1.0 in C# and Python - fully supported and stable. Find out more here: MS Learn | Agent Framework | GitHub Copilot Agents and check out the samples here: .NET | Python A great example of using MAF and GitHub Copi...
Making an agile version of a Windows Runtime delegate in C++/WinRT, part 9
Maybe it doesn't matter.
Azure SDK Release (July 2026)
Azure SDK releases every month. In this post, you'll find this month's highlights and release notes.
