Sr. Content Developer at Microsoft, working remotely in PA, TechBash conference organizer, former Microsoft MVP, Husband, Dad and Geek.
160557 stories
·
33 followers

WW 999: Physical Goods - Acer SFF RTX Spark Desktop Design Showcased at IFA 2026

1 Share

While Microsoft pushes Copilot+ PCs, NVIDIA storms into the Windows ecosystem with AI-focused Spark machines and game-changing specs, igniting new rivalries with Apple and upending expectations for what local hardware can do. Plus, Atari revives 39 Activision classics for a price that will make retro fans blink, while the Sonos saga continues as it pivots to an open AI platform that might finally win back old loyalties. Finally, Paul's Markdown book will be released sometime in the next week.

Windows

  • The mystery of 26H2 is now less mysterious
  • Last week: Week D came and went without a preview release, triggering speculation
  • Microsoft issues Windows 11 version 26H2 to Release Preview, a first
  • This means a September or October release to stable. Just guessing, but Preview Update in September, general Update in October is most likely
  • Version numbers don't matter much anymore. There are no unique 26H2 features, just a few unique 26H2 presets - These include Point-in-time restore and Memory Integrity Protection being on by default
  • Two 26H1 pre-release builds with little to speak of
  • IFA 2026 is underway in Berlin
  • Acer is first out of the gates with dozens of new PCs, including one based on the NVIDIA RTX Spark
  • EU General Court confirms that Microsoft Edge is not a gatekeeper
  • Visual Studio Code now has a full Markdown Editor experience
  • Brave now offers free email aliases, and will have a premium option soon
  • Firefox for iOS now has integrated ad blocking
  • NVIDIA - $96.2 billion in revenues, up 106 percent YOY
  • Dell - record $47 billion in revenues, but it's all from server/infrastructure
  • HP - $15.7 billion in revenues, up 12.5 percent - $11.8 billion from PCs, vs. $15 billion for all Dell client products

AI/dev

  • Sony and Warner sue Anthropic for stealing their music
  • Gemini Notebook gets first Expert Intelligence upgrade with integrated e-book support
  • Sonos announces Sonos 27 OS with major AI functionality
  • Microsoft moves WinUI development fully to GitHub ahead of open-sourcing it

XBOX and gaming

  • Call of Duty: Black Ops Cold War, more coming to Game Pass
  • Every Activision title for the Atari 2600 is being reissued in cartridge form, but it's going to cost you

Tips and picks

  • Tip of the week: Markdown: A Field Guide for Writers
  • App pick of the week: ImageGlass 10
  • RunAs Radio this week: Reimagining Intranets with Susan Hanley
  • Brown liquor pick of the week: Macaloney's Cath-Nah-Aven

Hosts: Leo Laporte, Paul Thurrott, and Richard Campbell

Download or subscribe to Windows Weekly at https://twit.tv/shows/windows-weekly

Check out Paul's blog at thurrott.com

The Windows Weekly theme music is courtesy of Carl Franklin.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:





Download audio: https://pdst.fm/e/pscrb.fm/rss/p/mgln.ai/e/294/cdn.twit.tv/megaphone/ww_999/ARML9499546354.mp3
Read the whole story
alvinashcraft
4 hours ago
reply
Pennsylvania, USA
Share this story
Delete

Build Agents That Drive Faster Outcomes: Best Practices From Microsoft Partners

1 Share
From: MicrosoftAzure
Duration: 2:22
Views: 28

Where do you actually start with agentic AI? Microsoft partners share what's working-spotting the internal processes worth automating, winning executive buy-in, and why they build on the Microsoft stack. Hear what the experts have learned, then connect with a Microsoft partner on your next step.

Start with the right use case—don't go it alone.
Explore Azure partner resources to build your AI and agent capabilities: https://msft.it/6058auIOQ

#Microsoft #MicrosoftAzure #AgenticAI

Read the whole story
alvinashcraft
4 hours ago
reply
Pennsylvania, USA
Share this story
Delete

Constraining Agents for Software Development with Don Demcsak

1 Share
How can constraints make software development assistants more efficient? Carl and Richard talk to Don Demcsak about his work on getting LLMs to build higher-quality software with fewer resources. Don talks about how domain-driven language techniques help to define and constrain language around a given application problem space, but that largely hasn't been applied to coding agents so far. And as powerful as domain-driven is, it has challenges when it comes to building applications - and, more importantly, testing them. That's where behavior-driven approaches have advantages, which can also be applied to agents. Applying techniques of the past to tools of the future can accelerate development even further!



Download audio: https://dts.podtrac.com/redirect.mp3/api.spreaker.com/download/episode/74837586/dotnetrocks_2018_constraining_agents_for_software_development.mp3
Read the whole story
alvinashcraft
4 hours ago
reply
Pennsylvania, USA
Share this story
Delete

Introducing Viva Glint APIs for Survey Data Export and Visier Integration

1 Share

Enterprise HR analytics increasingly depend on frictionless data integration across a diverse ecosystem of solutions to unlock deeper, actionable insight. With the introduction of programmatic survey export APIs—and a Visier connector built on top of them—Viva Glint enables customer data to flow securely into the analytics environments where business decisions are made.

The market problem

Organizations have invested heavily in employee listening, but insights often remain confined within the survey platform. Manual processes—downloading reports, reformatting data, reconciling employee identifiers, and ingesting files into data warehouses—limit what HR and People Analytics teams can achieve. These workflows create operational overhead, slow time-to-insight, and reduce the ability to act when it matters most. Customers are asking for a better way that aligns with how modern data ecosystems operate—one that reduces manual effort, automates data movement, supports ecosystem flexibility, and enables richer downstream analytics, all delivered with privacy and governance by design.

Introducing Viva Glint Export APIs

To address these needs, Microsoft is introducing Viva Glint export APIs—purpose-built to bring employee listening data into the flow of enterprise analytics. The Viva Glint export APIs let organizations securely and programmatically export survey response data for advanced analytics, reporting, and integration with external platforms. Built on Microsoft Graph, they use familiar, standards-based authentication and authorization to ensure secure, governed access across systems.

In practical terms, the APIs deliver:

  • Automation — Trigger exports on demand or on a defined cadence, eliminating manual downloads and operational bottlenecks
  • Extensibility — Easily integrate with analytics and data platforms such as Visier, Azure Data Lake or with any cross-cloud environments
  • Integration foundation — Establish a governed data layer that partners and customers can build on to build further HR intelligence workflows.

Setting up the APIs

The APIs enable exports for all Glint surveys within a defined time period, for a specific survey, or for a single survey cycle. The following steps set up the application used to automate data exports.

  • Register a Microsoft Entra application. In the Entra admin center, create an App Registration and record the Directory (tenant) ID and Application (client) ID.
  • Add a client secret under Certificates or secrets to the Entra application
  • Grant the export permission. In the created Entra application, add the Microsoft Graph application permission SentimentSurvey.Export.All. Because survey data is highly sensitive, only your tenant Global Administrator can grant admin consent — a deliberate governance control.
  • Acquire a token via the standard OAuth 2.0 client-credentials flow and call the export endpoints.
  • Enable API application id on Glint – Glint admin to add the Microsoft Graph application id in Settings > API Settings > Allowed Applications. Glint will only allow application ID requests from the allowed application settings.  
  • Initiate the data export job. Call the POST API endpoint with the appropriate export start date and end date values to schedule an export job.
  • Monitor the job. Continuously monitor the initiated job for completion.
  • Export the results. Download the results as a zipped file containing one file for every exported survey cycle and one folder for every exported survey program.
  • Availability: Viva Glint export APIs are currently available through a limited private preview for approved customers. Features, timelines, and availability may change during the preview period. Interested customers should reach out to their CxPM or Microsoft support to express interest and have their tenant enabled.

Every programmatic export is captured in the activity audit log (success/failure, Microsoft Graph correlation ID, and a link to the exported file), so governance and compliance teams retain full traceability. By default, exports include the minimum HR data alongside responses; additional attributes are configurable per tenant through support — keeping you in control of what leaves the platform.

Analyze faster with the vivaglint R library

For teams that would like to analyze along with data integration, the open-source vivaglint R package wraps these APIs end-to-end. Configure credentials once with glint_setup(), then pull data directly with read_glint_survey_api() — by cycle, by full survey, or by date range:

Sample code illustration:

library(vivaglint)

 

glint_setup(tenant_id, client_id, client_secret, experience_name) # pass configs for setup

 

survey <- read_glint_survey_api(mode = "daterange",

                                start_date = "2025-01-01",

                                end_date   = "2025-03-31")

 

summarize_survey(survey, scale_points = 5)      # Get survey means, favorability, response rates

get_correlations(survey, method = "spearman")   # Get inter-question relationships

analyze_attrition(survey, attrition_file = "employee_attributes.csv") #Join with external data

From there you can compare cycles, aggregate by manager hierarchy, run factor analysis, and link survey responses to turnover — the exact analyses customers told us they want.

Viva Glint + Visier: sentiment, meet workforce intelligence

Our first flagship integration built on these APIs is with Visier, the workforce intelligence platform. Visier’s new connector for Microsoft Viva Glint brings survey engagement data directly into the Visier platform — no manual ETL, no mismatched IDs.

Setup is straightforward and secure. In Visier, an admin selects Microsoft Viva Glint as a data provider in the Survey category, then enters the Entra tenant ID, client ID, and secret from the app registration above; Visier confirms “Authentication successful.”

Once connected, survey fields map into Visier’s Employee Survey model — employee ID, scores, comments, topics, and cycle metadata.

The connector then operates on a simple loop:

  1. A survey closes in Viva Glint.
  2. The connector triggers an automated transfer via the Viva Glint export API—on schedule or on demand.
  3. Engagement data joins your workforce model as Visier aligns it to your existing organizational context.
  4. Insights are delivered so engagement data can be analyzed alongside broader workforce metrics available within Visier's workforce intelligence platform.

The result: organizations can now analyze employee sentiment data alongside workforce analytics data in a more streamlined workflow for key questions such as Which teams with low belonging scores also show elevated attrition risk? Are new hires from certain channels less engaged at 90 days?. For organizations running both platforms, the connector is available for early access—see visier.com.

The developer & analyst ecosystem — and where we’re headed

The export APIs are more than a feature; they are a platform capability. Around them, a growing ecosystem is taking shape: the vivaglint R library and the vivaglint_py Python library give analysts productive, code-first access to their data, while partners like Visier show what ISV-built integrations can deliver.

The Viva Glint APIs and libraries mark an early step in Viva Glint's journey toward a more connected employee experience ecosystem, helping organizations to bring survey insights into the analytics platforms and business tools they already use and trust.

 

To join the private preview, contact your CxPM or Microsoft support.

Read the whole story
alvinashcraft
4 hours ago
reply
Pennsylvania, USA
Share this story
Delete

Kubernetes v1.37: Scale Workloads to Zero with HorizontalPodAutoscaler

1 Share

Kubernetes v1.37 includes API support for horizontal autoscaling of workloads down to zero replicas. This feature is now Beta and enabled by default. A HorizontalPodAutoscaler (HPA) that uses a suitable object metric or external metric can now scale a workload to zero replicas, then bring it back when the metric changes.

Before v1.37, you needed an add-on or external component, or you had to enable the Alpha feature gate, to scale from zero. It is now part of core Kubernetes.

Scaling to zero removes the last idle Pod from workloads such as queue consumers and batch processors. The savings are largest when each Pod reserves expensive resources, including dedicated CPUs or GPUs.

The trade-off is cold-start time: the HPA must observe the metric, schedule a Pod, and start the application. This works well when work can wait in a durable queue.

Kubernetes Services do not buffer requests while no Pods are ready, so HTTP and other request-driven workloads need a separate buffering layer.

Why scaling from zero needs a different metric

The HPA commonly scales on CPU or memory usage. Both metrics come from running Pods. Once the replica count reaches zero, there are no Pods left to measure and no signal that can tell the HPA to scale back up.

Object and external metrics do not have that limitation. A queue length, for example, exists independently of the workers that consume it. The HPA can continue reading the queue length while no workers are running.

The following example scales a queue consumer to and from zero using an external metric.

Configure an external metric

The following example uses a Prometheus metric named queue_consumer_lag. It assumes that Prometheus already collects a series similar to this one:

queue_consumer_lag{namespace="default",name="worker_tasks"}

Kubernetes needs a metrics adapter to make that value available through the External Metrics API. One implementation is the Prometheus Adapter, which can expose the series using an externalRules entry:

externalRules:
- seriesQuery: '{__name__="queue_consumer_lag",name!=""}'
 metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>}) by (name)
 resources:
 overrides:
 namespace:
 resource: namespace

The exact adapter installation and discovery rules depend on your monitoring setup. See the Prometheus Adapter guide to external metrics for the full configuration options.

Before creating the HPA, you can verify that Kubernetes can read the metric:

kubectl get --raw \
 '/apis/external.metrics.k8s.io/v1beta1/namespaces/default/queue_consumer_lag?labelSelector=name%3Dworker_tasks'

The request should return the current value for worker_tasks. If it does not, fix the metrics pipeline before configuring the HPA. An HPA cannot scale from zero when its metric is unavailable.

Configure the HPA

The following HPA targets a Deployment named queue-worker. It allows between zero and ten replicas, with one replica requested for each 30 queued tasks:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
 name: queue-worker
 annotations:
 kubernetes.io/description: "Scales queue-worker based on the number of queued tasks"
spec:
 scaleTargetRef:
 apiVersion: apps/v1
 kind: Deployment
 name: queue-worker
 minReplicas: 0
 maxReplicas: 10
 metrics:
 - type: External
 external:
 metric:
 name: queue_consumer_lag
 selector:
 matchLabels:
 name: worker_tasks
 target:
 type: Value
 value: "30"

When the queue is empty, the HPA can reduce the Deployment to zero replicas. When tasks arrive, the external metric remains available and the HPA calculates a new replica count, capped at ten by maxReplicas.

Start the Deployment with at least one replica. Manually setting a Deployment to zero has always paused autoscaling. The HPA preserves that behavior and will not wake a workload that it did not scale down itself.

Normal HPA behavior still applies. In particular, the default downscale stabilization window is five minutes. The window prevents a short drop in queue length from immediately removing all workers. You can configure the window through spec.behavior.scaleDown if your workload needs different behavior.

How the HPA distinguishes zero from paused

Scaling from zero creates an ambiguity. A replica count of zero can mean that the HPA scaled the workload down, or that an operator manually paused it.

The controller resolves this with a ScaledToZero status condition. When the HPA scales a workload from one or more replicas to zero, it records ScaledToZero=True. The condition tells later reconciliation loops that the controller owns the zero state and should continue evaluating object or external metrics.

After scaling the workload back up, the controller changes the condition to ScaledToZero=False with the reason NotScaledToZero. A workload at zero without the ScaledToZero=True condition remains paused.

You can inspect the conditions with:

kubectl describe hpa queue-worker

If the adapter cannot return the configured metric, the HPA reports ScalingActive=False with a reason such as FailedGetExternalMetric. Restore the metric or manually scale the workload to recover capacity.

Before upgrading or rolling back

In Kubernetes v1.37, the HPAScaleToZero feature gate is enabled by default on both the kube-apiserver and kube-controller-manager. The API server accepts minReplicas: 0; the controller manager performs the condition-based scaling.

During a version-skewed control plane upgrade, wait until both components support the feature and have it enabled before creating HPAs with minReplicas: 0. A controller manager with the feature disabled treats replicas: 0 as a manual pause and may leave a workload at zero.

Before disabling the feature gate or downgrading to a version without the condition-based implementation:

  • Change affected HPAs to minReplicas: 1 or higher.
  • Scale any workload currently at zero to at least one replica.

minReplicas: 0 also requires at least one object or external metric. The API server rejects an HPA that only contains resource metrics such as CPU or memory.

From Alpha to Beta

The first Alpha implementation shipped in Kubernetes v1.16. Kubernetes v1.36 added the ScaledToZero condition and the controller behavior needed to distinguish an automatic scale-down from a manual pause.

Kubernetes v1.37 enables the feature by default after adding integration and end-to-end coverage for scaling down to zero and back up from an external metric. The next step is to gather operational feedback before considering graduation to GA.

How can I learn more?

How to get involved

This feature is owned by SIG Autoscaling. Join Kubernetes Slack and the #sig-autoscaling channel to share feedback from Beta usage.

Acknowledgements

Thanks to the SIG Autoscaling contributors who took this feature from the original v1.16 implementation to the condition-based redesign and Beta graduation. Thanks also to Guy Templeton and Adrian Moisey for reviewing the KEP, and to the release, documentation, and production-readiness reviewers who helped prepare it for Kubernetes v1.37.

Read the whole story
alvinashcraft
4 hours ago
reply
Pennsylvania, USA
Share this story
Delete

The MCP Authentication and Authorization Gap

1 Share

The part of the MCP story that keeps me up at night is not the tools, the prompts, or the discovery. It is authentication and authorization, because that is the part where the gap between how it should be done and how it is actually being done right now is widest, and the consequences of getting it wrong are the most severe. We are wiring language models into production systems at a speed that would have been reckless even for human-driven integrations, and a large share of the MCP servers going live are handling identity and access in ways that range from naive to genuinely dangerous. This is the corner of MCP where the industry is writing checks its security posture cannot cash.

Let me describe the gap plainly. Done well, an MCP server sits behind real, modern authorization. It uses OAuth properly. It supports Dynamic Client Registration so that clients can be provisioned and identified without a human pasting secrets into a config file. It uses token exchange so that the agent acts with a token scoped precisely to what it is allowed to do, on behalf of a specific identity, for a bounded purpose — not with a god-mode credential that can do anything the server can do. That is the good version, and the standards to build it have existed for years. Done badly — which is a lot of what is shipping — the MCP server takes a long-lived API key stuffed into an environment variable, hands the agent the full authority of that key, and calls it a day. No scoping, no delegation, no real notion of who the agent is acting as or what it is allowed to touch. Just a bearer of enormous, undifferentiated power sitting one prompt injection away from misuse.

The reason this matters so much more for agents than it did for traditional clients is that the client in the middle is now a probabilistic system that can be talked into things. My friend Mike from Curity gave a talk this year whose title I have not been able to put down — when AI agents start acting, APIs become execution contracts — and that is exactly the shift. When a human held the API key, the authorization model could lean on the human’s judgment as a backstop. When an agent holds it, the judgment backstop is gone and replaced by a model that will do what its context tells it to do, including context an attacker slipped in. So the token the agent carries has to be the control. It has to be narrowly scoped, tied to a real identity, exchangeable for exactly the authority the current task requires and no more. The whole burden of “should this action be allowed” moves from the human onto the authorization layer, and if that layer is a static all-powerful key, there is no layer at all.

I have been making a version of this argument all year in the governance context, that governing what agents are allowed to consume is the actual frontier. Authentication and authorization is where that governance either exists or does not, in the most concrete possible terms. All the careful context engineering in the world does not help if the token behind the tools can do anything the account can do. Scoping the tools an agent sees is the governance conversation; scoping the token those tools act with is the enforcement. You need both, and right now the industry is doing a passable job on the first and a frightening job on the second.

The frustrating thing is that none of this is unsolved. We are not waiting on new standards. Dynamic Client Registration, token exchange, fine-grained scopes, proper OAuth flows — these are mature, they are documented, and the identity vendors who have spent years on exactly this problem know precisely how to do it. The gap is not a knowledge gap. It is a speed-versus-diligence gap, the same one that produced the throwaway API pattern: a static key wired into an env var demos today, and doing authorization correctly takes a few more days that the launch schedule does not want to spend. So the insecure version ships, and it ships a lot, and it is accumulating into a very large attack surface made of agents holding credentials far more powerful than the tasks they perform.

So if you are building an MCP server, treat authentication and authorization as the part you are least allowed to shortcut, not the part you bolt on after the tools are fun. Use OAuth properly. Support Dynamic Client Registration. Use token exchange so the agent acts with a scoped, delegated, purpose-bound token instead of a master key. Make the token, not the model’s good behavior, the thing that enforces what is allowed — because the model’s good behavior is exactly what an attacker will target. The tools are what make MCP interesting. The authorization is what makes it safe to connect to anything that matters, and closing this gap is the difference between MCP being useful infrastructure and MCP being the largest over-privileged-credential problem the industry has ever handed itself.



Read the whole story
alvinashcraft
5 hours ago
reply
Pennsylvania, USA
Share this story
Delete
Next Page of Stories