Sr. Content Developer at Microsoft, working remotely in PA, TechBash conference organizer, former Microsoft MVP, Husband, Dad and Geek.
150245 stories
·
33 followers

ICE Is Paying the Salaries of This Town’s Entire Police Force

1 Share
Under a Homeland Security program, police departments around the US are signing up to assist in immigration enforcement. The cops of Carroll, New Hampshire, are going all in—and they’re likely not alone.
Read the whole story
alvinashcraft
38 minutes ago
reply
Pennsylvania, USA
Share this story
Delete

Multi-stage attacks are the Final Fantasy bosses of security

1 Share
Ryan welcomes Gee Rittenhouse, VP of Security at AWS, to the show to discuss the complexities of multi-stage attacks in cybersecurity and how these attacks unfold, the challenges in detecting them, and the evolving role of AI in both enhancing security and creating new vulnerabilities.
Read the whole story
alvinashcraft
39 minutes ago
reply
Pennsylvania, USA
Share this story
Delete

Trump Administration To Pay French Company $1 Billion To Stop Offshore Wind Farms

2 Shares
An anonymous reader quotes a report from NPR: The Trump administration will pay $1 billion to a French company to walk away from two U.S. offshore wind leases as the administration ramps up its campaign against offshore wind and other renewable energy. TotalEnergies has agreed to what's essentially a refund of its leases for projects off the coasts of North Carolina and New York, and will invest the money in fossil fuel projects instead, the Department of Interior announced Monday. The Trump administration has tried to halt offshore wind construction, but federal judges overturned those orders. Environmental groups denounced the TotalEnergies deal as an alternate way to block wind projects. President Donald Trump has gone all in on fossil fuels, which he says is the way to lower costs for families, increase reliability and help the U.S. maintain global leadership in artificial intelligence. TotalEnergies pledged to not develop any new offshore wind projects in the United States. TotalEnergies CEO Patrick Pouyanne said in a statement that the company renounced offshore wind development in the United States in exchange for the reimbursement of the lease fees, "considering that the development of offshore wind projects is not in the country's interest." Pouyanne said the refunded lease fees will finance the construction of a liquefied natural gas plant in Texas and the development of its oil and gas activities, calling it a "more efficient use of capital" in the U.S. After it makes those investments, TotalEnergies will be reimbursed, up to the amount paid in lease purchases for offshore wind, according to the DOI.

Read more of this story at Slashdot.

Read the whole story
alvinashcraft
39 minutes ago
reply
Pennsylvania, USA
Share this story
Delete

CPU percentage vs SQL instance CPU percent: The Portal’s Favorite Misunderstanding

1 Share

If you’ve ever stared at Azure SQL Database metrics and thought:
“Hold on… SQL Instance CPU Percent includes user + system, so it must be higher than CPU Percentage, right? If it’s lower… something’s broken!”
…congratulations - you’ve joined a very large and very confused club. 


I recently had a customer hit exactly this situation: cpu_percent spiking to 100% while sql_instance_cpu_percent looked chill.
The customer’s conclusion was:
“The instance metric is lower, so Azure must be lying.”
Azure was not lying. The metrics were simply… doing math on different report cards.


As per Microsoft official documentations:

Metric: cpu_percent
“How hard is your database working?”
This metric shows CPU consumption toward the user workload limit of a database or an elastic pool, expressed as a percentage.

In simpler words:

  • Counts your database workload (user queries + user transactions)
  • Measured against the CPU quota allocated to your database
  • When it hits 100%, it means your database has used all CPU it’s allowed to use (for user workload)

Why you should care: If performance is slow and cpu_percent is high (especially near 100%), this is often the right place to look first for CPU pressure related to user workload.

100% cpu_percent = your database has exhausted all CPU allocated to it for user workload. This is the correct metric - you should care about for performance.

 

Metric: sql_instance_cpu_percent
“How busy is the host running SQL?”
This metric shows the total CPU consumption by the user and system workloads, expressed as a percentage. Because this metric and the CPU percentage metric are measured on different scales, they are not directly comparable with each other.

In simpler words:

  • Includes your user workload
  • Includes background/OS/internal SQL engine work
  • Includes system activity
  • Measured at the logical SQL host/instance level, not your database’s quota

Why you should care: It’s more of a platform/capacity/host health signal than a “your database is slow” signal.

 

MetricWhat is really meansShould you act?
CPU PercentageYour DB CPU limit usageYes, check the queries!
SQL Instance CPU PercentHost + System CPU usageFor Context Only

 

The Most Common Myth: “Instance CPU includes more stuff, so it should always be higher!”

Now, the confusion is regarding – usually people interpret that since SQL Instance CPU is a combination of user + internal workload, it should always be higher than CPU percentage. But actually, that is not the case. Let me explain you with a very basic/simple example:

Think of SQL Instance CPU Percent as an apartment flat, which has multiple rooms. One of the biggest room is allocated to the CPU Percentage for just user workload and other rooms for some other internal working or background processes.

Now, suppose the user workload room is now completely filled with people with no space, therefore we can say that the room is 100 percent occupied and the metric will show you the chart is peak 100 percent.

But that does not mean that whole apartment/flat is full, therefore – since that one room is only a part of it, it will always be higher usually in metrics – until there is an issue related to background process or some internal work.


Therefore, you should focus more on the CPU percentage, if this is super high, peaking 100 percent. You should explore the Query Store during that time to identify which query is causing CPU to spike and work on it.

Note: Even on a completely idle database or elastic pool, total CPU consumption is never at zero because of background database engine activities. It can fluctuate in a wide range depending on the specific background activities, compute size, and previous user workload.

References:
Monitoring Azure SQL Database with metrics and alerts - Azure SQL Database | Microsoft Learn
Resource Management - Azure SQL Database | Microsoft Learn

Read the whole story
alvinashcraft
39 minutes ago
reply
Pennsylvania, USA
Share this story
Delete

Step-by-Step: Deploy the Architecture Review Agent Using AZD AI CLI

1 Share

Hey everyone! I am Shivam Goyal, a Microsoft MVP, and I am super excited to share a project that will save you a massive amount of time.

Have you ever built a brilliant AI agent in an afternoon, only to spend the next two weeks fighting with Docker containers, memory persistence, and cloud deployment scripts to get it running?

In our previous post, we introduced the Architecture Review Agent, an open-source tool built on Microsoft Foundry that automatically converts messy architectural notes into structured risk assessments and interactive Excalidraw diagrams.

But building an AI agent is only half the battle. Iterating on one and actually getting it running in a production-grade environment without losing your mind over infrastructure is a completely different story.

The Problem with Agentic Development Loops

The typical agent development loop is painful: you write your agent code, test it by copy-pasting inputs into a local REPL, manually build a container, push it to a registry, configure RBAC, deploy to your cloud target, realize you need to tweak three lines of logic, and start the whole cycle over again.

You often end up with an agent that is 100 lines of clean Python, surrounded by 400 lines of Bicep and a 12-step deployment guide.

The azd ai extension for the Azure Developer CLI (AZD) completely changes this equation. For the Architecture Review Agent, the entire workflow, from zero infrastructure to a live hosted agent you can invoke from the command line, is just a few simple commands. And moving from local testing to a live cloud deployment is a single azd up.

Here is how you can set up, invoke, and deploy your own Architecture Review Agent, and even publish it to Microsoft Teams, without needing a tenant admin.

Step 1: The Setup (No heavy lifting required)

First, make sure you have the Azure Developer CLI installed and grab the AI Agents extension.

# Install AZD winget install microsoft.azd # Install the AI Agents extension azd extension install azure.ai.agents

Next, clone the repository and set up your local Python environment:

git clone https://github.com/Azure-Samples/agent-architecture-review-sample cd agent-architecture-review-sample python -m venv .venv .\.venv\Scripts\Activate.ps1 pip install -r requirements.txt

Finally, authenticate and tell AZD where your Microsoft Foundry project lives:

azd auth login azd env new arch-review-dev # Point it to your Foundry Project and Model azd env set AZURE_AI_PROJECT_ENDPOINT "https://<your-resource>.services.ai.azure.com/api/projects/<your-project>" azd env set AZURE_AI_MODEL_DEPLOYMENT_NAME "gpt-4.1"

Step 2: Run and Invoke Locally

With the AZD AI extension, you get a local server that behaves identically to a deployed Foundry-hosted agent. It uses the same localhost:8088 endpoint, the same OpenAI Responses API protocol, and the same conversation persistence.

Open your first terminal and start the runtime:

azd ai agent run

Now, open a second terminal. This is where the magic happens. The agent is completely format-agnostic. There is no schema you have to memorize. You can pass it a file, or just type out a whiteboard brain-dump inline.

Here is what the terminal experience looks like when running these commands and getting the structured report back:

Styled terminal showing all 3 azd ai agent invoke commands + full structured report output

Here are the three ways you can invoke it using "azd ai agent invoke --local":

Pattern A: The Structured YAML

If your team uses formal definitions, just point the agent to the file. The rule-based parser handles this instantly without an LLM call.

azd ai agent invoke --local "scenarios/ecommerce.yaml"12-component ecommerce architecture diagram generated from YAML input.
Pattern B: The Whiteboard Brain-Dump (Inline Arrow Notation)

Arrow notation (A -> B -> C) is how engineers actually communicate on whiteboards and in Slack. Before now, this wasn't a valid input for architecture tools.

azd ai agent invoke --local "LB -> 3 API servers -> PostgreSQL primary with read replica -> Redis cache"

The parser automatically extracts the replica count, infers the component types (LB becomes a Gateway), and builds a valid connection graph, surfacing single points of failure instantly.

Pattern C: The Markdown Design Doc

Just point it to your existing READMEs or design docs.

azd ai agent invoke --local "scenarios/event_driven.md"8-component event-driven streaming architecture generated from Markdown input

For all three patterns, the agent returns a structured Markdown report in your terminal and generates an interactive architecture.excalidraw file and a high-res PNG right in your local /output folder.

Step 3: One Command to the Cloud

When you are happy with how your agent performs locally, it's time to deploy. Forget manual Docker builds and complex credential management.

azd up

This single command orchestrates everything:

  1. Provisions Infrastructure: Creates your Foundry AI Services account, ACR, App Insights, and managed identities with proper RBAC.
  2. Builds and Pushes: Packages your Dockerfile and pushes the container image to ACR.
  3. Deploys the Agent: Registers the image and creates a hosted agent version in Foundry Agent Service.

The output will hand you a live Agent Playground URL and a production-ready API endpoint. Your agent now automatically scales from 0 to 5 replicas, manages its own conversation state, and authenticates securely via Managed Identity.

Step 4: Publish to Teams and M365 Copilot (Zero Admin Required!)

Having an API is great, but agents are most powerful when they live where your users collaborate. You can publish this agent directly to Microsoft Teams and M365 Copilot natively from the Foundry portal.

The best part? You can use the Individual Scope.

  1. Go to the Microsoft Foundry portal and find your deployed agent.
  2. Click Publish to Teams and Microsoft 365 Copilot.
  3. Fill out the basic metadata (Name, Description).
  4. Select the Individual scope.

Because you are using an individual scope, no M365 admin approval is required. The portal automatically provisions the Azure Bot Service, packages the metadata, and registers the app. Within minutes, your agent will appear in your Teams Copilot agent store. You can generate a share link and instantly send it to your team for a workshop or demo.

What I Learned Building This Workflow

Shifting from custom deployment scripts to the azd ai CLI taught me three things:

  1. The declarative contract is beautifully clean. Our azure.yaml declares the agent and infrastructure in about 30 lines. azd up translates that into a fully secure, production-grade Foundry environment.
  2. The local-to-cloud gap is finally gone. The azd ai agent run behaves exactly like the cloud. The invocation you write locally works identically against the deployed endpoint.
  3. Teams publishing is remarkably simple. I expected bot registration nightmares and tenant admin blockers. Instead, I filled out a form, waited two minutes, and was chatting with my architecture agent in Teams.

Resources & Next Steps

Now that we have a streamlined, single-hosted agent deployment, the natural next step is multi-agent orchestration. Imagine a triage agent that routes your design doc to a dedicated Security Reviewer Agent and a Scalability Reviewer Agent.

Try it out yourself by cloning the repository, running azd up, and let me know what you build!

Read the whole story
alvinashcraft
40 minutes ago
reply
Pennsylvania, USA
Share this story
Delete

Hosted Containers and AI Agent Solutions

1 Share

If you have built a proof-of-concept AI agent on your laptop and wondered how to turn it into something other people can actually use, you are not alone. The gap between a working prototype and a production-ready service is where most agent projects stall. Hosted containers close that gap faster than any other approach available today.

This post walks through why containers and managed hosting platforms like Azure Container Apps are an ideal fit for multi-agent AI systems, what practical benefits they unlock, and how you can get started with minimal friction.

The problem with "it works on my machine"

Most AI agent projects begin the same way: a Python script, an API key, and a local terminal. That workflow is perfect for experimentation, but it creates a handful of problems the moment you try to share your work.

First, your colleagues need the same Python version, the same dependencies, and the same environment variables. Second, long-running agent pipelines tie up your machine and compete with everything else you are doing. Third, there is no reliable URL anyone can visit to use the system, which means every demo involves a screen share or a recorded video.

Containers solve all three problems in one step. A single Dockerfile captures the runtime, the dependencies, and the startup command. Once the image builds, it runs identically on any machine, any cloud, or any colleague's laptop.

Why containers suit AI agents particularly well

AI agents have characteristics that make them a better fit for containers than many traditional web applications.

Long, unpredictable execution times

A typical web request completes in milliseconds. An agent pipeline that retrieves context from a database, imports a codebase, runs four verification agents in sequence, and generates a report can take two to five minutes. Managed container platforms handle long-running requests gracefully, with configurable timeouts and automatic keep-alive, whereas many serverless platforms impose strict execution limits that agent workloads quickly exceed.

Heavy, specialised dependencies

Agent applications often depend on large packages: machine learning libraries, language model SDKs, database drivers, and Git tooling. A container image bundles all of these once at build time. There is no cold-start dependency resolution and no version conflict with other projects on the same server.

Stateless by design

Most agent pipelines are stateless. They receive a request, execute a sequence of steps, and return a result. This maps perfectly to the container model, where each instance handles requests independently and the platform can scale the number of instances up or down based on demand.

Reproducible environments

When an agent misbehaves in production, you need to reproduce the issue locally. With containers, the production environment and the local environment are the same image. There is no "works on my machine" ambiguity.

A real example: multi-agent code verification

To make this concrete, consider a system called Opustest, an open-source project that uses the Microsoft Agent Framework with Azure OpenAI to analyse Python codebases automatically.

The system runs AI agents in a pipeline:

  1. A Code Example Retrieval Agent queries Azure Cosmos DB for curated examples of good and bad Python code, providing the quality standards for the review.
  2. A Codebase Import Agent reads all Python files from a Git repository cloned on the server.
  3. Four Verification Agents each score a different dimension of code quality (coding standards, functional correctness, known error handling, and unknown error handling) on a scale of 0 to 5.
  4. A Report Generation Agent compiles all scores and errors into an HTML report with fix prompts that can be exported and fed directly into a coding assistant.

The entire pipeline is orchestrated by a FastAPI backend that streams progress updates to the browser via Server-Sent Events. Users paste a Git URL, watch each stage light up in real time, and receive a detailed report at the end.

The app in action

Landing page: the default Git URL mode, ready for a repository link.

Landing page showing Git URL input mode

Local Path mode: toggling to analyse a codebase from a local directory.

Local Path input mode

Repository URL entered: a GitHub repository ready for verification.

Repository URL entered in the input field

Stage 1: the Code Example Retrieval Agent fetching standards from Cosmos DB.

Stage 1 code example retrieval in progress

Stage 3: the four Verification Agents scoring the codebase.

Stage 3 verification agents running

Stage 4: the Report Generation Agent compiling the final report.

Stage 4 report generation

Verification complete: all stages finished with a success banner.

Verification complete with success banner

Report detail: scores and the errors table with fix prompts.

Report showing scores and error table

The Dockerfile

The container definition for this system is remarkably simple:

 
FROM python:3.12-slim RUN apt-get update && apt-get install -y --no-install-recommends git \ && rm -rf /var/lib/apt/lists/* WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt COPY backend/ backend/ COPY frontend/ frontend/ RUN adduser --disabled-password --gecos "" appuser USER appuser EXPOSE 8000 CMD ["uvicorn", "backend.app:app", "--host", "0.0.0.0", "--port", "8000"]
 

Twenty lines. That is all it takes to package a six-agent AI system with a web frontend, a FastAPI backend, Git support, and all Python dependencies into a portable, production-ready image.

Notice the security detail: the container runs as a non-root user. This is a best practice that many tutorials skip, but it matters when you are deploying to a shared platform.

From image to production in one command

With the Azure Developer CLI (azd), deploying this container to Azure Container Apps takes a single command:

 
azd up
 

Behind the scenes, azd reads an azure.yaml file that declares the project structure, provisions the infrastructure defined in Bicep templates (a Container Apps environment, an Azure Container Registry, and a Cosmos DB account), builds the Docker image, pushes it to the registry, deploys it to the container app, and even seeds the database with sample data via a post-provision hook.

The result is a publicly accessible URL serving the full agent system, with automatic HTTPS, built-in scaling, and zero infrastructure to manage manually.

Microsoft Hosted Agents vs Azure Container Apps: choosing the right home

Microsoft offers two distinct approaches for running AI agent workloads in the cloud. Understanding the difference is important when deciding how to host your solution.

Microsoft Foundry Hosted Agent Service (Microsoft Foundry)

Microsoft Foundry provides a fully managed agent hosting service. You define your agent's behaviour declaratively, upload it to the platform, and Foundry handles execution, scaling, and lifecycle management. This is an excellent choice when your agents fit within the platform's conventions: single-purpose agents that respond to prompts, use built-in tool integrations, and do not require custom server-side logic or a bespoke frontend.

Key characteristics of hosted agents in Foundry:

  • Fully managed execution. You do not provision or maintain any infrastructure. The platform runs your agent and handles scaling automatically.
  • Declarative configuration. Agents are defined through configuration and prompt templates rather than custom application code.
  • Built-in tool ecosystem. Foundry provides pre-built connections to Azure services, knowledge stores, and evaluation tooling.
  • Opinionated runtime. The platform controls the execution environment, request handling, and networking.

Azure Container Apps

Azure Container Apps is a managed container hosting platform. You package your entire application (agents, backend, frontend, and all dependencies) into a Docker image and deploy it. The platform handles scaling, HTTPS, and infrastructure, but you retain full control over what runs inside the container.

Key characteristics of Container Apps:

  • Full application control. You own the runtime, the web framework, the agent orchestration logic, and the frontend.
  • Custom networking. You can serve a web UI, expose REST APIs, stream Server-Sent Events, or run WebSocket connections.
  • Arbitrary dependencies. Your container can include any system package, any Python library, and any tooling (like Git for cloning repositories).
  • Portable. The same Docker image runs locally, in CI, and in production without modification.

Why Opustest uses Container Apps

Opustest requires capabilities that go beyond what a managed agent hosting platform provides:

RequirementHosted Agents (Foundry)Container Apps
Custom web UI with real-time progressNot supported nativelyFull control via FastAPI and SSE
Multi-agent orchestration pipelinePlatform-managed, limited customisationCustom orchestrator with arbitrary logic
Git repository cloning on the serverNot availableInstall Git in the container image
Server-Sent Events streamingNot supportedFull HTTP control
Custom HTML report generationLimited to platform outputsGenerate and serve any content
Export button for Copilot promptsNot availableCustom frontend with JavaScript
RAG retrieval from Cosmos DBPossible via built-in connectorsDirect SDK access with full query control

The core reason is straightforward: Opustest is not just a set of agents. It is a complete web application that happens to use agents as its processing engine. It needs a custom frontend, real-time streaming, server-side Git operations, and full control over how the agent pipeline executes. Container Apps provides all of this while still offering managed infrastructure, automatic scaling, and zero server maintenance.

When to choose which

Choose Microsoft Hosted Agents when your use case is primarily conversational or prompt-driven, when you want the fastest path to a working agent with minimal code, and when the built-in tool ecosystem covers your integration needs.

Choose Azure Container Apps when you need a custom frontend, custom orchestration logic, real-time streaming, server-side processing beyond prompt-response patterns, or when your agent system is part of a larger application with its own web server and API surface.

Both approaches use the same underlying AI models via Azure OpenAI. The difference is in how much control you need over the surrounding application.

Five practical benefits of hosted containers for agents

1. Consistent deployments across environments

Whether you are running the container locally with docker run, in a CI pipeline, or on Azure Container Apps, the behaviour is identical. Configuration differences are handled through environment variables, not code changes. This eliminates an entire category of "it works locally but breaks in production" bugs.

2. Scaling without re-architecture

Azure Container Apps can scale from zero instances (paying nothing when idle) to multiple instances under load. Because agent pipelines are stateless, each request is routed to whichever instance is available. You do not need to redesign your application to handle concurrency; the platform does it for you.

3. Isolation between services

If your agent system grows to include multiple services (perhaps a separate service for document processing or a background worker for batch analysis), each service gets its own container. They can be deployed, scaled, and updated independently. A bug in one service does not bring down the others.

4. Built-in observability

Managed container platforms provide logging, metrics, and health checks out of the box. When an agent pipeline fails after three minutes of execution, you can inspect the container logs to see exactly which stage failed and why, without adding custom logging infrastructure.

5. Infrastructure as code

The entire deployment can be defined in code. Bicep templates, Terraform configurations, or Pulumi programmes describe every resource. This means deployments are repeatable, reviewable, and version-controlled alongside your application code. No clicking through portals, no undocumented manual steps.

Common concerns addressed

"Containers add complexity"

For a single-file script, this is a fair point. But the moment your agent system has more than one dependency, a Dockerfile is simpler to maintain than a set of installation instructions. It is also self-documenting: anyone reading the Dockerfile knows exactly what the system needs to run.

"Serverless is simpler"

Serverless functions are excellent for short, event-driven tasks. But agent pipelines that run for minutes, require persistent connections (like SSE streaming), and depend on large packages are a poor fit for most serverless platforms. Containers give you the operational simplicity of managed hosting without the execution constraints.

"I do not want to learn Docker"

A basic Dockerfile for a Python application is fewer than ten lines. The core concepts are straightforward: start from a base image, install dependencies, copy your code, and specify the startup command. The learning investment is small relative to the deployment problems it solves.

"What about cost?"

Azure Container Apps supports scale-to-zero, meaning you pay nothing when the application is idle. For development and demonstration purposes, this makes hosted containers extremely cost-effective. You only pay for the compute time your agents actually use.

Getting started: a practical checklist

If you are ready to containerise your own agent solution, here is a step-by-step approach.

Step 1: Write a Dockerfile. Start from an official Python base image. Install system-level dependencies (like Git, if your agents clone repositories), then your Python packages, then your application code. Run as a non-root user.

Step 2: Test locally. Build and run the image on your machine:

 
docker build -t my-agent-app . docker run -p 8000:8000 --env-file .env my-agent-app
 

If it works locally, it will work in the cloud.

Step 3: Define your infrastructure. Use Bicep, Terraform, or the Azure Developer CLI to declare the resources you need: a container app, a container registry, and any backing services (databases, key vaults, AI endpoints).

Step 4: Deploy. Push your image to the registry and deploy to the container platform. With azd, this is a single command. With CI/CD, it is a pipeline that runs on every push to your main branch.

Step 5: Iterate. Change your agent code, rebuild the image, and redeploy. The cycle is fast because Docker layer caching means only changed layers are rebuilt.

The broader picture

The AI agent ecosystem is maturing rapidly. Frameworks like Microsoft Agent Framework, LangChain, Semantic Kernel, and AutoGen make it straightforward to build sophisticated multi-agent systems. But building is only half the challenge. The other half is running these systems reliably, securely, and at scale.

Hosted containers offer the best balance of flexibility and operational simplicity for agent workloads. They do not impose the execution limits of serverless platforms. They do not require the operational overhead of managing virtual machines. They give you a portable, reproducible unit of deployment that works the same everywhere.

If you have an agent prototype sitting on your laptop, the path to making it available to your team, your organisation, or the world is shorter than you think. Write a Dockerfile, define your infrastructure, run azd up, and share the URL.

Your agents deserve a proper home. Hosted containers are that home.

Read the whole story
alvinashcraft
40 minutes ago
reply
Pennsylvania, USA
Share this story
Delete
Next Page of Stories