Service principals, managed identities and now Entra agent identities are all non-human identities in the same directory, and they multiply faster than anyone reviews them. This guide explains what each type is, which credential each should use, what Workload ID Premium and Agent 365 actually add, and which identity to choose for which workload, with every claim checked against Microsoft's documentation in September 2026.
Microsoft's guidance is clear that AI workloads belong in ordinary application landing zones. What changes is the order of work. Some Foundry networking choices are fixed the moment the resource is created, so they have to be settled before the first model is deployed. This guide covers placement, private endpoints and DNS, agent network isolation, keyless identity, the renamed Foundry roles, policy, the AI gateway, quotas and regions, checked against Microsoft's documentation in September 2026.
Most Azure waste is not a bad architecture decision. It is a meter that kept running after its reason ended: a disk left behind by a deleted VM, a public IP nobody released, an empty App Service plan, a reservation nobody watches. This list covers seven common leaks, with how to find each one, how to fix it, and whether policy can stop it coming back, checked against Microsoft's documentation in September 2026.
Licensing is an architecture input, not a procurement detail. The agreement you buy through decides where Azure commitments, cost allocation and billing scopes can sit, and the Microsoft 365 plan decides which identity, endpoint, email and data controls you can design with. This guide maps EA, MCA and CSP to Azure billing structure, and E3, E5, the $12 suites and E7 to the security designs each one unlocks, checked against Microsoft's documentation in September 2026.
Azure budgets alert, they do not stop spending, and every cost alert in Azure works on data that is hours or days old. This guide separates preventive guardrails (Azure Policy, quotas, subscription vending) from detective ones (budgets, anomaly alerts, Advisor), shows the latency gap between them, and proposes a baseline that puts each control at the right scope. Checked against Microsoft's documentation in September 2026.
Microsoft 365 Copilot and its agents are paid for in three different ways, and each one bills to a different place: per-user seats on the Microsoft 365 invoice, prepaid Copilot Credits allocated to Power Platform environments, and pay-as-you-go charges on an Azure subscription. This guide explains the three cost shapes, the controls Microsoft provides for each, and a chargeback model built on them, checked against Microsoft's documentation in September 2026.
Azure OpenAI in Microsoft Foundry Models has three billing shapes: pay per token, reserve capacity in provisioned throughput units, or accept a 24-hour target turnaround for half price with Batch. This guide explains where tokens come from in an agent turn, how PTU sizing and reservations work, when spillover helps, and how to monitor spend, with every claim checked against Microsoft's documentation in September 2026.
Most AI governance boards fail in one of two ways: they review everything and become a queue, or they review nothing and become a rubber stamp. This article proposes an operating model built on intake tiers, clear decision rights and a fast path for low-risk AI use, grounded in the NIST AI RMF, ISO/IEC 42001, the EU AI Act as amended by the 2026 AI Omnibus, Microsoft's Responsible AI Impact Assessment and OMB M-25-21.
Indirect prompt injection arrives through the documents, email, web pages and tool results an AI system reads, not through the user. OWASP's 2026 Top 10 now says no reliable prevention exists and that defence is architectural. This article explains where injected instructions enter, what model-level defences can and cannot do, and the trust boundaries on data that still hold when the model is fooled.
NIST's AI Risk Management Framework is voluntary and ISO/IEC 42001 is certifiable, but they describe the same management cycle. This guide lines the two up, maps each theme to the Microsoft controls that produce evidence for it (Purview, Entra Agent ID, Agent 365, Defender for Cloud and Foundry), and is clear about what no tool can do for you. Checked against NIST, ISO and Microsoft documentation in September 2026.
Microsoft Copilot respects existing permissions, which means it finds existing oversharing faster than any user ever did. This guide explains where excess access comes from, what SharePoint Advanced Management and Microsoft Purview actually do about it, why Restricted SharePoint Search is retiring, and a phased remediation plan, with every status checked against Microsoft's documentation in September 2026.
Most organizations can now build AI agents faster than they can say who owns them. This article proposes a twelve-field inventory record and a seven-stage lifecycle from proposal to retirement, and maps each stage to what the Microsoft 365 Agent Registry, Microsoft Agent 365, Entra Agent ID and Power Platform inventory actually do as of September 2026, including where the tooling stops.
Every MCP server is two things at once: text your model will read, and code that acts with someone's credentials. This guide covers the current MCP specification and its OAuth 2.1 authorization model, five risk classes, a vetting checklist, where Microsoft's MCP hosting and gateway options stand in September 2026, and an allow-list model that holds up in an audit.
Once an AI agent can write to systems, send email or move money, "a human approves it" is not a design. This guide classifies agent actions by consequence and reversibility, maps each class to an approval pattern, and sets out what the audit record must hold to survive a review, grounded in what Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry and Purview actually provide as of September 2026.
Once you have decided to extend Microsoft 365 Copilot, there are three ways to do it, and they are not interchangeable. Copilot connectors change what Copilot knows, declarative agents change how it behaves, and custom engine agents replace its engine. This guide compares the three on licensing, governance and who carries the risk, with every claim checked against Microsoft's documentation in September 2026.
Copilot Studio and Microsoft Foundry are not competitors — they sit at different levels of abstraction, and three changes in 2026 have quietly retired most of the advice written about choosing between them. A decision framework built on who owns the runtime, where the data already lives, and who operates the agent on day ninety, with the cost shapes, governance asymmetries and interop paths verified against Microsoft's own documentation.
Microsoft Foundry is no longer a place to call models — it is a platform for hosting, grounding, governing and operating agents. A working architecture guide to prompt and hosted agents, Foundry IQ, Toolbox, MCP and A2A, model choice and Claude, agent identity and RBAC, private networking, evaluation and Agent 365 — with every capability marked GA, Preview or retiring, and the places Microsoft's own documentation contradicts itself named rather than smoothed over.
A research-grounded enterprise reference architecture for autonomous AI agents: agent identity, task-bound authorization, tool and MCP gateways, memory security, runtime containment, observability, and incident response — with an OWASP agentic Top 10 mapping, a bounded-autonomy model, and a 38-control matrix.
Architecture documents die in slide decks. This one is a clickable package: fifteen linked views, an asset-mapped control catalog, ADRs, a risk register, and a phased runbook — all driven by one canonical model you can explore in the browser.
Governance earns its keep when it speeds decisions up, not when it slows them down. A working model for architecture governance inside large infrastructure programs.
AI services are entering organizations through every door at once. Treating them as enterprise platforms — with identity, data boundaries, logging, and governance — is the difference between adoption and exposure.
Zero Trust fails when it is treated as a shopping list. A durable design starts from identity, device health, and explicit policy — and earns its rollout with evidence.
Landing zone security is mostly decided before the first workload arrives. The guardrails, identity boundaries, and logging defaults that matter — and the ones that just add friction.
Can agentic AI actually run security operations? The interesting problem is not the triage decision — it is everything around it: authority, tenant isolation, evidence, approval, and audit. This is the full target architecture, published as something you can click through.
Microsoft's AI portfolio is not five versions of the same product — it is a layered enterprise architecture with an experience layer, two build platforms, a control plane, and the identity, data and threat controls underneath. A practical architecture guide to what each platform is for, which workloads belong where, how agent identity and authority actually flow, and what has to be true before an organization scales any of it.
A field-tested strategy for moving a VMware estate to Azure without pretending lift-and-shift is easy: how to run the provider evaluation, design waves around downtime tolerance, protect data integrity, plan a rollback you can actually execute, and validate the result — in a regulated, always-on environment.