This week in Azure

John called it a really quick update, and on the video side it was. The feed tells a different story: the week of July 15th carried one of the larger Microsoft Agent Framework drops of the year, and it went past most people because it landed as seven separate announcements rather than one.

Three items are worth your time. Entra passkeys become the default from September and SMS drops off entirely in February 2027, which is a tenant-wide deadline rather than a feature. Front Door edge actions put JavaScript into the request path, changing what you can do without touching your origin. And advanced platform metrics finally give Storage the telemetry depth it has been missing.

Networking

Azure Front Door edge actions (preview)

Azure Front Door edge actions bring serverless compute to the edge. You write lightweight JavaScript that executes during Front Door request processing, so decisions happen close to the user instead of at your origin.

The scenarios are the obvious ones: A/B testing and canary routing, header manipulation, request filtering, dynamic origin selection, URL rewrites, authentication at the edge. Edge actions sit alongside the rules engine, caching, routing and WAF rather than replacing them.

The implementation detail is the interesting part. Edge actions run on Hyperlight, Microsoft’s micro-VM technology, so customer code gets hardware-backed isolation rather than a shared JavaScript sandbox. That is a meaningfully stronger boundary than the usual isolate-per-tenant model, and it is the same technology showing up in the Agent Framework work below.

If you have been carrying an origin-side service purely to rewrite headers or route by cookie, this is the week to look at deleting it.

Observability

Advanced platform metrics in Azure Monitor (preview)

Advanced platform metrics went to public preview on July 15th, 2026, adding telemetry beyond the standard platform metric set. Azure Storage is the first service on board.

The concrete change: blob metrics were only ever visible at the storage account level, so “why is this account so large” had no answer beyond the total. You now get capacity and blob count per container. That is the difference between knowing you have a problem and knowing where it is.

Two caveats. You enable it per storage account, not tenant-wide, because it costs money — the pricing scales with the dimensions of the service, which for blob means tiers and object counts, so read the calculation in the docs before switching it on across an estate. And it is preview, so evaluate rather than build alerting on it. More services and metrics onboard over time.

Database

Azure Arc SQL migration to SQL Server on Azure VMs (GA)

The Azure Arc migration solution now accepts SQL Server on Azure Virtual Machines as a migration target. Arc-enabled SQL Server instances can move to either Azure SQL Managed Instance or SQL Server on Azure infrastructure through the same workflow.

Small announcement, real consequence. Lift-and-shift to a VM was previously outside the unified Arc migration path, which pushed a lot of estates into a separate toolchain for the subset of databases that could not take a PaaS target. One workflow now covers both.

It is a guided online migration built on log shipping, so the cutover window is minutes rather than a maintenance weekend, and the source can be anything Arc-enabled — on-premises or another cloud.

Azure Databricks SQL Serverless in UK West (GA)

Databricks SQL Serverless is available in UK West as of July 13th, 2026. Eligible workspaces get Serverless preselected when creating new SQL warehouses; Classic and Pro remain available.

Regional item, but worth noting if you are placing analytics workloads under UK data residency requirements. Check workspace eligibility before you plan around it — not every workspace has Serverless enabled by default.

Azure SQL: VS Code extension updates (preview)

Mid-July brought two changes to the MSSQL extension for VS Code. Keyboard shortcuts for Quick Queries, the Results Grid and the Query Editor are now configurable in-editor. The new Results Grid adds column freeze, hide and show, plus reworked state management for responsiveness.

Enable the Beta Results Grid in MSSQL Settings if you want it. Minor quality-of-life work, but this extension is where a lot of day-to-day query work actually happens.

AI

Microsoft Agent Framework: a large week

Seven announcements landed on July 15th, and together they are more significant than any single item in the video. The headline pieces:

  • Multi-agent orchestration patterns, including Magentic, with a matching orchestration SDK for C#
  • Agent Harness for running and evaluating agents
  • Tracing for Python and .NET, wired into the standard observability path
  • CodeAct pattern and Hyperlight containers, so generated code executes inside a micro-VM boundary rather than a process sandbox
  • Episodic procedural memory, giving agents recall across runs
  • DevUI Agent Inspector for looking inside an agent’s execution

Read that list as one thing rather than seven. Orchestration, evaluation, tracing, sandboxed execution and memory are exactly the pieces you have to build yourself before an agent goes anywhere near production. Microsoft shipping them as framework primitives is the difference between a demo and something you can put a change-approval process around.

The Hyperlight detail matters most. If an agent writes and runs code, the isolation boundary is the security model. A micro-VM per execution is a defensible answer to “what stops the generated code touching something else”. A process sandbox is not.

Identity

Passkeys become the default, SMS and voice are retired

This is the one with a date on it, and it applies to every tenant.

From September 1st, 2026, Microsoft begins rolling out passkeys as the default authentication experience in Entra ID. As the rollout reaches your tenant, users enabled for SMS or voice are automatically enabled for passkeys, and the next time they perform MFA they are prompted to register one.

From February 1st, 2027, Microsoft-provided telecom delivery for SMS and voice is retired. Tenants that have not configured a customer-managed telecom provider through the Microsoft Security Store can no longer use SMS or voice for MFA at all. Users whose only method is SMS or voice have to register a passkey during sign-in before they can get in.

There is a temporary opt-out for the September window so you can finish a migration. There is no opt-out for the February 2027 enforcement.

Why Microsoft is pushing this rather than asking: a passkey is phishing-resistant in a way an SMS code is not. It requires proximity between the authenticator and the device you are signing in to — NFC, Bluetooth or a plugged-in key — so you cannot be talked into approving a sign-in happening on someone else’s machine. And the credential is bound to the domain, so a lookalike site is never offered the passkey in the first place. SMS fails both tests.

Treat the September date as the real one. February is when it breaks; September is when you find out which users, service accounts and break-glass paths still depend on a phone number. Run that inventory now, while the temporary opt-out still exists as a safety net.

Final thoughts

Start with the passkey timeline, because it is the only item here with a date that bites. Pull the list of users whose only strong authentication method is SMS or voice, and find the service accounts and break-glass paths that quietly depend on a phone number. September is the warning; February 2027 is the wall, and there is no opt-out from that one.

Front Door edge actions is the one to try this week. Not because you need edge compute, but because most teams have accumulated an origin-side component that exists purely to manipulate requests. Look at what that component does and check whether thirty lines of JavaScript at the edge replaces it. Preview, so prototype rather than deploy.

The Agent Framework wave deserves an afternoon if you are building anything agentic. Specifically: swap your hand-rolled tracing for the built-in tracing, and look hard at whether your code-execution path has a real isolation boundary or just a well-intentioned one.

And if you run SQL Server estates on Arc, the VM migration target closes the gap that forced a second toolchain. Re-scope the migration plan you shelved.

Sources

  1. John Savill, “Azure Update 17th July 2026,” YouTube, https://www.youtube.com/watch?v=bemRBrJnYvA
  2. “Azure Front Door edge actions,” Microsoft Learn, https://learn.microsoft.com/azure/frontdoor/edge-actions
  3. “Advanced platform metrics in Azure Monitor,” Microsoft Community Hub, https://techcommunity.microsoft.com/blog/azureobservabilityblog/public-preview-advanced-platform-metrics-in-azure-monitor/4536983
  4. “Advanced platform metrics for Azure Blob Storage,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/storage/blobs/blob-storage-advanced-platform-metrics
  5. “Serverless compute for Databricks SQL,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/databricks/admin/sql/serverless
  6. “Microsoft Agent Framework,” Microsoft Learn, https://learn.microsoft.com/en-us/agent-framework/overview/
  7. “Agent observability and tracing,” Microsoft Learn, https://learn.microsoft.com/en-us/agent-framework/agents/observability
  8. Microsoft, “agent-framework,” GitHub, https://github.com/microsoft/agent-framework
  9. “Passkeys by default and retirement of Microsoft-provided SMS and voice authentication,” Microsoft Learn, https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
  10. “FAQ for Microsoft-provided SMS and voice retirement,” Microsoft Learn, https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq
  11. “Passkeys are the default authentication method in Entra ID,” Microsoft Security Blog, https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/