By Andrew Mathu

Introduction

Vulnerabilities and zero-day exploits continue to be a serious threat to systems worldwide. One such vulnerability is CVE-2023-50164, a critical issue in Apache Struts that can lead to critical security breaches if not properly mitigated. Protecting your systems from such vulnerabilities is paramount to prevent unauthorized access and data loss. Azure Firewall Premium provides a robust solution to safeguard your infrastructure against such threats. This blog post will explore the CVE-2023-50164 vulnerability and demonstrate how Azure Firewall Premium can effectively prevent this attack.

Read the full post here: Azure Firewall Protection Against Apache Struts Vulnerability – CVE-2023-50164

​By Andrew Mathu
 
Introduction
 
Vulnerabilities and zero-day exploits continue to be a serious threat to systems worldwide. One such vulnerability is CVE-2023-50164, a critical issue in Apache Struts that can lead to critical security breaches if not properly mitigated. Protecting your systems from such vulnerabilities is paramount to prevent unauthorized access and data loss. Azure Firewall Premium provides a robust solution to safeguard your infrastructure against such threats. This blog post will explore the CVE-2023-50164 vulnerability and demonstrate how Azure Firewall Premium can effectively prevent this attack.
 

 
 
Read the full post here: Azure Firewall Protection Against Apache Struts Vulnerability – CVE-2023-50164  Read More

​

Mastering your AI adoption: Essentials to building, operating and optimizing genAI workloads on Azure

As the demand for scalable, efficient AI cloud solutions grows, many organizations are looking to be AI Ready. AI is not only a powerful tool for innovation and insights, but also a driver for cloud migration and modernization. Azure Essentials helps customers accelerate the reliability, security, and ongoing performance of AI and cloud investments. Whether you are new to AI or looking to scale your existing AI solutions, Azure Essentials offers comprehensive guidance and resources all in one place to help you succeed.

We recognize the distinct challenges and benefits of integrating AI with cloud infrastructure and are committed to delivering a comprehensive, expert-led experience including best practices and customized tools to guide you through the AI adoption journey.

Azure Essentials equips your team with an AI adoption blueprint

Becoming AI ready implies that an organization scale AI adoption. The guidance within Azure Essentials for AI outlines a strategy in three stages: establishing a solid foundation and readiness, correctly designing and incorporating governance into AI workloads, and managing and optimizing deployments. Within each of these stages we provide a comprehensive set of resources including detailed best practices, frameworks, and tools for ensuring reliability, security, performance and efficiency.

Stage 1: Establishing a solid foundation and readiness

Before embarking on AI development, it’s essential to assess your business needs and pinpoint where AI can deliver significant benefits. Use cases vary, from enhancing customer support to streamlining supply chain operations. It’s your decision to determine how to utilize genAI effectively both immediately and in the future. The genAI Readiness assessment helps you evaluate your strategy and AI adoption. By defining clear objectives, you can devise an AI strategy that complements your business goals. This stage guides you through five key considerations to start on the right foot:

Migration, Modernization, and Data Colocation: 75% of our customers who have adopted AI agree that migration was essential (source: The Total Economic Impact ™ Of Migration For AI-Readiness June 2024). Streamline AI adoption by migrating existing systems, modernizing applications to leverage cloud-native technology, and centralizing data. This approach ensures that your data is collocated with your AI model to ensure performance efficiency and reduce latency, and lays a scalable, efficient platform for AI innovation and insights. Evaluate your infrastructure and data to prioritize migration and modernization efforts.
FinOps Adoption: FinOps is a collaborative framework that brings together tech, finance, and business to maximize cloud investments. Using FinOps best practices allows you to align spending with business objectives, ensuring resource efficiency and resilient infrastructure, enabling scalable AI adoption with financial oversight.
Platform landing zone (Cloud Adoption Framework for Azure): A robust landing zone is key for AI adoption, ensuring governance, management, and security policies are uniformly applied. It enables reliable, automated environment deployment, tested by thousands of customers, facilitating AI adoption at scale. The platform landing zone offers accelerators for easy implementation and customization options via Azure Portal, Azure Command Line Interface or PowerShell. Once the platform landing zone is deployed, tailored application landing zones that support Azure AI services can take advantage of shared services, such as identity management, cost controls, logging, and networking.
Purchasing and pricing: Azure offers a comprehensive suite of tools for effective AI cost management, with options for both pay-as-you-go (PAYG) and pre-purchasing provisioning throughput units (PTU). The capacity calculator in Azure AI Studio aids in estimating and forecasting PTU usage, while the Pricing Calculator and Total Cost of Ownership (TCO) Calculator help estimate upfront and long-term costs. Microsoft Cost Management provides detailed insights into spending patterns, and Azure Advisor offers personalized recommendations for optimizing resource allocation and cost savings.
AI Skilling: Microsoft Learn AI Hub offers a wide range of AI learning materials suitable for all levels. Beginners can explore Azure AI Fundamentals and the Azure OpenAI Service module, while advanced learners can delve into AI solution design, computer vision, and conversational AI. The hub provides interactive exercises and assessments for hands-on learning and skill verification.

Stage 2: Correctly designing and incorporating governance into AI workloads

After laying the groundwork, it’s time to roll up your sleeves and start constructing your AI solutions.  This stage  is focused on Designing and Governing your AI projects, and consists of five key considerations:

Responsible AI: Microsoft prioritizes human-centered AI development, grounded in our six AI principles for creating responsible AI solutions. Explore our AI principles and approach,  then utilize our tools and practices for deeper AI system insights and monitoring, such as the Human-AI eXperience (HAX) toolkit that provides a comprehensive set of tools for ensuring safe, inclusive and ethical human-to-AI interaction. You can become more familiar with Responsible genAI by taking this online course.
 Safeguard generative AI applications and human-generated content: Azure AI Content Safety enables users to detect risks and harms, customize severity scores, set thresholds, content filters. Furthermore, it offers generative AI guardrails to detect and mitigates potential risks and quality issues – prompt injection attacks, hallucinations, and copyrighted materials – promoting responsible AI application development. Azure AI Content Safety is on by default in Azure OpenAI Service and foundation models in the model catalog, offering customers robust protection against harmful content. Users can also utilize it independently as an API, enhancing the content safety of user-generated content across various applications. For more thorough introduction to Azure AI Content Safety, consult the FAQ.
Data governance, security, privacy and compliance: Microsoft Purview enables data governance, security, privacy and compliance with your AI adoption strategy. There are also a host of other solutions to leverage: Azure Information Protection for data classification and protection, Microsoft Entra ID for identity management, and Azure Key Vault for secure key management. Enforce resource compliance with Azure Policy, monitor and audit AI systems using Azure Monitor. Regularly train staff on best practices, and continuously assess risks and adapt your strategy to maintain a secure, private and compliant AI environment.
Azure Well-Architected Reference Architectures and Patterns: The baseline architecture for private chatbots in Azure Architecture Center leverages the Azure Well-Architected Framework, ensuring optimized, reliable, and secure AI workloads. The designed architecture influences the application landing zone and its accelerator, inheriting organizational policies while maintaining workload-specific flexibility. Along with the baseline architecture, consider leveraging these best practices for developing workloads Retrieval Augmented Generation (RAG pattern to increase system performance and quality of the responses.
LLMOps: Large Language Model Operations (LLMOps) manage the lifecycle of large language models, addressing size, computational needs, and performance. LLMOps streamlines workflows for reliability, evaluating and improving output quality and safety, and cost-effectiveness, enhancing the value of AI investments. An assessment is available to check your adherence to LLMOps best practices. For more information about LLMOps, see this great post by Vishnu Pamula.

The second stage and its various activities all come together in Azure AI Studio, a comprehensive platform designed to help developers build, evaluate, and deploy generative AI solutions and custom copilots. It offers a range of tools and features to streamline the development process, including:

Prebuilt and customizable models: Use existing models or tailor them to your specific needs.
Generative AI tools: Fine-tune models, orchestrate prompts, and evaluate app performance.
Responsible AI technologies: Implement content filters, controls, and best practices to ensure ethical AI use.
Deployment and scaling: Easily deploy AI solutions in websites and applications, and monitor their performance continuously.

To start using Azure AI Studio’s tools and resources, please see the product page.

Stage 3: Managing and optimizing deployments

As your AI adoption progresses and scales, it’s essential to continuously enhance and refine your workloads. The third stage of our Azure Essentials AI adoption guidance focuses on Managing and Optimizing your deployments, concentrated on 3 key considerations:

Monitoring and Security: To optimize and secure your AI solutions on Azure, continuously monitor and enhance their performance and cost-efficiency using ongoing evaluations and monitoring for generative AI deployments, Azure Monitor for infrastructure health insights, and Microsoft Cost Management to track and control spending.  Protect your application data with Microsoft Defender for Cloud against threats. And ensure resilience by regularly updating AI workloads and employing Azure Chaos Studio for stress testing. These practices are vital for maintaining secure, reliable, and efficient AI operations on Azure.
Management and optimization: Once your AI solutions are deployed, continuously monitor and optimize them using Azure’s suite of tools. Benchmarking of Azure OpenAI Service endpoints is an important step in understanding the performance of your deployments and helping to select the best deployment approach. While Microsoft Cost Managements tracks and controls spending, Azure Advisor offers personalized recommendations for optimizing resource allocation and performance for a given workload. By actively managing and refining your AI workloads with Azure Advisor, you ensure ongoing efficiency, cost-effectiveness, and adaptability to evolving business needs.
Architectural assessment and remediations: ongoing processes are recommended to enhance AI workloads post-deployment. They involve integrating the latest Azure AI services and LLMs, adhering to new policies, and applying optimization features for security and efficiency. Microsoft provides various tools and solutions for continuous workload assessment and improvement recommendations. Use the Well-Architected Review to assess your deployed workloads.

We’re here to assist your AI journey succeed

Determine how ready your organization is to scale AI adoption with the Technical Assessment for Generative AI in Azure. This comprehensive assessment evaluates your AI preparedness for projects of all sizes, providing you with pragmatic recommendations based on your specific needs.

If you have an AI project in mind, and you’d like expert assistance, consider leveraging one of our advanced specialized partners with Microsoft’s Azure Innovate offering. Or if you’re looking to migrate workloads to adopt AI at scale, consider leveraging Microsoft’s Azure Migrate and Modernize offering.

If you have a Microsoft Unified Support agreement in place, you can get personalized assistance by contacting your Microsoft Customer Success Account Manager (CSAM), who can help you maximize the benefits of Azure for your AI initiatives.

Review the Azure Essentials official website for additional information.

Check out the following resources to explore further:

Establishing a solid foundation and readiness:

Migration resources: Build a business case for migrating to innovate with AI | Azure Migrate Overview | Migration tools | Migration FAQ

Landing Zone Resources: Landing Zone deployment options | ISV considerations | Get landing zone help | Landing zone FAQ

FinOps Resources: Cost optimization of AI workloads | How to forecast AI services costs in cloud | FinOps Framework | FinOps Review

Pricing Resources: Azure Pricing Calculator | PTU Reservations Blog | Azure OpenAI sizing tool | Pricing Blog

Skilling Resources: Azure AI Fundamentals | Azure AI Engineer Associate | Azure Data Scientist Associate | Transform your business with Microsoft AI

Correctly designing and incorporating governance into AI workloads:

Responsible AI principles: Responsible AI Toolbox | Azure Confidential Computing | A general overview of responsible AI Tools and Practices | Blog: Tools for Responsible AI

Content Safety: Azure AI Content Safety | Learn how to build responsible AI | Responsible AI Impact Assessment | Azure AI Content Safety – Pricing

Data governance, security, and compliance: Introducing modern data governance for the era of AI | Best practice for data and AI governance | Unpacking AI governance to shape digital transformation

Architectural guidance: Baseline OpenAI end-to-end chat reference architecture | Access Azure OpenAI and other language models through a gateway | Azure OpenAI chat baseline architecture in an Azure landing zone

LLMOps: LLMops Assessment to determine your organization’s LLMOps maturity | LLMOps with prompt flow and GitHub | Designing and developing a RAG solution | Retrieval Augmented Generation using Azure Machine Learning prompt flow | Build apps with LLM Workshop

Managing and optimizing deployments:

Monitoring and security: Model monitoring for generative AI applications | Inference data collection from models in production | Shared Responsibility AI

Management and optimization: Optimizing Generative Applications on Azure Open AI | Monitoring with Azure OpenAI Studio | Service Benchmarking tool | Solution sizing tool | Resource utilization and efficiency with Microsoft Cost Management  | Understand and optimize costs w/ the Cost optimization workbook | Learn how to optimize for carbon using Azure carbon optimization

Architectural assessments & remediations:  An overview of Azure Advisor | Well-Architected Review – MLOps | Learn how to conduct and analyze results from groundedness tests | Leverage the GovViz Tool to keep Azure policies up to date

​Microsoft Tech Community – Latest Blogs –Read More 

By: Priya Ravichandran – Principal Product Manager | Microsoft Intune

A prerequisite to managing Android Enterprise devices with Microsoft Intune is that organizations must first complete a one-time onboarding process which requires admins to create and manage a consumer Gmail account. Starting in August 2024, this process will no longer require Gmail accounts. Instead, we’re happy to announce that admins will be able to use their existing Microsoft Entra credentials to complete this one-time onboarding.

Streamlined flow for new tenants

For tenants connecting or reconnecting your Microsoft Intune tenant to Managed Google Play, you can now use your Microsoft Entra credentials to complete the onboarding process. Let’s walk through the new flow.

As you work through the Prerequisites tab under Android enrollment, the new flow is invoked when you select “Launch Google to connect now”. At this point, a new tab is launched with the following screen. The Microsoft Entra credentials used to sign into the Microsoft Intune admin center will be pre-filled.

We recommend continuing with the prefilled identity and selecting the “Sign in with Microsoft” option that will follow.

Figure 1: Select “Sign in with Microsoft” to easily use your Entra ID identity.

The process may require email verification so if the identity or credentials used to sign in doesn’t have an email inbox, we recommend that you use a corporate email address with a mailbox to complete the onboarding. Once the onboarding flow is complete, you can add other Microsoft Intune administrators into the Google Admin console and grant them the right level of access to manage Google resources for your organization.

The Google Admin console wizard will guide you through the steps to create and set up your Google Admin account and allow Intune to manage your Android Enterprise devices.

Figure 2: To complete the account creation, you will need to select ‘Allow and create account’.

Figure 3: Once the account is created, you will need to allow Intune to manage the devices for a second time.

At this point, the step to connect your Microsoft tenant to Google is complete and you can start enrolling and managing Android Enterprise devices with Microsoft Intune.

Migration for current Intune tenants

For Microsoft Intune customers who have already onboarded using a Gmail account, no changes are required, and you will continue to be supported.

If you decide to disconnect your Android Enterprise administrative account and reconnect, you will now have the option of using this new flow.

Important note: Disconnecting your Android Enterprise account will remove all your Managed Google Play apps and all managed Android Enterprise devices from your tenant.

We’re working with Google to finalize a process to migrate from your Gmail account to your Microsoft Entra credentials in a way that won’t interrupt how these devices are managed. We expect this migration process to be defined in Q1CY25, and we’ll share more information closer to that date.

What is this new Google Account?

As you may have noticed, the onboarding flow creates a Google account using your corporate email address. Admins can use their Microsoft Entra credentials to log in and manage the connection between Google and Microsoft Intune, as well as other Google features. For more information, refer to How Android Enterprise connects your Google services (Google Blog).

What’s next

As you engage with this new experience, let us know in the comments below or by reaching out on X @IntuneSuppTeam if you have any questions or feedback so that we can work together to make this the best experience.

​Microsoft Tech Community – Latest Blogs –Read More 

I bought a used unit of Surface Book that doesn’t recognize itself as a Surface device. In the System Properties it identifies as “OEMCH Product”. It will not install drivers and has 18 unrecognized devices in Device Manager. One of them is the camera.

I tried to install the official driver pack but the installer will say this is not a Surface device.

I even tried to use a driver installer but that BSODed the Windows and I had to reinstall it.

I ran out of ideas, other than try to find individual drivers. Any help would be welcome.

​I bought a used unit of Surface Book that doesn’t recognize itself as a Surface device. In the System Properties it identifies as “OEMCH Product”. It will not install drivers and has 18 unrecognized devices in Device Manager. One of them is the camera. I tried to install the official driver pack but the installer will say this is not a Surface device.I even tried to use a driver installer but that BSODed the Windows and I had to reinstall it.I ran out of ideas, other than try to find individual drivers. Any help would be welcome.   Read More

​

We’re thrilled to share that the Mesh app on PC and Meta Quest now has simplified network setup and improved audio quality, enabled by transitioning spatial audio and avatar pose data in Mesh to use the same infrastructure as Microsoft Teams. 

As part of this, admins will no longer need to configure custom ports and endpoints to get started with Mesh. Instead, Mesh will align to the same set of network setup requirements as Teams and Azure Communication Services. You can find full details on this in our docs: Network setup requirements for the Mesh app. 

We know this has been a core need for many organizations to deploy Mesh at scale, and are looking forward to hearing about the scenarios this enables. Interested in getting started with Mesh? See Microsoft Mesh Adoption resources. 

Immersive experiences in Microsoft Mesh

Note: Immersive spaces in Teams will continue requiring custom network setup requirements until its respective infrastructure transition is completed in upcoming months. Read more in Managing immersive spaces in Teams. 

​ 
We’re thrilled to share that the Mesh app on PC and Meta Quest now has simplified network setup and improved audio quality, enabled by transitioning spatial audio and avatar pose data in Mesh to use the same infrastructure as Microsoft Teams. 
 
As part of this, admins will no longer need to configure custom ports and endpoints to get started with Mesh. Instead, Mesh will align to the same set of network setup requirements as Teams and Azure Communication Services. You can find full details on this in our docs: Network setup requirements for the Mesh app. 
 
We know this has been a core need for many organizations to deploy Mesh at scale, and are looking forward to hearing about the scenarios this enables. Interested in getting started with Mesh? See Microsoft Mesh Adoption resources. 
 
Immersive experiences in Microsoft Mesh
 
Note: Immersive spaces in Teams will continue requiring custom network setup requirements until its respective infrastructure transition is completed in upcoming months. Read more in Managing immersive spaces in Teams. 
   Read More

​