In an era where seamless network management and enhanced performance are paramount, the release of Network ATC, Network HUD, and AccelNet for Windows Server 2025 marks a significant milestone. These groundbreaking innovations are designed to optimize the way we manage, monitor, and accelerate network operations, promising unprecedented efficiency and reliability.

Network ATC

Historically, deployment and management of networking for Failover clusters has been complex and error prone. The configuration flexibility with the host networking stack means there are many moving parts that can be easily misconfigured or overlooked. Keeping up with the latest best practices is also a challenge as improvements are continuously made to the underlying technologies. Additionally, configuration consistency across failover cluster nodes is vital for reliability.

Network ATC simplifies the deployment and network configuration management for Windows Server 2025 clusters. It provides an intent-based approach to host network deployment. Customers specify one or more intents (management, compute, or storage) for a network adapter, and we automate the deployment of the intended configuration.

Network ATC helps to:

• Reduce host networking deployment time, complexity, and errors
• Deploy the latest Microsoft-validated and supported best practices
• Ensure configuration consistency across the cluster
• Eliminate configuration drift

One of the greatest benefits of Network ATC is its ability to remediate configuration drift. Have you ever wondered “who changed that?” or said, “we must have missed this node.” You’ll never worry about this again with Network ATC at the helm. Expanding the cluster to add new nodes? Simply install the feature on the new node, join the cluster and within minutes, the expected configuration will be deployed.

For more details about deploying and managing Network ATC on Windows Server 2025, please check here: Deploy host networking with Network ATC. You can manage Network ATC through Powershell cmdlets or Windows Admin Center.

Figure: Network ATC management in Windows Admin Center

Network HUD (Coming Soon)

Network HUD is an upcoming Windows Server 2025 feature that will proactively identifies and remediates operational network issues.

Managing a network for business applications is challenging. Ensuring stability and optimization requires coordination across the physical network (switches, cabling, NICs), host operating system (virtual switches, virtual NICs), and the applications running in VMs or containers. Each component has its own configurations and capabilities, often managed by different teams. Even with a perfect setup, a bad configuration elsewhere in the network can degrade performance.

The complexity of managing these components has reached an all-time high, with numerous tools and technologies involved. Windows Server OS provides a wealth of information through event logs, performance counters, and tools, but analyzing this data when issues arise requires expertise and time, often after the problem has occurred.

Network HUD excels by analyzing real-time data from event logs, performance counters, tools like Pktmon, network traffic, and physical devices to identify issues before they happen. In many cases, it prevents issues by adjusting your system to avoid exacerbating problems. When prevention isn’t possible, Network HUD alerts you with actionable messages to resolve the issue.

Network HUD leverages capabilities in the physical switch to ensure that your configuration matches the physical network. For example, it can determine whether the locally connected switchports have the correct VLAN settings and the correct data center bridging configuration required for RDMA storage traffic to function.

Network HUD is built as a true cloud service that runs on-premises. It will ship as an Arc extension and will be part of Windows Server Azure Arc Management (WSAAM) services. This allows us to bring in more capabilities and make these available to you as soon as they are ready.

AccelNet

Accelerated Networking simplifies the management of single root I/O virtualization (SR-IOV) for virtual machines hosted on Windows Server 2025 clusters. SR-IOV provides a high-performance data path that bypasses the host, which reduces latency, jitter, and CPU utilization for the most demanding network workloads. This is particularly useful in High Performance Computing (HPC) environments, Real-time applications such as financial trading platforms, and virtualized network functions.  

The following figure illustrates how two VMs communicate with and without SR-IOV.

Without SR-IOV, all networking traffic in and out of the VM traverses the host and the virtual switch. With SR-IOV, network traffic that arrives at VM’s network interface (NIC) is forwarded directly to VM.

SR-IOV has been available in Windows Server since 2012 R2 days. So, what benefit does AccelNet provide?

1. Prerequisite checking: Informs users if the Windows Server cluster hosts support SR-IOV, checking for OS version and hyperthreading status among other things.
2. Host Configuration: Ensures SR-IOV is enabled on the correct vSwitch that hosts virtual machine workloads and allows configuration of reserve nodes in case of failover to prevent resource over-subscription.
3. Simplified VM performance settings: It can be overwhelming to identify how many queue pairs may be needed for a VM that is being enabled through SR-IOV. AccelNet abstracts performance settings into “Low,” “Medium,” and “High” to simplify configuration.
4. Health Monitoring and Diagnostics: Leverages Network HUD to identify and remediate configuration/performance related issues. Examples include NIC SR-IOV support, Live migration management, etc. (Coming Soon)
5. Simplified management with Windows Admin Center: All AccelNet management functionality is available through Powershell and with an easy-to-use UI through Windows Admin Center (Latter coming Soon).

AccelNet is part of Windows Server Azure Arc Management (WSAAM) services. To learn more about Accelnet, please check here.

As organizations continue to navigate the challenges of an ever-evolving digital landscape, the integration of these advanced features into Windows Server 2025 ensures they are equipped with the tools needed to achieve excellence in network management and performance. Embrace the future of networking with Windows Server 2025 and experience the transformative power of Network ATC, Network HUD, and AccelNet.

We are excited to share all these innovations with you. Upgrade to Windows Server 2025 to try out these features, we look forward to your feedback. For any suggestions, opinions or issues, please reach out to us at edgenetfeedback@microsoft.com.

​Microsoft Tech Community – Latest Blogs –Read More 

Is there an option to embed the Viva insight’s Praise in SharePoint site? Currently there is only limited options like conversation, community etc that you can add in SharePoint but how to add the Viva Praise option? So that the Praise is visible in the Intra-SharePoint site for all to see basically who praised who for what.

​Is there an option to embed the Viva insight’s Praise in SharePoint site? Currently there is only limited options like conversation, community etc that you can add in SharePoint but how to add the Viva Praise option? So that the Praise is visible in the Intra-SharePoint site for all to see basically who praised who for what.  Read More

​

جـلب الـحبيب بالخضوع (010.40.581.277 002 -) شيـخ روحانـي متمـكن

​جـلب الـحبيب بالخضوع (010.40.581.277 002 -) شيـخ روحانـي متمـكن  Read More

​

I have a list with a lookup column. The lookup column brings back the ID from the linked list. I can use the list tools to sort the list by this column into descending order and use the group by option and it works fine (see below). But if I save this view it reverts the sort order to ascending. Anyone have any idea how to resolve this?

​I have a list with a lookup column. The lookup column brings back the ID from the linked list. I can use the list tools to sort the list by this column into descending order and use the group by option and it works fine (see below). But if I save this view it reverts the sort order to ascending. Anyone have any idea how to resolve this?    Read More

​

Microsoft Defender XDR Monthly news November 2024 Edition
This is our monthly “What’s new” blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from October 2024.  Defender for Cloud has it’s own Monthly News post, have a look at their blog space.
Legend: Product videos Webcast (recordings) Docs on Microsoft Blogs on Microsoft GitHub External Improvements Previews / Announcements

Unified Security Operations Platform: Microsoft Defender XDR & Microsoft Sentinel

(Preview) In advanced hunting, Microsoft Defender portal users can now use the arg() operator for Azure Resource Graph queries to search over Azure resources. You no longer need to go to Log Analytics in Microsoft Sentinel to use this operator if you are already in Microsoft Defender. Learn more on our docs. Microsoft Unified RBAC roles are added with new permission levels for Microsoft Threat Experts customers to use Ask Defender experts capability. Demystify potential data leaks with Insider Risk Management insights in Defender XDR. Microsoft Purview Insider Risk Management adds significant value by identifying and mitigating potential insider risks — such as data leaks or intellectual property theft, covering key scenarios including detecting unusual employee behavior, managing data exfiltration risks from insiders performing riskier activities, and differentiating between external and internal attacks. This blogs details how the integration into Defender XDR empowers SOC teams to detect and respond more effectively to insider threats, enabling them to better distinguish between external and internal attacks We published an updated version of the short training video “How to use the Alert page“. Watch these 3:40 minutes to get the most out of the alert page during your investigations. New filter option on the Ninja Show page. You can now filter all our session on-demand by products to easier find relevant content for you.

Microsoft Sentinel (Preview) Use matching analytics to detect threats. Take advantage of threat intelligence produced by Microsoft to generate high-fidelity alerts and incidents with the Microsoft Defender Threat Intelligence Analytics rule. This built-in rule in Microsoft Sentinel matches indicators with Common Event Format (CEF) logs, Windows DNS events with domain and IPv4 threat indicators, syslog data, and more. Learn more on our docs. Introducing the Use Cases Mapper workbook. Read this blog to see how Use Case Mapper Workbook is an invaluable tool for identifying gaps in your Sentinel environment and the established Content-Hub-Solutions Level Up Your Security Skills with the New Microsoft Sentinel Ninja Training! The Microsoft Sentinel Ninja Training has been completely updated, and the individual knowledge checks will now point to official MS Learning path so you can earn the official badge after completing successfully.   Save money on your Sentinel ingestion costs with Data Collection Rules. This blog post outlines a strategy you can use to reduce your data volume while also collecting and retaining the information that really matters.  Cowrie honeypot and its integration with Microsoft Sentinel. Cowrie is an advanced honeypot designed to emulate SSH (Secure Shell) and Telnet services to attract, detect, and analyze malicious activities. Learn in this blog post how this cybersecurity tool is used, how possible attackers activities are logged, and providing valuable insights into their methods and motives. Deploy Microsoft Sentinel using Bicep. This blog post walks you through the deployment process of Microsoft Sentinel using Bicep. Webinars We have the following two upcoming webinars: Data Tiering Best Practices (Oct 29 2024, 09:00 AM – 10:00 AM (PT)) Mastering API Integration with Sentinel & Unified Security Platform (Dec 5 2024, 09:00 AM – 10:00 AM (PDT)) Last month, these two webinars have been presented and the recordings are now available: Deep Dive: Moving from the Log Analytics Agent to the New Azure Monitor Agent Building Microsoft Sentinel integrations – Part 2: Creating data connectors

Microsoft Defender Vulnerability Management Guidance for handling CUPS remote code execution vulnerability using Microsoft Security capabilities. In this blogpost we will demonstrate how you can easily discover if your organization is vulnerable to this critical unauthenticated RCE flaws in CUPS printing systems and view guidelines on remediation.  Microsoft Security Exposure Management Ninja Show: In this 2 episodes, we explore Microsoft Security Exposure Management, learning how it quantifies risks, generates reports for key stakeholders, unifies the security stack, and optimizes attack surface management. Watch the recordings of Part 1 and Part 2. Microsoft Security Experts Phish, Click, Breach: Hunting for a Sophisticated Cyber Attack. Since April 2024, we have observed a significant increase in Teams phishing attacks, which have led to endpoint-related incidents, particularly through the abuse of Remote Monitoring and Management (RMM) tools such as Quick Assist (Ref : Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft …), and other tools such as Any Desk, and Team Viewer. In this blog, we will walk through one of the observed scenarios and discuss hunting approaches for detecting such attacks.   Microsoft Unified RBAC roles are added with new permission levels for Microsoft Threat Experts customers to use Ask Defender experts capability. Learn more on our docs. Microsoft Defender for Cloud Apps We released various new data in advanced hunting via the CloudAppEvents table – Anomaly data – Conditional Access app control / inline data – OAuthAppId We published a new short training video (6 minutes) for App Governance.  Threat actors are using non-human app identities as an attack vector and unfortunately this isn’t as well understood as it should be. Customers who own Defender for Cloud Apps can turn on app governance with a few simple clicks and light up powerful capabilities. Microsoft Defender for Office 365 Use community queries to hunt more effectively across email and collaboration threats. One of the most valuable and insightful resources within advanced hunting is the community queries feature. This collaborative repository can enhance your threat-hunting capabilities, streamline investigation processes, and empower your security operations center (SOC) team members with easily accessible shared knowledge. Check out this blog to learn about the benefits of using community queries. Tenant Allow/Block List in Microsoft 365 now supports IPv6 address. Learn more on our docs. Watch this short4 minutes training video on “How to investigate email messages in Microsoft Defender for Office 365″.  Ninja Show episode: In-depth defense with dual-use scenario: We are joined by Senior Product Manager Manfred Fischer and Cloud Solution Architect Dominik Hoefling to explore the built-in protection mechanisms in Defender for Office 365. Tune into this episode as we dive deep into a dual-use scenario demonstration to learn how customers using third-party email filtering services can still leverage the powerful features and controls of Defender for Office 365. Bulk Sender Insights in Microsoft Defender for Office 365: In this episode, Senior Product Manager Puneeth Kuthati explains the importance of bulk sender insights within Defender for Office 365. Discover how these insights help differentiate trustworthy bulk senders from potential threats, tackle the challenges of fine-tuning bulk email filters, and strike the right balance to ensure important emails reach your inbox without overwhelming it. By analyzing sender behavior and trends, organizations can strengthen email security, reduce unwanted bulk traffic, and minimize false positives. Microsoft Defender for Endpoint Troubleshoot Network Extension (NetExt) issues in Defender for Endpoint on Mac. Learn more on our documentation. Microsoft Defender for Identity (Preview) Defender for Identity is expanding coverage with new 10 Identity posture recommendations. Read the details on our documentation to learn how these new recommendations can help you improve your posture.  Copilot Identity Summary released to Public Preview. Read this blog to see how Copilot for Security can simplify SOC teams’ investigation with the new Identity Summary feature within Defender XDR. Copilot for Security Identity Summary (Preview) Sensor management (add, remove, list …) through new public API. Check out our documentation to learn more about this API. Microsoft Security Blog File hosting services misused for identity phishing.  New macOS vulnerability, “HM Surf”, could lead to unauthorized data access.

​Microsoft Tech Community – Latest Blogs –Read More 

In this blog, we are going to discuss about an automated approach to configure total retention period for log analytics workspace tables. Before we delve into the solution, let’s understand more about the retention options for log analytics tables. 

A Log Analytics workspace retains data in two states: 

• Interactive retention: In this state, data is available for monitoring, troubleshooting, and near-real-time analytics. 
• Long-term retention: In this low-cost state, data isn’t available for table plan features, but can be accessed through search jobs. 

By default, all tables in a Log Analytics workspace retain data for 30 days, except for log tables with 90-day default retention. The interactive retention can be extended up to 730 days (2 years). During this period, you can retrieve the data from the table through queries, and the data is available for visualizations, alerts, and other features and services, based on the table plan. 

After the interactive retention period, the data remains in the table for the remainder of the total retention period you configure provided you’ve configured archive tier for the log analytics table. You can configure total retention to up to 12 years which includes interactive retention and archive period. 

During the long-term retention period you can run a search job to retrieve the specific data you need from the table and make it available for interactive queries in a search results table. 

To restore archived log data in Microsoft Sentinel, specify the table and time range for the data you want to restore. Typically, within a few minutes, the log data is available within the Log Analytics workspace. Then you can use the data in high-performance queries that support full Kusto Query Language (KQL). Please refer our public documentation for restoring archived data for more details. 

I would recommend reviewing our public documentation on restore job in Azure Monitor to get more information on limitations and pricing model for executing restore operation. 

Note: My focus would be on providing a scalable approach to set total retention period for tables in log analytics workspace. 

Let’s understand why a scalable approach to set total retention period is important 

There might be several tables where you might want to set total retention period to x days, one way to implement this change is by manually changing the total retention period for each and every table.  

Log Analytics Workspace > Settings > Tables > Choose the table of your interest > Manage Table and set the retention as shown below. 

As you can see, we’re setting total retention period of 220 days here which means data will be available for interactive retention for 90 days (retention configuration at my workspace level) and in archive tier for 130 days. 

As we understand, this is a manual approach, and you might end up spending quite some time configuring it for multiple tables in the log analytics workspace. 

For automate this process, I’ve created a PowerShell script which can update the total retention period for multiple tables (comma separated) at once. Script is hosted in my GitHub repository: LogAnalyticsTableMgmt/SetTableRetentionAtScale_v1.3.ps1 at main · Abhishek-Sharan/LogAnalyticsTableMgmt  

Note: We highly recommend you should review the PowerShell script thoroughly and do proper testing before executing it in production. We don’t take any responsibility for the script. 

Posting the PowerShell script here as well 

$disclaimer = @"
**Disclaimer:**
The author of this script provides it "as is" without any guarantees or warranties of any kind. 
By using this script, you acknowledge that you are solely responsible for any damage, data loss, or other issues that may arise from its execution. 
It is your responsibility to thoroughly test the script in a controlled environment before deploying it in a production setting. 
The author will not be held liable for any consequences resulting from the use of this script. Use at your own risk.
"@

Write-Host $disclaimer

# Function to set retention for a Log Analytics table
function Set-LogAnalyticsRetention {
    param (
        [string]$ResourceGroupName,
        [string]$WorkspaceName,
        [string]$TableName,
        [int]$TotalRetentionInDays
    )

    # Check if the resource group exists
    $resourceGroup = Get-AzResourceGroup -Name $ResourceGroupName -ErrorAction SilentlyContinue
    if (-not $resourceGroup) {
        Write-Error "Resource Group '$ResourceGroupName' does not exist."
        exit 1
    }

    # Check if the workspace exists
    $workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName $ResourceGroupName -Name $WorkspaceName -ErrorAction SilentlyContinue
    if (-not $workspace) {
        Write-Error "Workspace '$WorkspaceName' does not exist in Resource Group '$ResourceGroupName'."
        exit 1
    }

    # Check if the table exists
    $table = Get-AzOperationalInsightsTable -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -TableName $TableName -ErrorAction SilentlyContinue
    if (-not $table) {
        Write-Error "Table '$TableName' does not exist in Workspace '$WorkspaceName'."
        return $false
    }

    # Update the retention period
    Update-AzOperationalInsightsTable -ResourceGroupName $ResourceGroupName -WorkspaceName $WorkspaceName -TableName $TableName -TotalRetentionInDays $TotalRetentionInDays
    return $true
}

# Prompt for user input
$resourceGroupName = Read-Host "Enter the Resource Group Name"
$workspaceName = Read-Host "Enter the Workspace Name"
# Prompt for multiple table names
$TableName = Read-Host "Enter the Table Names (comma-separated)"

# Split the table names into an array
$TableNameArray = $TableName -split ","

$TotalRetentionInDays = Read-Host "Enter the Total Retention Period in Days"

# Loop through each table name and set the retention period
foreach ($TableName in $TableNameArray) {
    $result = Set-LogAnalyticsRetention -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName -TableName $TableName.Trim() -TotalRetentionInDays $TotalRetentionInDays
    if ($result) {
        Write-Host "Retention period set successfully for table $TableName in workspace $workspaceName."
    } else {
        Write-Host "Failed to set retention period for table $TableName in workspace $workspaceName."
    }
}

Let’s see it in action now 

I hope you’ve downloaded the script locally at this point. This an interactive script and it will ask for following details: 

• Resource Group Name 

• Log Analytics Workspace Name 

• Name of tables separated by comma where total retention needs to be updated 

• Total retention period to set 

Login to Azure Portal and launch Azure Shell, upload the PowerShell script. 

Enter the details as shown below: 

Here we are setting total retention period to 250 days for 5 tables: 

• AADManagedIdentitySignInLogs 
• AADNonInteractiveUserSignInLogs 
• SecurityAlert 
• SecurityIncident 
• Usage 

Execute the script and the result will be something like this: 

 Here you can see that Total Retention Period for SecurityAlert table has been updated to 250 days. 

Let’s validate in the log analytics workspace blade 

To review the total retention period, go to Log Analytics Workspace > Settings > Tables 

As we can see, the total retention period for all 5 tables have been updated to 250 days.

Which also means that we’ve configured 90 days of interactive retention and 160 days of archive period (shown below) 

Reference Article: Manage data retention in a Log Analytics workspace – Azure Monitor | Microsoft Learn 

​Microsoft Tech Community – Latest Blogs –Read More 

In the timeline view, I would like to see the number of days each activity takes rather than the start and finish dates. How can I change that?

​In the timeline view, I would like to see the number of days each activity takes rather than the start and finish dates. How can I change that?  Read More

​

Hi, I’d need to send an adaptive card as notification to a Teams Channel, using channel email.

As Microsoft is deprecating Webhooks and my company doesn’t let me use workflow (as it’s not included in our plan) the only way I found to send notification to Teams channel is using channel own email.

I know I can use an html body with a dedicated script tag when sending an email to an Outlook client in order to send an adaptive card with it. But for what I tried this trick doesn’t work when sending email to a Teams channel.

Is there any other way to send an adaptive card to a Teams channel via email? Or is there any other way to do it apart from webhook or email?

The main reason for me to send an adaptive card is having a better formatting (I tried but several html tag are not recognized) and I’d like to keep the possibility to have mentions.

Thanks in advance

Regards

Marco

​Hi, I’d need to send an adaptive card as notification to a Teams Channel, using channel email.As Microsoft is deprecating Webhooks and my company doesn’t let me use workflow (as it’s not included in our plan) the only way I found to send notification to Teams channel is using channel own email.I know I can use an html body with a dedicated script tag when sending an email to an Outlook client in order to send an adaptive card with it. But for what I tried this trick doesn’t work when sending email to a Teams channel.Is there any other way to send an adaptive card to a Teams channel via email? Or is there any other way to do it apart from webhook or email?The main reason for me to send an adaptive card is having a better formatting (I tried but several html tag are not recognized) and I’d like to keep the possibility to have mentions.Thanks in advanceRegardsMarco  Read More

​

I’m the percentile function to calculate 20 and 80 percentiles from a list of data registered to a date. I need to work it out month by month. However when I drag my formula down it only goes down one row where I need it to go down to the next month. Is it possible to jump down 30 or so rows or is there another way of doing it?

​I’m the percentile function to calculate 20 and 80 percentiles from a list of data registered to a date. I need to work it out month by month. However when I drag my formula down it only goes down one row where I need it to go down to the next month. Is it possible to jump down 30 or so rows or is there another way of doing it?   Read More

​

We have successfully rolled out Sensitivity Labels across our organization. All users an admins subscribe to M365 E5

I would like create an alert email which fires when a Sensitivity Label is replaced with a lower-order label on any document or email.

The Activity Explorer logs in Purview show the labell applied, but events, but I am struggling to find a way to create an alert.

I tried using PowerAutomate, but unable to find a solution there.

Thanks

Dheeraj

​We have successfully rolled out Sensitivity Labels across our organization. All users an admins subscribe to M365 E5 I would like create an alert email which fires when a Sensitivity Label is replaced with a lower-order label on any document or email. The Activity Explorer logs in Purview show the labell applied, but events, but I am struggling to find a way to create an alert. I tried using PowerAutomate, but unable to find a solution there. ThanksDheeraj  Read More

​