EduDataSci – Educating the world about data and leadership – Data Strategy from a one time K-12 data architect

Deploying Lovable Applications to Azure with Continuous Delivery

A team builds a useful application in Lovable. The workflow makes sense, the screens are good enough to put in front of users, and somebody asks when it can become an internal service. That is the point at which the conversation changes. The application needs an owner, a production identity, somewhere appropriate to run, and a way to release the next version without reconstructing the deployment by hand.

Azure App Service can provide that operating environment. Lovable can continue to provide the development experience. A Git repository connects them, giving the organization a place to review the generated code and decide which version becomes a release.

I have put together a reusable deployment starter for that arrangement. It includes infrastructure in Bicep, GitHub Actions workflows, a small deployment runtime, environment configuration, and an adoption guide. The design supports both the older React and Vite applications and the newer TanStack Start applications produced by Lovable. This article explains the choices in the package and walks through adopting it for an internal delivery-review application.

Azure and the Next Round of Enterprise Modernization

Azure’s September and October announcements point to a platform taking on more of the work of running the enterprise estate. This editorial examines what changed in compute, Kubernetes, networking, security and hybrid operations, and what that direction means for customers.

An application can be running perfectly well while the infrastructure beneath it becomes harder to expand, more expensive to retain, or more demanding to operate. That is a familiar enterprise problem, and it provides a useful way to read Azure’s announcements since the beginning of September. Microsoft is changing how customers plan the life of a virtual machine, where Kubernetes can run, and how much of the surrounding operational work the platform can absorb.

I see Azure becoming more deeply involved in the continuing operation of the enterprise estate. The latest developments extend its management model onto customer hardware while making the public cloud more capable of maintaining itself. This is a sensible direction for organizations with long-lived applications and mixed infrastructure. It also gives Microsoft a larger role in their architecture and spending decisions. The changes through October 17 make that direction much more concrete.

Modernization becomes a continuing obligation

The VM lifecycle policy published on September 28 establishes four stages: Current, Extended, End of Life and Retired. Current families are the preferred destination for new deployments. Extended families remain supported, with transition planning encouraged. End of Life means retirement has been announced, while maintenance and support continue; capacity, purchasing options and pricing can become less favorable. At retirement, remaining VMs are deallocated and lose support and SLA coverage. The initial policy covers general-purpose, memory-, compute- and storage-optimized families. It makes the consequences of retaining older infrastructure much more explicit.

For example, Microsoft’s retirement guidance for Dv3, Dsv3, Ev3 and Esv3 sets November 15, 2029 as the deadline in the affected public-cloud environments, excluding government, 21Vianet and sovereign regions. Capacity growth restrictions already apply separately. An application owner therefore has to consider whether a workload can expand or be redeployed as well as whether it runs today. HPC Pack 2019’s end of support in August 2027 creates a related planning task for organizations relying on that cluster-management and scheduling stack. Cloud adoption has not removed infrastructure renewal from the budget.

There are new destinations for that renewal. The Lasv5 and Laosv5 VM families reached general availability on September 29. They combine fifth-generation AMD EPYC processors with substantial local NVMe storage for workloads such as caching and distributed storage. Laosv5 provides three times the local storage capacity per vCPU of Lasv5. The useful distinction is the resource balance: organizations can choose a denser storage configuration without treating every storage-heavy workload as a reason to buy proportionately more CPU.

Azure Migrate’s September previews address the work needed to reach a new environment. Network assessments examine VMware environments, including NSX, and recommend Azure networks, security controls and load-balancing resources alongside readiness and cost estimates. Auto Wave Planning uses inventory, assessment results, application mappings and dependencies to propose migration groups and their order. Together, these features bring the application’s connections and sequencing into the migration plan. That is a substantial improvement over a project organized around a list of servers, because moving the machines is only useful if their applications can still communicate.

The management-group scope added to savings-plan and reservation recommendations also fits this broader view. Finance and platform teams can evaluate opportunities across an organizational hierarchy of subscriptions, rather than assemble every subscription’s picture separately. I would connect this directly to modernization planning. A recommendation based on consumption is useful evidence, but a commitment should reflect the infrastructure the business expects to retain. Microsoft is improving the view of current demand; deciding which demand will survive a migration remains an architectural and financial judgment.

Azure management reaches further into the estate

The September 22 public preview of AKS flex nodes lets an existing Azure Kubernetes Service cluster use worker nodes in other Azure regions, on premises or at the edge. An encrypted overlay connects those nodes to the cluster’s API server, and Kubernetes scheduling and access controls operate across the expanded cluster. This offers a way to use capacity near an application’s data, or capacity available elsewhere, without introducing another cluster control plane. The management boundary grows while the compute can stay where it is needed.

AKS on bare-metal Ubuntu, announced on September 30, takes a different approach. Both the Kubernetes control plane and the workloads run on customer-owned Ubuntu hardware, without a hypervisor between Kubernetes and the server. Azure supplies the management integration, while the customer retains control over the host and hardware stack. The current public preview is limited to single-node clusters, so this is an evaluation opportunity for local and edge computing rather than a ready-made replacement for a large production cluster. Its significance is the direction: Azure’s Kubernetes offering is extending to infrastructure Microsoft does not own.

September’s Azure Red Hat OpenShift hosted-control-plane preview changes the division of work within Azure itself. The control plane moves outside the customer’s worker subscription, while application workers remain in the customer’s virtual network. The documented architecture reduces the minimum customer compute footprint from three control-plane nodes and three workers to two workers, and separates control-plane upgrades from worker-pool upgrades. That could make smaller clusters and stronger separation between application teams easier to justify. The economic change comes from reducing the infrastructure and coordination needed to operate each cluster.

Azure Virtual Desktop Hybrid became generally available in September. Azure Arc connects local session hosts to the Azure desktop service, so organizations can deliver remote applications and desktops from infrastructure they already own. The service handles the cloud desktop layer while the customer operates the local machines. Provisioning, power management and autoscale remain outside this hybrid offering, and Windows Enterprise multi-session is unsupported. This is nevertheless a useful concession to enterprise reality: a business can adopt a managed access service while continuing to use its existing hosting investment.

Other Virtual Desktop changes make that service easier to operate and reach. Regional host pools, generally available in September, store host-pool metadata in the chosen region instead of a database shared across regions, reducing cross-region dependencies. Managed identities also reached general availability for supported host-pool operations, including session-host configuration, autoscale and Start VM on Connect. October adds general availability of external-identity support in Windows App on iOS, allowing invited external users to access assigned desktops and applications from that client in supported configurations.

These announcements describe several distinct deployment models, but they share a commercial logic. Microsoft can supply more of the operating environment even when moving every workload into an Azure datacenter would be impractical. I think that is a stronger enterprise proposition than treating retained infrastructure as an unfinished migration. It gives customers more choice about location while increasing the importance of Azure’s identities, policies and management services to the estate as a whole.

More operational work moves into the platform

Azure Firewall explicit proxy reached general availability on September 2. Applications and browsers can send outbound HTTP and HTTPS traffic to the firewall through ordinary proxy settings. The GA release uses one proxy endpoint port for both, and can retrieve proxy auto-configuration files from Blob Storage using a managed identity. This lets organizations replace self-managed forward proxies while retaining a familiar application configuration. It also allows selected traffic to pass through the firewall without redirecting every connection from the subnet, making modernization easier to stage.

Network security perimeter metrics became generally available on September 30. For protected resources, Azure Monitor now exposes aggregate allowed and denied access activity that teams can chart, alert on and compare as rules change. Teams can establish a traffic baseline before enforcing a perimeter and see whether a policy change produces unexpected denials. Detailed investigations still use diagnostic logs, but routine monitoring becomes more accessible. Security policy is more useful when its effect is visible to the people operating the application.

Reliability is receiving similar treatment. Microsoft’s September 9 guidance on two-zone and three-zone designs asks architects to evaluate each component’s surviving capacity and consistency requirements. A stateless application tier and a quorum-based system need different reasoning. This is architecture guidance, not a new service, and I welcome its emphasis on proving what survives a failure. Counting zones on a diagram cannot establish that the remaining application will carry the business workload.

Two scale-set features turn parts of that reasoning into platform behavior. September’s Automatic Zone Placement preview chooses zones for new instances using SKU availability, capacity and customer constraints. It reduces the need to maintain fixed zone lists for every region. Automatic Zone Balance was announced as generally available on October 15 and addresses an existing deployment’s uneven distribution. Its create-before-delete mechanism creates a replacement in an underrepresented zone and checks health before removing an instance elsewhere. Placement governs new capacity; balancing corrects drift. Because balancing recreates instances, the application must tolerate that lifecycle, and it should not be treated as a zone-outage recovery system.

The October 14 general availability of StandardV2 NAT Gateway for AKS-managed egress strengthens another dependency that can otherwise undermine a resilient cluster: outbound connectivity. StandardV2 is zone redundant, supports IPv6 and raises the throughput ceiling from 50 to 100 Gbps. New clusters using the applicable API and managed-NAT configuration receive it in supported regions. Existing clusters retain Standard until migrated. That migration replaces the gateway and changes its public addresses, so it requires coordination with systems that allowlist outbound traffic. The improvement matters because distributing application workers across zones achieves little if their shared route to essential external services remains vulnerable.

Specialist infrastructure is also moving into managed services. Azure Payment HSM v2 entered public preview on September 17, initially in West US and West Europe. It combines Marvell hardware security modules with Utimaco Atalla payment software to provide cryptographic operations such as PIN translation, card issuance and key management through Azure. For payment providers, the proposed operational change is substantial: consuming the payment-security platform as a service can remove the need to deploy and maintain its physical appliances. Azure is extending into work that previously required a particularly specialized local infrastructure team.

The engineering underneath Azure is changing too

Anyscale on Azure reached general availability on October 7. It provides managed Ray, the distributed-computing runtime, on AKS. Customer workloads, datasets and model artifacts stay in the customer’s Azure subscription, while Anyscale operates its control plane in its own Azure tenant and processes operational metadata there. The relevant Azure development is the packaging of specialist infrastructure into a supported operating service. Teams can run distributed workloads without taking on every part of the Ray cluster lifecycle themselves.

The Open Compute Project announcements on October 13 show how far below the software interface the next round of infrastructure work reaches. Microsoft’s power architecture work advances 800-volt DC distribution and the Mt. Diablo design, which moves power conversion into a separate rack so power and compute can scale independently. Solid-state transformer research aims to reduce conversion stages between the utility supply and computing equipment. These are engineering initiatives at differing stages of development, rather than new Azure services to select in the portal. Their purpose is to make increasing compute density physically and economically supportable.

On networking, Microsoft and partners have released the Multipath Reliable Connection v1.0 specification through OCP. It distributes an RDMA connection, used for high-speed communication between machines, across multiple network paths. Traffic can use available capacity and route around congestion or failed links, helping large accelerator systems continue useful work. The strategic point is that buying more compute is insufficient if its communication system leaves it waiting. Azure’s future performance depends increasingly on the behavior of the complete system.

The hardware-security announcements apply the same thinking to trust. Tessera Integrated HSM opens the specifications and supporting software for hardware-protected key management close to workloads, with a path toward fully open-source silicon. Composite Entity Attestation Token binds evidence from components such as CPUs, GPUs and storage into a single signed platform claim, simplifying verification of a whole machine. These contributions aim to make independently supplied components work together securely. Open interfaces help Microsoft build and evolve its infrastructure with a wider ecosystem; they do not, by themselves, make an Azure application portable to another provider.

Taken together, this is a credible direction for Azure. Microsoft is improving the machinery that keeps applications running while widening the range of infrastructure that its management services can reach. AI helps explain the urgency of the power and network work, but the broader enterprise benefit is operational: more placement decisions, lifecycle tasks and specialist services can be handled through the platform. Fabric, databases and Copilot deserve their own examination; this infrastructure story already has consequences for organizations whose main concern is dependable business applications.

I would judge the next phase by how much operating work these services actually remove. Retaining local compute can be the right decision if Azure makes it easier to govern and maintain. A new managed service earns its place when fewer people need to coordinate upgrades, diagnose dependencies or keep specialist appliances running. The tradeoff is a deeper relationship with Microsoft’s operating model, even where the hardware remains elsewhere. For many enterprises that will be worthwhile. The strongest case for Azure is becoming the quality of that continuing relationship, measured in reliable applications and manageable costs over their working lives.

The Squirrels Have Accomplices. One of Them Has Wheels.

The squirrels can climb, the rabbits are listening, the geese have air support, and something with wheels refuses to explain itself. I have concerns.

Dear world,

In my last letter, I explained that the squirrels were getting away with something. I appreciate that this was a considerable concern to place before people who may simply have wanted to look at a golden retriever.

You may still look at the golden retriever. I will remain available throughout.

But while you are looking at me, other creatures are moving about outside. Some climb. Some fly. One has wheels, which raises questions I do not believe anyone has properly considered. To understand the Great Squirrel Conspiracy, you need to know who is involved.

Business Events Go GA in Microsoft Fabric

Business Events are generally available in Microsoft Fabric. Explore the technology, the changes to data-product design, and the operational work these signals can support.

A data platform can tell a distribution team that a customer’s order is likely to arrive late. Getting that finding to the person who can change the outcome is often a separate project. Someone has to recognize the condition, build an integration, decide who should respond, and preserve enough context to explain what happened afterward.

Microsoft’s September 2026 release lists Business Events as generally available. This gives Fabric teams a common way to publish meaningful business occurrences and connect them to downstream responses. For organizations already using Fabric to combine data and calculate business conditions, that is a substantial extension of what the platform can contribute.

I see the architectural opportunity in treating the findings produced by analytics as something other teams can subscribe to and use. Understanding that opportunity starts with what a business event represents, then follows through to the systems we build and the people whose work those systems support.

Lovable and Microsoft Change the Business Case for Internal Apps

Lovable and Microsoft could make more small internal applications worth building. The business case depends on reusable operating services, process improvement, and the full cost of ownership.

There is a familiar category of business problem that never becomes a software project. A sales team needs a better way to handle pricing exceptions. Operations needs a tool for work that falls between two systems. A department has outgrown a spreadsheet, but its requirements are too specific for the standard application and too small to compete for engineering capacity.

The organization keeps paying for the problem through delay, repeated work, and missed opportunities. Building the tool might make sense in isolation. Owning it, connecting it, securing it, and supporting it can make the total proposition difficult to justify.

Lovable’s September 28 announcement with Microsoft addresses that gap. Applications built in Lovable can be packaged for Microsoft Copilot Managed Runtime, with Microsoft hosting, organizational sign-in, and tenant governance. The partnership also brings together Microsoft data connections and distribution through Microsoft’s ecosystem.

My reading is that this changes the investment threshold for internal software. More business improvements could become economically achievable when an organization can reuse the foundations required to operate an application. Understanding that opportunity requires looking beyond the speed of generating its first screen.

Fabric Policies and the Business of Governed Self Service

Fabric Policies bring more granular controls to selected actions in Microsoft Fabric. Explore how the preview changes architecture, delivery practices, and the business case for delegated ownership.

A finance team wants to build its own forecasting tools in Fabric. The platform team wants to support that work while keeping production engineering, network protection, and encryption decisions under clear ownership. Each request is reasonable. The difficulty is expressing both in the platform without turning every new project into another round of administrative negotiation.

Microsoft’s Fabric Policies announcement introduces a more granular way to govern selected actions. Currently in preview, the feature lets administrators define conditions for who can perform an operation and where. That makes it possible to describe an approved way of working more precisely than a broad organizational permission alone.

The business significance is the prospect of more useful delegation. Teams can take responsibility for their analytical work within boundaries the platform can enforce. Understanding that opportunity requires looking at what a policy evaluates, how its rules interact, and how we should build and operate Fabric when governance itself becomes a managed artifact.

Microsoft Plugin Registry and the Value of Shared Expertise

A useful AI workflow often begins with one person who understands the work. They know which questions to ask, which documents matter, and what an acceptable answer looks like. After several attempts, they have instructions that produce a useful result. Then somebody asks whether the rest of the team can use it.

That is the point at which an individual productivity improvement becomes an organizational opportunity. The team needs a way to distribute the method, connect it to the right information, and keep it current as the work changes.

Microsoft’s plugin registry gives organizations that distribution mechanism. A plugin packages skills, connectors, and agents into a capability that people can discover and administrators can manage. The registry provides a common place to publish those capabilities and make them available through Copilot.

The value is straightforward: a useful working method becomes something the organization can share, maintain, and improve. This article explains the business case, shows how to adopt an existing plugin, and walks through building a delivery-review plugin with Work IQ Developer Tools.

Microsoft Copilot Is Becoming a Place to Work

Microsoft’s September and October updates bring documents, business knowledge, reusable skills, and persistent agents into Copilot. The strategic shift is toward an enterprise working environment that carries business processes forward between conversations.

A weekly program review begins long before anyone opens PowerPoint. The budget is in a workbook, delivery commitments are scattered across Teams and email, and the explanation for a changed forecast may be in somebody else’s meeting notes. A person has to assemble those pieces, resolve inconsistencies, and turn them into a decision. Microsoft’s recent Copilot announcements increasingly address that work between applications.

My reading of the developments since the beginning of September is that Microsoft wants Copilot to become a primary working environment for the enterprise. The direction is clear: bring the deliverable into the conversation, give the assistant access to business context and professional methods, and let it carry work forward between interactions. October’s additions make the ambition more concrete. Copilot is becoming a place to produce software and documents, and an entry point into business processes that continue after the user closes the window.

Bringing the work into Copilot

The September 25 introduction of Home, Code, and Autopilot provides the organizing structure. Home brings Chat and Cowork together with recent activity and suggestions for continuing work. Chat supports an interactive exchange; Cowork accepts a delegated assignment and works toward a finished result. Home is rolling out through Frontier, Microsoft’s early-access program. The useful change is continuity: a program director can move from investigating a variance to commissioning the review material in the same environment.

Office in Copilot, announced October 9 and rolling out to Frontier customers, makes that environment substantially more useful. Word, Excel, and PowerPoint files open alongside the conversation, with direct editing, comments, sharing, and coauthoring. The files remain synchronized with the standalone Office applications. A colleague can change the workbook while another refines the explanation, without treating the AI’s output as a disposable draft that must be exported and reconstructed. This is Microsoft using an established strength: the collaboration machinery around the file matters as much as the ability to generate it.

The October Notebooks update gives recurring work a more durable home. Notebooks collect project references and now add simple task delegation, model choice, Office editing, interactive reports, and PDF creation through Frontier. A report can include filters and drill-down views, so the result need not be another static deck. Markdown, TXT, and RTF references are generally available. Notebook creation from a stated goal, recurring task automations, and expanded audio overviews are announced for the following weeks. For the program review, this means keeping the evidence and working deliverables together, with a path toward refreshing them each cycle.

September’s PowerPoint changes also move beyond slide generation. Reusable skills can examine a presentation’s narrative or sharpen its titles, and administrators can distribute approved skills to groups or the whole organization. Brand Kit integration with skills and background completion of longer tasks are listed for October rollout. A team can therefore distribute how it expects a review to be constructed, alongside how the deck should look.

The same monthly update reports general availability for Copilot in SharePoint and the rebuilt OneDrive experience. SharePoint gains content creation, library organization, and AI-generated metadata; OneDrive adopts the same foundation for working with files. Administrators can designate official SharePoint sites as authoritative sources for Copilot. These are practical changes to how the source material is prepared and found. They strengthen the less glamorous part of the strategy: making the organization’s existing information usable.

Making business knowledge and professional methods available

Microsoft is also connecting more of that information to actual business meaning. Fabric IQ grounding lets Cowork query accessible Power BI reports and semantic models, then carry the results into a document or subsequent task. The Cowork integration is generally available and queries run under the user’s Power BI permissions, including row-level security. Work IQ supplies workplace context such as correspondence and meetings. The generally available Foundry IQ integration in Copilot Studio adds reusable knowledge bases, cited retrieval, and private connectivity. These serve different purposes: a measure, an explanation in an email, and an approved procedure can now contribute to one piece of work without pretending they are the same kind of evidence.

The plugin registry announced September 30 supplies a distribution mechanism. A plugin can package reusable instructions, connections to services, and agents. Employees discover approved packages through a Plugins menu; administrators can approve, assign, or block access centrally. The registry is rolling out across supported experiences, with Studio integration still expanding. This gives a professional method somewhere to live beyond an expert’s private prompt collection. A delivery practice can package its review procedure with the tools that obtain the evidence, then make that capability available to the people who need it.

The October 8 Dynamics 365 announcements show what this looks like in a business function. Thirty prebuilt skills across sales, customer service, and customer insights are generally available in Cowork. They can surface at-risk deals, prepare account plans, propose CRM updates, research service questions, and draft responses. The public-preview CRM experience in Teams connects a channel to a customer account and brings account developments, meeting briefs, and case notifications into the discussion. CRM remains the record of the relationship; more of the preparation and coordination happens where the account team already works.

The same release extends the process itself. Sales Development Agent, in public preview, researches prospects, conducts follow-up conversations using its own Exchange account, and hands qualified opportunities to sellers. Service Agent’s expansion into Microsoft 365 is in private preview, bringing service knowledge and case handling to account teams and other employees. The commercial opportunity is better follow-through across sales and service, including work that otherwise waits for someone to remember it.

Copilot for legal, announced October 15, is an especially revealing example. More than twenty purpose-built legal skills are generally available, supporting contract drafting, playbook-based review, obligation extraction, and case chronologies. Proposed contract edits become native tracked changes in Word; approved precedents can supply structured drafts. Partner plugins for research, document management, electronic signatures, and other legal systems are beginning to roll out. This is a stronger proposition than asking a general assistant to sound like a lawyer. Microsoft is connecting a professional method to the document operations and sources that make the work reviewable.

I expect this combination of methods and tools to become a major source of differentiation. Firms can buy access to similar models; their own review standards, precedents, and working practices are harder to reproduce. Those capabilities need an owner and occasional retesting as models and connected systems change. That is an ongoing maintenance responsibility, much like maintaining a useful application or professional practice guide.

September’s model additions reinforce this interpretation. GPT-6.1 Sol and Claude Sonnet 5.5 followed Claude Opus 5.5 and GPT-6 Sol, expanding the available choices across Copilot experiences. The important strategic point is that Microsoft is building a workplace environment around models from multiple suppliers. Its advantage increasingly depends on what the selected model can reach and accomplish inside that environment.

From generated work to continuing responsibility

Code extends the range of possible deliverables. In the September 25 announcement, Microsoft describes building trackers, dashboards, and small applications from natural-language requests, using the underlying technology of GitHub Copilot. Code is rolling out through Frontier. For our program director, an unresolved-decisions tracker could become a working tool rather than another tab maintained manually in the review workbook.

The September 25 public preview of Copilot Managed Runtime addresses the next problem: running that tool. Microsoft provides hosting, Entra identity, governed data connections, Git-backed versioning, and an application inventory in the Microsoft 365 admin center. An SDK and command-line tools give professional developers and compatible third-party builders a route into the same environment. This could materially change the economics of small internal applications. Teams can spend more effort on the useful business function because a common platform supplies much of the operational foundation.

Copilot Studio’s October 7 update brings apps, workflows, and agents into the same design environment. Apps are in public preview. Preview hooks run specified workflows at events such as a session starting or a tool being called, while broader evaluation capabilities assess outcomes, tool use, safety, and latency. The generally available Review panel surfaces publication blockers and warnings, including stale evaluation results after a model change. I like the direction because it leaves room for ordinary software engineering: a form can collect a decision, a workflow can enforce a known sequence, and an agent can interpret the surrounding evidence.

Autopilot, previously called Scout, introduces continuing personal responsibility. Available in private preview, it is a cloud-hosted agent with its own identity, memory, and tools. Its assignment can continue between conversations instead of ending with a response. The practical distinction is time: preparing this week’s review becomes an ongoing role that watches for relevant changes and returns to unfinished work.

The October 15 Copilot Studio announcement extends that idea to organization-owned processes. Agent accounts give agents their own credentials and let people assign work through Teams, Outlook, and document mentions. Business process memory carries relevant context across cycles and participants. Triggers start work from an event or schedule without another prompt. These features are rolling out through Frontier; activity-based recommendations for improving agents and browser-enabled cloud computers are described as forthcoming. A recurring process can now be designed around an agent that belongs to the organization, with responsibility continuing when an individual participant changes jobs.

That is the most consequential development in this period. A personal assistant can make a capable employee faster. An organization-owned agent can change who gathers the evidence, follows up on missing inputs, and prepares the next decision. I would expect the early value to appear in these coordination-heavy activities, where nobody wants to remove professional judgment but everyone would welcome less effort preparing to exercise it.

Operating and paying for the new working environment

Agent 365’s September changes supply more of the management machinery. Tools management now covers plugins, skills, connectors, and MCP servers. Public-preview management rules can act on conditions such as missing ownership, while natural-language registry queries help administrators find agents needing attention. An integration with Azure API Management began rolling out September 30, connecting discovery and access governance with authentication, routing, and other runtime controls. These additions recognize that an organization needs to manage the growing collection of agents and their dependencies, not simply count how many were created.

The October 13 description of trust-aware controls tackles a different problem: a document or email can contain instructions intended to misdirect the assistant. Microsoft describes routing untrusted material through a constrained processing path before passing a transformed representation to the primary model, with initial attention to high-risk sources such as external communications. This adds a structural boundary around retrieved content. It is an important part of making connected assistants useful, because permission to read a message should not give that message authority over the task.

Windows is being pulled into the same architecture. The October 7 hybrid-intelligence announcement describes Copilot using permitted local files and activity, performing actions on the PC, and combining local models with cloud processing. Those Copilot+ PC experiences are expected over the coming months. Microsoft Execution Containers are already generally available on Windows, enforcing boundaries around the files and networks an agent can access. GitHub’s local-and-cloud model routing is scheduled for an experimental preview later in October. The direction is toward a working environment that can reach both enterprise services and the employee’s device.

The pricing changes follow the same logic. Everyday assistance remains under a per-user subscription, subject to fair-use and model limits. Advanced work in Cowork, Code, Autopilot, and specified model experiences consumes Copilot Credits. Administrators must establish a billing policy before users access those metered capabilities. Agent 365’s cost management has expanded to Code and Managed Runtime, alongside Cowork and Work IQ, with model-access controls rolling out for Cowork. Organizations are being asked to fund ongoing work as well as access to software.

That makes the business case more interesting than a license-utilization exercise. For a program review, I would measure the time spent gathering and correcting information, the delay before unresolved issues reach a decision-maker, and the effort required to prepare the next cycle. Credit consumption belongs beside those measures. An agent that produces more material without improving the decision may be adding expense; one that keeps a consequential issue from waiting another week can create value beyond the minutes it saves.

I think Microsoft has chosen a credible direction. It is combining the files people collaborate on, the systems that hold business records, and the methods professionals use to turn evidence into action. Dedicated applications will remain valuable, particularly where structured interaction makes work faster or clearer. Copilot’s opportunity is to absorb more of the coordination between them and to make small, useful capabilities easier to create and distribute.

The next stage should be judged by complete work. Can a team prepare a better review, maintain the record of its decisions, and carry the outstanding actions into the next cycle with less effort? Can someone else take over without reconstructing the process from a private chat history? If these capabilities deliver that continuity, Copilot will have earned a larger role in the organization’s working day. That is a more substantial destination than being the place employees visit to ask a question.

I Am Going to the Resort. Please Do Not Wash Me.

Jason is getting on a plane. I am going to the dog spa and resort. I am extremely excited, although I would like to discuss what they mean by “spa.”

Dear world,

I have important travel news. Next week, Jason is getting on an airplane and going somewhere. I am going to the amazing dog spa and resort.

I am extremely excited about my arrangements. My ears are ready. My tail is ready. If somebody were to say “Do you want to go?” at this moment, we could experience a departure considerably ahead of schedule.

I do have a small complaint about how these arrangements became necessary. Apparently, Jason can get on the airplane and I cannot simply go with him. I consider this anti-dog discrimination, and I would like someone to investigate whether the geese have been threatening the airplanes.

Build a Fabric Ontology

The useful test of an ontology is whether it helps an agent answer a business question using the right entities, relationships, and calculations. A diagram full of connected objects is only the beginning.

Microsoft’s updated Fabric ontology experience gives us more to work with: semantic-model measures, richer metadata, natural-language rules, namespaces, inheritance, and an agent that can help create and query the model. This walkthrough builds a small customer-operations ontology and checks it against a result we can calculate independently.

The question is deliberately specific: which customers have an open, high-priority service case at least seven days old, and how much open order value belongs to those customers? The example includes two qualifying cases for one customer, so a careless join can double the commercial amount. That makes the exercise useful for testing meaning as well as connectivity.