How MaaS Governance Wraps a Model Endpoint on AKS
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
Loading…
Topic
27 posts about Azure. Every summary links to the original.
See the idea
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
A practical Azure workflow for turning fragmented operational data into governed analytics and agent experiences, with checkpoints for layering, context, access, and deployment.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Databricks announced Private Network Gateway (PNG) in public preview on Azure and private preview on AWS, addressing the networking friction that prevented teams from moving workloads to serverless compute. PNG provides a single managed gateway from serverless compute into a customer’s virtual network, eliminating the need for per-resource private endpoints, load balancers, and proxy VMs. Customers configure the gateway via a Network Connectivity Configuration (NCC) and delegate one subnet, with Databricks managing the gateway infrastructure while customers retain control over routing and security. PNG supports use cases such as ingesting from private databases via Lakeflow Connect, connecting AI agents to private MCP servers, using private package repositories, and routing egress through customer firewalls. The gateway offers two traffic modes for precise control or broad egress inspection and works alongside existing private connectivity without disruption.
Microsoft, NVIDIA, and Anthropic announced strategic partnerships to scale Anthropic’s Claude models on Microsoft Azure and broaden enterprise access to them. Anthropic committed to purchase $30 billion of Azure compute capacity and contract additional capacity up to one gigawatt, initially using NVIDIA Grace Blackwell and Vera Rubin systems. NVIDIA and Anthropic will collaborate on design and engineering to optimize Anthropic models for performance, efficiency, and total cost of ownership, while adapting future NVIDIA architectures to Anthropic workloads. Microsoft Foundry customers will be able to access Claude Sonnet 4.5, Claude Opus 4.1, and Claude Haiku 4.5, while Claude remains available across Microsoft’s Copilot products. Microsoft and NVIDIA committed up to $5 billion and $10 billion, respectively, to Anthropic; Amazon remains its primary cloud provider and training partner.
Anthropic and Microsoft are expanding their partnership by making Claude Sonnet 4.5, Haiku 4.5, and Opus 4.1 available in public preview through Microsoft Foundry, where Azure customers can build applications and enterprise agents. The integration uses serverless deployment, supports Foundry APIs, tools, and workflows, and works with existing Azure agreements, including MACC, while offering Python, TypeScript, and C# SDKs with Microsoft Entra authentication. Claude models are also available through Claude Code in Foundry, and Microsoft 365 Copilot integrations include Researcher, Copilot Studio custom agents, and a preview Agent Mode option in Excel. In Excel, Claude can generate formulas, analyze data, identify errors, and iterate on solutions. Foundry's Global Standard deployment uses standard API pricing; US DataZone availability is described as coming soon, and the models support capabilities including code execution, web search, citations, vision, tool use, and prompt caching.
Indra Renewable Technologies consolidated a fragmented EV-charging data estate spanning Cosmos DB, Synapse, Azure Data Lake Storage, Azure Functions, Power BI, and other services onto Databricks. The migration began with a parallel Synapse prototype and expanded to Delta tables, a consolidated fleet pipeline, and greater use of Databricks for operational workloads. A medallion architecture stores raw fleet data in bronze, transforms it with PySpark in silver, and publishes gold tables for reporting and client delivery; one pipeline now serves three clients and improved performance by 60% to 70%. Unity Catalog, serverless SQL warehouses, AI/BI dashboards, and Genie Agents support governed self-service analytics, while reported results include 80% to 90% business cost savings, 90% storage savings, and query latency falling from 24.4 seconds to 3.5 seconds.
Databricks introduces Governance Hub, a beta account-level interface for platform and governance teams overseeing estates spanning hundreds of workspaces and multiple regions. It consolidates data health, access, AI usage, and cost information across AWS, Azure, and GCP, replacing scattered system tables, workspace views, and third-party tools with drill-downs for metadata gaps, principal access, token and model activity, and untagged spend. The hub also integrates with Genie, allowing users to ask governance questions in natural language and receive answers and recommendations grounded in governance data; future actions such as configuring policies and alerts are described as planned. Account admins enable it from the Account Console, with access varying by role and existing permissions respected, while upcoming features include performance and security insights and delegated recommendations.
Red Hat OpenShift supports compute scaling using Cluster Autoscaler integrated with the OpenShift machine API. The mechanism relies on paired ClusterAutoscaler and MachineAutoscaler custom resources to manage cluster-wide limits and per-MachineSet replica boundaries. Scaling decisions evaluate pending pods against node allocatable capacity and hypothetical node capacity annotations while respecting expander strategies like Random, LeastWaste, or Priority. Cluster Autoscaler checks for unnecessary nodes every 10 seconds, scaling down when utilization falls below configured thresholds and workloads can safely migrate. To mitigate provisioning delays, clusters can adopt overprovisioning via low-priority pause containers or use APIs like ProvisioningRequest and CapacityBuffer for predictive scaling.
Databricks has expanded Inbound Private Link in Beta on AWS and Azure to cover account-level resources, including account-level Genie One, the account console, Governance Hub, and account-level APIs. The update also supports custom URLs and Managed Disaster Recovery stable URLs, while one shared General Access endpoint in any region can serve workspace and account-level UI and API resources, removing the need for one endpoint per region or workspace. These capabilities use context-based ingress, where account admins define allow and deny rules by caller identity, network source, and destination through account and workspace policies. Enabling private access to account-level resources requires registering and allowlisting a General Access endpoint with the account-policy and resolving the custom URL to that endpoint. Existing workspace-specific URLs, private access settings, and IP access lists continue to work in parallel, while service-direct and SCC relay endpoints retain per-region requirements.
Scottish Water’s Capital Investment teams had project data, reports, and metrics available, but non-technical users often struggled to find answers, creating duplicated reporting and delays. SPARK addresses this access problem through a natural-language interface in Microsoft Teams: Copilot routes questions via a supervisor agent and MCP to the Databricks Genie Agent, which queries governed Unity Catalog data. The implementation curates use-case data in a gold layer, adds metric views as a semantic layer, and configures business rules, examples, benchmarking, feedback, and monitoring for accuracy and performance. Environment-parameterised Databricks Asset Bundles, separate environments, Azure DevOps approvals, Entra ID, and Key Vault support repeatable deployment. The post reports lookup journeys shrinking from around eight clicks or four to five search steps to a direct question, with an estimated 520 to 1,300 hours saved annually under a stated usage scenario.
Enterprise AI adoption across regulated industries stalls when internal governance mandates private, dedicated network paths for sensitive data. To eliminate the need for manual VPN tunnels and complex proxy layers, Salesforce re-engineered Private Connect into a multi-cloud networking platform connecting customer environments to Hyperforce services. The Private Connect v2.0 architecture utilizes private links, transit gateways, and direct endpoint routing alongside an automated control plane for rapid Hyperforce regional rollouts. In addition to supporting cross-substrate interconnects for Azure and decoupling endpoint management, the platform incorporates a generic connector framework supporting tools like Snowflake, Databricks, and Kafka. Today, the system provisions secure connectivity in under 30 minutes while processing roughly 120 TB of data and 683 million requests monthly across 15 AWS regions.
cellcentric describes how it built a governed lakehouse foundation for R&D data so industrial AI agents can reason over engineering context, not isolated source-system records. On Azure and Databricks, the Data Hub combines Unity Catalog governance, Lakehouse Federation, Delta Sharing, Declarative Automation Bundles, and an MCP interface for agents. Its Fuel Cell Passport unifies five enterprise systems, models seven hierarchy levels, refreshes daily, and uses a state-based temporal model for point-in-time configuration and rework-history questions. The platform treats context coverage as a data-quality metric, with 27 published products averaging 90% column-comment coverage, while authenticated user identity and Unity Catalog authorization constrain agent access. For many R&D and process-development workflows, work that once took weeks now ships in days, though complex multi-source investigations still require substantial domain review.
Imperial College London’s Care Research and Technology Centre (CR&T) needed to scale Minder, a platform that combines in-home sensors, sleep monitors, and electronic health records to support dementia care and research. Growing data volumes caused competing workloads, tightly coupled storage and compute, and limited access for researchers and clinicians. The re-architected platform validates IoT data through Kubernetes, stores it in Delta Lake on Azure Data Lake Storage using bronze, silver, and anonymized gold layers, and adds Databricks analytics with Unity Catalog governance while retaining FHIR-based EHR interoperability and Kubeflow for model deployment. Research-to-production workflows, reusable pipelines, dashboards, and timestamped data improve collaboration, accessibility, and reproducibility. During migration, uptime remained 100%; new sources integrated in as little as one month, model development fell to about one month, and insights reached 581 people living with dementia in five months.
Autonomous AI agents require governed environments to safely inspect code, execute tests, query enterprise systems, and handle sensitive business data. The NVIDIA Secure Agent Workspace Reference Design shifts agent execution away from user laptops to dedicated, single-user virtual machines managed on Red Hat OpenShift Virtualization or Microsoft Azure. Perimeter defenses enforce enterprise single sign-on access broker connections, default-deny network egress rules, and human approval gates for critical state-changing actions. Inside the workspace virtual machine, active sandboxing through NVIDIA OpenShell evaluates signed security policies before each tool invocation while credential proxies prevent direct access to raw secrets. GitOps workflows continuously reconcile infrastructure profiles and network configurations while all operational and security telemetry streams to centralized SIEM platforms in OCSF format.
Launched in 2016, MongoDB Atlas was designed to bring MongoDB's developer experience to the cloud while eliminating operational overhead for production environments. Over ten years, Atlas expanded beyond a managed database into a multi-cloud data platform that supports multi-document ACID transactions, Queryable Encryption, native search, and stream processing. The platform introduced Atlas Vector Search in 2023 and acquired Voyage AI in 2025 to embed advanced embedding and reranking models natively. These integrated capabilities address the requirements of retrieval-augmented generation and autonomous AI agents without relying on disparate vector stores or sync pipelines. Atlas now serves more than three trillion queries daily across over 125 AWS, Google Cloud, and Microsoft Azure regions for nearly 70,000 customers.
At Data + AI Summit 2026, Azure Databricks announced capabilities aimed at moving enterprises from experimental AI pilots to production-grade automated workflows by unifying data, productivity tools, marketing, and governance on Azure. Its Agentic Data foundation introduces LTAP, combining analytical data, streaming pipelines, and live application transactions in one lakehouse storage copy; Lakebase adds a managed serverless Postgres engine with copy-on-write branching, while Lakehouse//RT targets millisecond responses for high-concurrency workloads. Genie integrations for Microsoft Teams, M365 Copilot, Excel, and SharePoint bring governed lakehouse intelligence and ingestion into daily work, alongside tools for agents, applications, pipelines, and autonomous operations. CustomerLake adds Profile Agents and Campaign Agents for customer profiles and personalization, while Genie Ontology and Unity AI Gateway provide semantic context, rate limits, content filtering, and spend controls.
Data + AI Summit 2026 brings Databricks and Microsoft leaders, partners, and customers together June 15–18, with in-person and virtual programming focused on Azure Databricks. The collaboration presents Azure Databricks as a first-party Microsoft offering for unifying data, analytics, and AI on a secure, scalable foundation, with sessions covering ecosystem integration, federated analytics, governance, modernization, and AI applications. One technical example introduces zero-copy federation between Azure Data Manager for Energy and Databricks compute, preserving ADME as the source of truth while avoiding large-scale data copies. Another shows Unity Catalog External Locations extending governed access to Microsoft OneLake without ETL pipelines, while customer sessions describe Apache Iceberg and Apache Spark integration, fragmented data consolidation, and production-grade finance workflows using Azure Document Intelligence.
BKK, Budapest’s unified transport authority, manages public transit, shared mobility, infrastructure, and traffic systems for a city of 1.7 million people. Its legacy on-premises warehouse and fragmented Excel- and PowerBI-based reporting struggled with growing, varied data, limiting efficient access and analysis. BKK phased a migration to Azure Databricks, starting with mobility datasets and carefully modeling and validating data from vehicle GPS, passenger sensors, boarding schedules, and other systems. The Databricks Lakehouse lets analysts process large geospatial datasets in shared SQL, Python, or R notebooks, supporting minute-level shared-mobility tracking, route-performance analysis, airport-bus forecasting, and dynamic scheduling. These capabilities provide faster insights and more responsive decisions, while governed access and cost visibility support broader collaboration and BKK’s vision for a digital twin of Budapest’s mobility system.
Mercedes-Benz built a cross-cloud data mesh to share after-sales data between AWS and Azure while supporting its data-defined vehicle strategy. Existing direct queries incurred egress costs, and weekly full loads delayed updates for datasets that included vehicle over-the-air events and workshop visits; source tables were in Iceberg while many consumers expected Delta. Using Unity Catalog and Delta Sharing, the company federated AWS Glue tables, established cross-metastore shares, and used periodic serverless Sync Jobs with Delta Deep Clone to incrementally replicate selected tables into Azure object storage for local querying. This hybrid model preserves direct sharing for fresher workloads while reducing transfer for less time-sensitive ones. For the initial ten data products, egress costs fell 66%, update frequency improved from weekly to every second day, and the source reports an approximately 93% annual reduction in its 50-use-case comparison.
During database latency spikes or unexpected outages, operations teams frequently waste valuable time downloading compressed archives and manually inspecting log files to isolate root causes. MongoDB Atlas resolves this operational friction by introducing a direct log integration feature for dedicated M10+ clusters. The system routes mongod, mongos, and audit logs directly to third-party tools such as Datadog, Splunk, Amazon S3, Google Cloud Storage, and Azure Blob Storage. Furthermore, built-in support for the OpenTelemetry standard enables teams to pipe database logs into any OTel-compatible logging backend. This setup eliminates operational silos, streamlines security auditing, and correlates database query diagnostics with application traces and infrastructure metrics in real time.
Enterprise organizations are modernizing legacy monoliths, mainframes, and relational databases to improve scalability and system performance. MongoDB launched its Application Modernization Platform, an AI-powered program combining artificial intelligence tooling with migration methodologies. Using these capabilities, Wells Fargo implemented an operational data store to serve 40 percent of external vendor traffic with sub-second response times across more than 7 million transactions. CSX utilized MongoDB Atlas on Azure alongside Cluster-to-Cluster Sync to complete a cloud migration within hours while sustaining continuous operations. Additionally, Intellect Design reduced onboarding workflow times by 85 percent, and Deutsche Telekom scaled daily customer interactions from under 50,000 to approximately 1.5 million.
MongoDB announced the recipients of its 2025 Global Partner Awards, recognizing cloud providers, systems integrators, and technology vendors for driving enterprise modernization and artificial intelligence adoption. Microsoft earned Global Cloud Partner of the Year for joint integrations linking MongoDB Atlas on Azure with native Microsoft services across healthcare, telecommunications, and financial services. Amazon Web Services received the Global AI Cloud Partner award, highlighted by a joint deployment with Novo Nordisk that reduced a key workflow from twelve weeks to ten minutes using Amazon Bedrock and Atlas. Confluent was named Global Tech Partner of the Year with over 550 joint customer deployments focused on event-driven streaming and multi-agent systems alongside LangChain. Additional honorees included Google Cloud, Accenture, BigID, Pureinsights, gravity9, IBM, and Alibaba Cloud for their contributions across public sector solutions, database-as-a-service offerings, and generative AI frameworks.
The best engineering reads, once a week.