Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Will Velida
Configuring and Securing Azure Key Vault for the Enterprise
We can use Azure Key Vault to securely store and control access to sensitive information. We can use it to handle secrets (things like database connection string, passwords, API tokens etc.), cryptographic keys (used for encrypting and decrypting data), and certificates (SSL/TLS certificates used to secure communications). However, just having a Key Vault by itself doesn't automatically make your application secure.
Implement and configure Privileged Identity Management (PIM)
Imagine if an attacker was able to compromise a privileged user at your company. The damage they could do with that identity could have permanent effects and they can continue to do that damage until someone notices. This is was Privileged Identity Management, or PIM, is designed to stop. With PIM, we can implement just-in-time (JIT) access across a full surface of privileged access in a Microsoft cloud environment. Why does this matter?
Last week in Agent Security Update 4: Cairn’t Touch This
What a fucking week.... If you've been living under a rock this week, two critical RCE vulnerabilities were found in PHP, collectively known as PHP2Shell. This vulnerability allows unauthenticated attackers to remotely execute code on vulnerable web servers without logging in or providing credentials, potentially seizing server control or stealing data.
Last week in Agent Security 1: We are not-a-mused!
Last week I talked at NDC Oslo about the OWASP Top 10 for Agents where I showed folks the different ways that agents can be exploited. If you've turned the news on recently, you've probably heard about AI will kill us all and how we're all doomed.
What are Agent Plugins?
Implementing Agent Skills and MCP servers as part of my development workflow has been a huge boost to my productivity. Long gone are the days where I'd actually have to leave my IDE to raise a pull request in GitHub, and then manually add that PR to a Jira ticket that's still impossible to find in 2026. Now it's just a matter of me asking GitHub Copilot to create the PR using my create-pr Agent Skill, then use the Atlassian MCP Server to link the PR to the appropriate Jira ticket.
Distributed tracing for multi-agent systems with OpenTelemetry
Multi-agentic architectures can pose challenges from an observability perspective. Each agent within a workflow makes its calls to its own toolset and each agent may be configured to use a different underlying LLM (or even a Model Router which picks the most efficient model for us). Being able to observe which agent made what call with which model in a unified manner can be challenging over an entire workflow.
Orchestrating a multi-agent solution with the Microsoft Agent Framework
The World Cup is over, and despite England losing in the semi-finals, there were plenty of successful hatewatches to be enjoyed (Thank you Belgium and Spain for your service). If you're sad that it's all over, the Premier League is just over 1 month away. Last season, my team Arsenal finally won the title after a 22-year drought. Arguably, we should have won the EFL Cup and the Champions League.
Preventing Cascading Failures in AI Agents
Your AI agent depends on a chain of services. In my side project (Biotrackr), the chain looks like this: Claude API for reasoning, APIM for routing, downstream APIs for health data, and Cosmos DB for chat history. When one link in that chain fails, things can get ugly fast. Imagine this: Claude API returns a 429 (rate limited). The agent retries the same request. Each retry consumes more tokens. More 429s. The conversation times out. The user sees an error and submits again, doubling the load.
Preventing Rogue AI Agents
What happens when the agent itself becomes the threat? Not because of a prompt injection (ASI01) or tool misuse (ASI02), but because the Claude model produces systematically wrong analysis, the Agent Framework has a bug in its tool loop, or the Anthropic API starts returning manipulated responses?
Preventing Human-Agent Trust Exploitation in AI Agents
Your health data agent says: "Your sleep quality improved 23% this month compared to last month." You adjust your bedtime routine, change your medication timing, or skip a doctor's appointment because "the AI says I'm improving." But what if the 23% was hallucinated? What if the agent compared 30 days to 28 days without normalising? What if one of the tool calls failed and the agent filled in the gap with a plausible-sounding number?
Preventing Insecure Inter-Agent Communication in AI Agents
Biotrackr is a single-agent system. One agent, twelve tools, one identity. That is an architectural choice that eliminates an entire vulnerability class Insecure Inter-Agent Communication (ASI07). But what happens when the system grows? Imagine Biotrackr evolves into a multi-agent platform: a Data Retrieval Agent that fetches health records, a Health Advisor Agent that provides wellness recommendations based on trends, and an Orchestrator Agent that coordinates them.
Preventing Agentic Supply Chain Vulnerabilities
Your AI Agent's security is only as strong as its weakest dependency. Whatever packages you are using within your agents, you're trusting that those packages that have been published haven't been tampered with and that they don't contain vulnerabilities. The same applies for every transitive dependency in your graph. In Biotrackr, I'm using a couple of packages that are still in preview, so there may be flaky APIs that could affect my agent's security and reliability.
Preventing Tool Misuse in AI Agents
In my side project (Biotrackr), I have a chat agent that I use to query my data using natural language. This agent has 12 tools that call APIs to retrieve data that provides context to a LLM. I'm using Claude as my LLM provider, so Claude will decide which tool to call, and with what parameters. Let's pretend that we are bad actors trying to disrupt my agent.
Preventing Agent Goal Hijack in AI Agents
My side project (Biotrackr) now has an agent! It's essentially a chat agent that interacts with my data generated from Fitbit, which includes data about my sleep patterns, activity levels, food intake, and weight. But what would happen if a bad actor managed to gain access to the agent, and get it to perform adversarial actions?
Preventing Unexpected Code Execution in AI Agents
Can your AI Agent run code? If not, you probably don't think that unexpected code execution applies to you. However, this goes a lot deeper than eval(). Input validation, container security, static analysis, and runtime monitoring all play a part here. Even an Agent with read-only capabilities and no code interpreter has an execution environment, tool parameters that flow from LLM output, and a CI/CD pipeline that needs to be secure.
Preventing Memory and Context Poisoning in AI Agents
Every time your AI agent saves a conversation, you're creating a potential attack vector. ASI06 (Memory and Context Poisoning) asks a deceptively simple question: "can previous conversations corrupt future ones?" For my side project (Biotrackr), this is one of the more interesting risks. The chat agent persists conversation history to Cosmos DB, and those persisted conversations become context when a user continues an old chat. A poisoned message from 2 weeks ago could influence today's analysis.
Preventing Identity and Privilege Abuse in AI Agents
One of the challenges I faced developing an agent for my side project (Biotrackr) was how do I manage identity. Some AI Agents share the same service principals or managed identity with the application, which is used to authenticate API calls, access databases etc. This is an issue, because if the application has contributor access to a database, so does the agent. If the agent gets compromised, then the blast radius extends to the entire application's permission scope.
Building a Health Data Chat Agent with Claude and the Microsoft Agent Framework
Using the Microsoft Agent Framework, we can build agents that interact with our data via chat capabilities. In my personal project, I decided to create a Chat API that allows me to query my data via a chat interface using an LLM. I wasn't keen on using OpenAI, or even provisioning Microsoft Foundry to create a deployment so that I could use an LLM that they provide.
How to Call Azure Services from an AI Agent Using Entra Agent ID and the .NET Azure SDK
Introduction: The Identity Problem with AI Agents AI agents are moving beyond simple prompt-and-response. They're calling APIs, reading databases, writing to storage etc. Doing actions on real resources with real consequences. This raises a question every platform team eventually asks: whose identity should the agent use? Today, most agents authenticate to Azure services one of two ways: Delegated (on-behalf-of-user): The agent acts as the signed-in user.
Creating Entra Agent ID Blueprints and Identities with PowerShell and .NET
In Microsoft Entra Agent ID, we use agent identity blueprints to create agent identities and request tokens using those agent identities. These agent identities represent AI Agents within your tenant, and is usually provisioned when we create a new AI Agent. In this post, we'll go through an end-to-end example of creating an agent blueprint using Microsoft Graph PowerShell, then we'll create an Agent Identity using a ASP.NET Web API that we'll deploy to Azure Container Apps.
Understanding Microsoft Entra Agent ID
As agents become more capable of making decisions, they require own identities to ensure proper governance, security, and accountability. AI Agents are already being used in a variety of different workflows (perhaps you've deployed some yourself!). But as they become more capable and make autonomous decisions, there are several concerns and challenges that must be addressed: How do we authenticate and authorize agents? How do we govern them?
How to Store Chat History Using External Storage in Microsoft Agent Framework
Chat history and memory allow agents to maintain context across conversations and remember user preferences, which enables agents to provide personalized experiences. Using the Microsoft Agent Framework, we can use in-memory chat message stores, persistent databases, and specialized memory services to cater to a variety of different use cases.
Using GitHub Models with the Microsoft Agent Framework
Almost a year ago, I wrote a blog post on how you could use GitHub Models with Semantic Kernel applications for dev and test purposes. Now that the Microsoft Agent Framework is available, I thought I'd create an updated article on how you can use GitHub Models with the new framework, so that you don't have to provision Azure Foundry and pay for using LLM usage to build agents. What is the Microsoft Agent Framework?
Exploring Azure SRE Agent Preview Service
I run various Container Apps as part of my personal health project. I want this project to be as low maintenance as possible, so I decided to take a look at Azure SRE Agent to see how it could help me reduce the operational toil required to operate my side project. As I'm writing this blog post (8th January 2026), Azure SRE Agent is still in Preview.
Building Remote MCP Servers with .NET and Azure Container Apps
A couple of months ago, I wrote a blog post on how you can create Model Context Protocol (MCP) servers using C#. Using a basic API, I was able to create a MCP server that allowed me to call Australian Football League (AFL) data and supply that as context to LLMs so I can ask it question about AFL results, teams, stats etc. using that API. That blog post talked about how we can use MCP servers that run locally on our machines using stdio transport.
How Tracing works in Azure AI Foundry Agents
Determining how Azure AI Foundry Agents makes decisions is important for troubleshooting and debugging purposes. However, it can get a little complicated when our agents perform complex workflows. Our agents could perform numerous executions, making it difficult to track decisions made by all or them, or some agents may invoke tools, that invoke other tools, which invoke more tools! (And so on and so forth).
Using GitHub Models with Semantic Kernel
I'm making a conscious effort to deepen my knowledge on Semantic Kernel, and I just want an easy way to access LLMs and SLMs without having to go through Azure OpenAI (and pay for it). GitHub Models provides a number of AI models that you can use to build GenAI applications, particularly within Semantic Kernel. Semantic Kernel provides a lightweight framework for us to build AI applications and agents that use LLMs and other cloud services.
Creating an AKS Automatic cluster with your OWN custom VNET in Bicep
In this article, I'm going to show you how to deploy an AKS Automatic Cluster within your own custom virtual network using Bicep. An Azure Subscription A code editor - I'm using Visual Studio Code! The AZ CLI kubectl A bash shell (VS Code has an integrated terminal, Windows terminal is also pretty neat) If you don't know what AKS Automatic is, we'll cover that before we start. We'll then work through the Bicep code that we need to provision a cluster with our own virtual network.
Creating an Azure Kubernetes Service lab environment with Bicep
In this article, I'm going to show you how to build an Azure Kubernetes Service lab environment with Bicep. This sample was inspired by this AKS Lab provided by the AKS team! We're going to build the lab environment step by step using Bicep. Wherever possible, we will avoid creating resources using the AZ CLI, and instead take an opinionated approach to defining our infrastructure declaratively with Bicep instead.
Configuring Virtual Network Peering in Azure
In distributed Azure architectures, it's necessary to split up your virtual network infrastructure into different parts. This may happen over different Azure regions, or different subscriptions. Even in networks that are distributed, we'll need a mechanism to communicate between these different networks. For this, we can use virtual network peering. Virtual network peering enables us to connect two or more virtual networks in Azure, whether they are in the same Azure region or not.
Understanding Private and Public DNS in Azure
To facilitate communication between resources in Azure deployed in virtual networks, we can use domain name resolution over relying on IP address, making the communication process simpler. In Azure, DNS is split into two areas: Public DNS, and Private DNS. Domain Name System, otherwise known as DNS, is responsible for resolving a service name to an IP address. Azure DNS provides DNS hosting, resolution, and load balancing for your Azure applications.
Configuring Public IP addresses in Azure
Azure Virtual Networks use private IP addresses which aren't routable on public networks. To enable support networks that exist both in Azure and on-prem environments, we need to configure IP addressing for both networks. Public IP addresses allow resources on the internet to communicate with Azure, and also enable outbound communication for Azure resources to public-facing services on the internet. In Azure, we can create public IP addresses and assign them to specific resources.
Implementing a basic Azure Virtual Network with Bicep
Azure Virtual Networks (or VNETs) are the fundamental building block for private networks in Azure. We can built Azure VNETs that are similar to on-prem networks, with the benefit of Azure infrastructure. We can create VNETs with their own CIDR block, and link them to other Azure VNETs and on-prem networks (providing that there's no overlap with CIDR blocks). We can also control DNS server settings, segmentation of VNETs into subnets, and more.
Integrating Azure Policy in your AKS cluster using Terraform
As part of my AKS lab, I wanted to see how I can enforce compliance on workloads and my AKS control plane so I get into the habit of creating secure and compliant sandbox environments. We can achieve this with Azure Policy! So in this article, I'll cover: What Azure Policy is. How it integrates with Azure Kubernetes Service.
Installing the Dapr extension for Azure Kubernetes Service with Terraform
As part of the AKS cluster that I'm building for my personal development, I decided it be worthwhile installing the Dapr extension on my cluster. AKS extensions provide an Azure Resource Manager driven experience for installing and managing different services like Dapr on your cluster. Since I built my cluster using Terraform, I decided to configure the Dapr extension using Terraform as well.
Deploying to Azure with Terraform and GitHub Actions
I'm building my own Azure Kubernetes Cluster that I can use for my personal development, and I've been wanting to improve my Terraform skills, so I've spent a bit of time over the past couple of days getting a Terraform deployment to work with GitHub Actions. The AzureRM provider has moved on a bit since I've used it in anger, so I learnt a lot about the different resources that are available, and how we can use GitHub Actions to deploy Terraform templates to Azure.
Managing Secrets in Azure Container Apps
Managing Secrets in Azure Container Apps In Azure Container Apps, we can use secrets to secure sensitive configuration. We can reference secrets directly in our Container Apps, or reference a secret in Azure Key Vault. Azure Container Apps allows your apps to secure sensitive configuration values as secrets. Once you…
Giving our AI Agents skills using native functions in the Semantic Kernel SDK
Native functions are written in native code that can be called by the Semantic Kernel SDK in AI Apps. They’re useful for performing tasks that large language models can’t do on their own! In my last post on Semantic Kernel, I talked about how we interact with large language models (LLMs) through plugins that run with NLP prompts. We can also create plugins using native code.
Creating Plugins for Semantic Kernel SDK
Using the Semantic Kernel SDK, we use plugins that act as the building blocks for our AI applications. Plugins essentially define the tasks that the kernel should complete, and the kernel interfaces with large language models and run the plugins we define. When we use the Semantic Kernel SDK, we use plugins that act as the building blocks for our AI applications.
Building your first Radius application on Azure Kubernetes Service
Radius is a open-source cloud-native platform that bridges the gap between application developers and platform engineers to build and operate cloud-native applications. UPDATE! I’ve published a video on YouTube that provides an introduction to Radius, and how you can build a simple Radius app on Azure Kubernetes Services. Please let me know if you have any feedback Earlier on this week, I gave a presentation to two user groups on the Radius project.
Building our first Radius application on Azure Kubernetes Service
Radius is a open-source cloud-native platform that bridges the gap between application developers and platform engineers to build and operate cloud-native applications. Earlier on this week, I gave a presentation to two user groups on the Radius project.
Managing Distributed Transactions with the Saga Pattern
In a microservices architecture, we may adopt a database-per-microservice approach to let each domain service us a data store that best serves the type of data that microservices uses. With a database-per-microservice approach, we can scale out our data stores independently, and should our data store fail, that failure will be isolated from other services. However, this approach gets complicated when we need to perform operations in a transactional manner.
The Sequential Convoy Pattern
In most cases, we will our applications to process a sequence of messages in the order that they arrive. This is especially the case if and when we need to scale out our message processors to handle any increased load in messages. This isn’t always an easy task, because as our application scales out, instances can often pull messages from the queue independently, similar to how this happens when implementing the Competing Consumers pattern.
The Publisher-Subscriber pattern (pub/sub messaging)
In distributed architectures, different parts of our system will need to provide information to other parts as events happens. One way we could solve this is to provision dedicated queues for each consumer and send messages asynchronously to decouple them from message senders. However, this wouldn’t scale if we had to do this for large amounts of consumers, and what if some consumers where only interested in parts of the information that producers send.
The Asynchronous Request-Reply pattern
Client-side applications often rely on APIs to provide data and functionality, which are either in your control, or provided by a 3rd party. We usually communicate with these APIs using HTTP(S) protocols and REST. Usually, these APIs are designed to respond quickly to requests.
The Queue-Based Load Leveling Pattern
Applications in the cloud can be subjected to heavy peaks of traffic in intermittent phases. If our applications can’t handle these peaks, this can lead to performance, availability and reliability issues. For example, imagine we have an application that stores state temporarily in a cache. We could have a single task within our application that performs this for us, and we could have a good idea of how many times a single instance of our application would perform this task.
The Priority Queue Pattern
The Priority Queue pattern is a pattern that allows us to prioritize requests sent to services so that higher priority requests are received and processed faster than lower priority requests. This is useful for when we are building applications where we need to prioritize some clients over others, or if some requests need to be processed faster than usual for business/compliance reasons.
The Competing Consumers Pattern
Applications running in the cloud should expect to handle a large number of requests. One method of dealing with large amounts of requests is to pass them through a message broker to a consumer service that handles these requests asynchronously. This helps ensure that requests are being processed without throttling or degrading the performance of our applications. The volume of these requests can vary over a period of time. Imagine that you’re a developer for an e-commerce website.
The Retry Pattern and Retry Storm Anti-pattern
When developing cloud applications, we’ll be interacting with remote services that can suffer from transient faults. Our applications need to be able to handle transient failures when trying to connect to remote services, and retry a failed operation to improve the stability of your applications. This is where the Retry pattern comes into play.
Improving Azure AI Search results with semantic search
In Azure AI Search, semantic ranking measurably improves search relevance by using language understanding to re-rank search results In Azure AI Search, semantic ranking improves our searches by using language understanding to rerank search results. Semantic search is a collection of query capabilities that improve the quality of search results using text-based queries.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Will
Contact Will, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack