Steef-Jan Wiggers
@steefjan.bsky.social
InfoQ Cloud Lead Editor, Microsoft MVP Azure Integration PaaS, Cloud Native, Speaker, Scuba Diver, Runner, and Field Hockey Player.
Apple Reference Image signs pixel data inside the iPhone 18 Pro sensor, then develops it in Private Cloud Compute under Apple's signature.
Trust moves from C2PA's editing chain to Apple. Verification stays on Apple platforms.
www.infoq.com/news/2026/09...
Trust moves from C2PA's editing chain to Apple. Verification stays on Apple platforms.
www.infoq.com/news/2026/09...
Apple Reference Image Signs Photos at the Sensor, Moving Provenance Trust Away from C2PA
Apple has published the design of Reference Image, an iPhone 18 Pro camera mode that signs pixel data at the sensor and develops it in Private Cloud Compute under an Apple signature. Developers on Hac...
www.infoq.com
September 24, 2026 at 8:09 AM
Apple Reference Image signs pixel data inside the iPhone 18 Pro sensor, then develops it in Private Cloud Compute under Apple's signature.
Trust moves from C2PA's editing chain to Apple. Verification stays on Apple platforms.
www.infoq.com/news/2026/09...
Trust moves from C2PA's editing chain to Apple. Verification stays on Apple platforms.
www.infoq.com/news/2026/09...
Built all six rate limiting algorithms in C# on Azure and load-tested them. A "10/sec" fixed window let 19 through, and a second replica quietly doubled every in-process limit.
sjwiggers.com/2026/09/24/r...
sjwiggers.com/2026/09/24/r...
Rate Limiting Algorithms on Azure: 6 Compared - Cloud Perspectives
Six rate limiting algorithms on Azure, measured with real load tests: fixed window, sliding log, token bucket, leaky bucket, and more.
sjwiggers.com
September 24, 2026 at 6:24 AM
Built all six rate limiting algorithms in C# on Azure and load-tested them. A "10/sec" fixed window let 19 through, and a second replica quietly doubled every in-process limit.
sjwiggers.com/2026/09/24/r...
sjwiggers.com/2026/09/24/r...
Azure's price list for Foundry models: 1,727 meters in one region, but it doesn't name the model. So I wrote a tool that joins the ARM catalog, Retail Prices, and your own deployments: price per 1M tokens, retirement date, and which of yours are affected.
sjwiggers.com/2026/09/22/f...
sjwiggers.com/2026/09/22/f...
Foundry Model Ledger: Which Model, at What Price, Until When, and Which of Mine - Cloud Perspectives
Foundry Model Ledger shows what a Foundry model costs per 1M tokens in your currency, when it retires, where else it runs, and which of your deployments are affected.
sjwiggers.com
September 22, 2026 at 5:48 AM
Azure's price list for Foundry models: 1,727 meters in one region, but it doesn't name the model. So I wrote a tool that joins the ARM catalog, Retail Prices, and your own deployments: price per 1M tokens, retirement date, and which of yours are affected.
sjwiggers.com/2026/09/22/f...
sjwiggers.com/2026/09/22/f...
AWS says it cannot restore data held exclusively in a damaged UAE availability zone, or exclusively in its Bahrain region, after strikes during the conflict with Iran.
Multi-AZ and S3 durability are regional properties.
www.infoq.com/news/2026/09...
Multi-AZ and S3 durability are regional properties.
www.infoq.com/news/2026/09...
AWS Cannot Restore Data Held Only in Damaged Middle East Availability Zones
AWS has told customers it cannot restore resources and data hosted exclusively in the mec1-az2 availability zone in the UAE, or exclusively in the Bahrain region, after damage during the conflict with...
www.infoq.com
September 21, 2026 at 5:41 PM
AWS says it cannot restore data held exclusively in a damaged UAE availability zone, or exclusively in its Bahrain region, after strikes during the conflict with Iran.
Multi-AZ and S3 durability are regional properties.
www.infoq.com/news/2026/09...
Multi-AZ and S3 durability are regional properties.
www.infoq.com/news/2026/09...
Revoked the same user's session twice. One client was locked out in 4 seconds, the other kept working for 65 minutes. The difference: one claim in the token request.
Six samples measuring what the Entra ID diagram hides:
sjwiggers.com/2026/09/20/m...
Six samples measuring what the Entra ID diagram hides:
sjwiggers.com/2026/09/20/m...
Microsoft Entra ID under the hood - Cloud Perspectives
Microsoft Entra ID under the hood: token lifetimes, CAE revocation latency and PIM payload, measured on a real tenant with six deployable samples.
sjwiggers.com
September 20, 2026 at 12:21 PM
Revoked the same user's session twice. One client was locked out in 4 seconds, the other kept working for 65 minutes. The difference: one claim in the token request.
Six samples measuring what the Entra ID diagram hides:
sjwiggers.com/2026/09/20/m...
Six samples measuring what the Entra ID diagram hides:
sjwiggers.com/2026/09/20/m...
Post 6, closing the series: real production case study on Cosmos DB agent memory cost — one partition key absorbed 80% of traffic, account pinned at 100% RU utilization. Fixing the data model dropped it to 20-35%, no new throughput.
sjwiggers.com/2026/09/17/c...
sjwiggers.com/2026/09/17/c...
Cosmos DB Agent Memory Cost: Caching, RU Drivers, and a Pitfalls Roundup - Cloud Perspectives
Cost only matters next to the value it unlocks. A practical guide to Cosmos DB agent memory cost: semantic caching, RU drivers, and pitfalls.
sjwiggers.com
September 17, 2026 at 6:24 AM
Post 6, closing the series: real production case study on Cosmos DB agent memory cost — one partition key absorbed 80% of traffic, account pinned at 100% RU utilization. Fixing the data model dropped it to 20-35%, no new throughput.
sjwiggers.com/2026/09/17/c...
sjwiggers.com/2026/09/17/c...
GPT-6 Astra is the first model OpenAI classifies as Critical for cybersecurity under its Preparedness Framework.
In expert-led testing it found unknown vulnerabilities in a browser and an OS kernel and built working exploits.
www.infoq.com/news/2026/09...
In expert-led testing it found unknown vulnerabilities in a browser and an OS kernel and built working exploits.
www.infoq.com/news/2026/09...
GPT-6 Astra Is the First Model OpenAI Classifies as Critical for Cybersecurity
OpenAI has classified GPT-6 Astra at the Critical cybersecurity threshold under its Preparedness Framework, a first. In expert-led testing the model found previously unknown vulnerabilities in a brows...
www.infoq.com
September 17, 2026 at 6:14 AM
GPT-6 Astra is the first model OpenAI classifies as Critical for cybersecurity under its Preparedness Framework.
In expert-led testing it found unknown vulnerabilities in a browser and an OS kernel and built working exploits.
www.infoq.com/news/2026/09...
In expert-led testing it found unknown vulnerabilities in a browser and an OS kernel and built working exploits.
www.infoq.com/news/2026/09...
Post 5 on Cosmos DB agent memory: bring-your-own thread storage for Foundry Agent Service — direct query access instead of a managed black box.
Gotcha: 3,000 RU/s minimum, or you hit CapabilityHostProvisioningFailed.
sjwiggers.com/2026/09/16/c...
Gotcha: 3,000 RU/s minimum, or you hit CapabilityHostProvisioningFailed.
sjwiggers.com/2026/09/16/c...
Cosmos DB Foundry Agent Service: Bring-Your-Own Thread Storage - Cloud Perspectives
Default agent storage is opaque. A practical guide to Cosmos DB Foundry Agent Service — the enterprise_memory database, RU sizing, and roles.
sjwiggers.com
September 16, 2026 at 10:47 AM
Post 5 on Cosmos DB agent memory: bring-your-own thread storage for Foundry Agent Service — direct query access instead of a managed black box.
Gotcha: 3,000 RU/s minimum, or you hit CapabilityHostProvisioningFailed.
sjwiggers.com/2026/09/16/c...
Gotcha: 3,000 RU/s minimum, or you hit CapabilityHostProvisioningFailed.
sjwiggers.com/2026/09/16/c...
Built five RAG architectures on the same Azure setup, with the same 15 questions, so I could actually compare them.
Best surprise: Corrective RAG did better on the 12 questions it wasn't built for than on the 3 it was built for.
sjwiggers.com/2026/09/13/f... #azure #rag #ai
Best surprise: Corrective RAG did better on the 12 questions it wasn't built for than on the 3 it was built for.
sjwiggers.com/2026/09/13/f... #azure #rag #ai
Five RAG Architectures in Real Azure Code - Cloud Perspectives
Hybrid, GraphRAG, Agentic, Corrective, and Multimodal RAG, built against the same Azure substrate and the same fifteen questions. What the diagrams leave out, and what the measured numbers actually sh...
sjwiggers.com
September 13, 2026 at 12:30 PM
Built five RAG architectures on the same Azure setup, with the same 15 questions, so I could actually compare them.
Best surprise: Corrective RAG did better on the 12 questions it wasn't built for than on the 3 it was built for.
sjwiggers.com/2026/09/13/f... #azure #rag #ai
Best surprise: Corrective RAG did better on the 12 questions it wasn't built for than on the 3 it was built for.
sjwiggers.com/2026/09/13/f... #azure #rag #ai
Settled the MCP vs API debate the practical way: one Azure Functions app, same backend, two doors. Developers call the REST endpoints; an AI agent discovers the MCP tools and chains them on its own. Code and writeup:
dev.to/steefjan_wig...
dev.to/steefjan_wig...
MCP vs API Is the Wrong Question
Recently, I saw a LinkedIn post discussing "MCP vs API" and felt like we needed to choose one. But I...
dev.to
September 11, 2026 at 4:30 PM
Settled the MCP vs API debate the practical way: one Azure Functions app, same backend, two doors. Developers call the REST endpoints; an AI agent discovers the MCP tools and chains them on its own. Code and writeup:
dev.to/steefjan_wig...
dev.to/steefjan_wig...
Built a scam-checking agent on Azure Functions hosted skills. V1 let the model orchestrate tools and hit 47K-token turns. V2: evidence in code, one LLM call for judgment.
dev.to/steefjan_wig...
dev.to/steefjan_wig...
Azure Functions Hosted Skills: I Built a Scam-Checking Agent, Then Removed the Agency
Is that webshop legit? Most of us have pasted a URL into a reputation checker at least once. The...
dev.to
September 11, 2026 at 10:28 AM
Built a scam-checking agent on Azure Functions hosted skills. V1 let the model orchestrate tools and hit 47K-token turns. V2: evidence in code, one LLM call for judgment.
dev.to/steefjan_wig...
dev.to/steefjan_wig...
Post 4 on CosmosDB agent memory: multi-agent systems need shared memory to coordinate and private memory for each agent's own persona.
Handoff is change feed — one agent's write becomes the next agent's signal to act, no polling loop.
sjwiggers.com/2026/09/10/c...
Handoff is change feed — one agent's write becomes the next agent's signal to act, no polling loop.
sjwiggers.com/2026/09/10/c...
Multi-Agent State and Checkpointing with Cosmos DB - Cloud Perspectives
A practical look at Cosmos DB multi-agent state — LangGraph checkpointing, hierarchical partitioning per session, and change feed for agent handoffs.
sjwiggers.com
September 10, 2026 at 2:39 PM
Post 4 on CosmosDB agent memory: multi-agent systems need shared memory to coordinate and private memory for each agent's own persona.
Handoff is change feed — one agent's write becomes the next agent's signal to act, no polling loop.
sjwiggers.com/2026/09/10/c...
Handoff is change feed — one agent's write becomes the next agent's signal to act, no polling loop.
sjwiggers.com/2026/09/10/c...
Post 3 on Cosmos DB agent memory: same question, four ways — recency, semantic, hybrid, keyword — one container, four answers.
Gotcha: named params don't bind in Data Explorer — VectorDistance() won't compile til you swap in literals.
sjwiggers.com/2026/09/03/c...
Gotcha: named params don't bind in Data Explorer — VectorDistance() won't compile til you swap in literals.
sjwiggers.com/2026/09/03/c...
Finding the Right Memory: Vector, Full-Text, and Hybrid Search in Cosmos DB - Cloud Perspectives
Storing memory well isn't the same as retrieving it well. A practical guide to Cosmos DB agent memory search: vector, full-text, and hybrid queries.
sjwiggers.com
September 3, 2026 at 7:40 AM
Post 3 on Cosmos DB agent memory: same question, four ways — recency, semantic, hybrid, keyword — one container, four answers.
Gotcha: named params don't bind in Data Explorer — VectorDistance() won't compile til you swap in literals.
sjwiggers.com/2026/09/03/c...
Gotcha: named params don't bind in Data Explorer — VectorDistance() won't compile til you swap in literals.
sjwiggers.com/2026/09/03/c...
Drew the Microsoft AI stack the way I see it: six layers, the sixth being governance and evidence, which vendor diagrams skip. Then plotted the AI-901 to AI-500 cert trail on it. AI-500 tests guardrails, not models.
sjwiggers.com/2026/09/02/m...
sjwiggers.com/2026/09/02/m...
The Microsoft AI Stack in 2026 and the Certification Trail That Runs Through It - Cloud Perspectives
The Microsoft AI stack as I see it: six layers, one governance plane, and how the new AI certification trail up to AI-500 maps onto that picture.
sjwiggers.com
September 2, 2026 at 12:19 PM
Drew the Microsoft AI stack the way I see it: six layers, the sixth being governance and evidence, which vendor diagrams skip. Then plotted the AI-901 to AI-500 cert trail on it. AI-500 tests guardrails, not models.
sjwiggers.com/2026/09/02/m...
sjwiggers.com/2026/09/02/m...
Cloudflare added optional OAuth scopes: client owners mark which permissions users may deselect at consent. MCP servers are the motivating case.
Partial consent isn't new. What's new is developer control over what's droppable.
www.infoq.com/news/2026/09...
Partial consent isn't new. What's new is developer control over what's droppable.
www.infoq.com/news/2026/09...
Cloudflare Adds Optional OAuth Scopes, Letting Developers Mark What Users May Decline
Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the u...
www.infoq.com
September 2, 2026 at 9:32 AM
Cloudflare added optional OAuth scopes: client owners mark which permissions users may deselect at consent. MCP servers are the motivating case.
Partial consent isn't new. What's new is developer control over what's droppable.
www.infoq.com/news/2026/09...
Partial consent isn't new. What's new is developer control over what's droppable.
www.infoq.com/news/2026/09...
Partition key and item shape decide whether a Cosmos DB agent memory schema holds up.
TTL trick: -1 on the container, override per item. Short-term turns expire; long-term memories don't. Same container.
sjwiggers.com/2026/09/01/c...
#agenticai
TTL trick: -1 on the container, override per item. Short-term turns expire; long-term memories don't. Same container.
sjwiggers.com/2026/09/01/c...
#agenticai
Designing a Cosmos DB Agent Memory Schema - Cloud Perspectives
Before you write agent code, design the schema. A practical guide to Cosmos DB agent memory schema design: partition keys, data models, and TTL.
sjwiggers.com
September 1, 2026 at 9:35 AM
Partition key and item shape decide whether a Cosmos DB agent memory schema holds up.
TTL trick: -1 on the container, override per item. Short-term turns expire; long-term memories don't. Same container.
sjwiggers.com/2026/09/01/c...
#agenticai
TTL trick: -1 on the container, override per item. Short-term turns expire; long-term memories don't. Same container.
sjwiggers.com/2026/09/01/c...
#agenticai
Agent ≠ Model. Foundry's router picks the model per request, and the pool refreshes under a stable endpoint. The durable investment is the control plane, not today's model. Also in the post: where that's the wrong answer.
sjwiggers.com/2026/08/31/b...
sjwiggers.com/2026/08/31/b...
Don't Build Around Today's Model. Build for the AI Control Plane - Cloud Perspectives
Microsoft Foundry's model router updates point to a model-agnostic AI control plane. Why enterprise architects should decouple agents from models.
sjwiggers.com
August 31, 2026 at 3:11 PM
Agent ≠ Model. Foundry's router picks the model per request, and the pool refreshes under a stable endpoint. The durable investment is the control plane, not today's model. Also in the post: where that's the wrong answer.
sjwiggers.com/2026/08/31/b...
sjwiggers.com/2026/08/31/b...
Cloudflare Workers can now accept inbound TCP. A connect(socket) handler routes raw sockets to a Worker, Durable Object, or Container.
gRPC is first on top: full duplex in Containers, unary and server-streaming in Workers.
Private beta.
www.infoq.com/news/2026/08...
gRPC is first on top: full duplex in Containers, unary and server-streaming in Workers.
Private beta.
www.infoq.com/news/2026/08...
Cloudflare Workers Accept Inbound TCP, with gRPC the First Protocol on Top
Cloudflare Workers can now accept inbound TCP connections through a new connect(socket) handler routed via Spectrum, ending an eight-year restriction to HTTP. Containers get full-duplex gRPC in any la...
www.infoq.com
August 31, 2026 at 5:59 AM
Cloudflare Workers can now accept inbound TCP. A connect(socket) handler routes raw sockets to a Worker, Durable Object, or Container.
gRPC is first on top: full duplex in Containers, unary and server-streaming in Workers.
Private beta.
www.infoq.com/news/2026/08...
gRPC is first on top: full duplex in Containers, unary and server-streaming in Workers.
Private beta.
www.infoq.com/news/2026/08...
In 2017, someone called my Cosmos DB demo "an hour-long marketing pitch," too pricey at €1,000/month.
Nine years on, it's replacing the cache + SQL + vector stack most AI agents use for memory. Post 1 of 6.
sjwiggers.com/2026/08/30/w...
Nine years on, it's replacing the cache + SQL + vector stack most AI agents use for memory. Post 1 of 6.
sjwiggers.com/2026/08/30/w...
Why Cosmos DB Ends Up as the Agent Memory Database - Cloud Perspectives
A 2017 Cosmos DB talk was dismissed as an expensive pitch. Here's why Cosmos DB agent memory now beats a stitched cache, SQL, and vector stack.
sjwiggers.com
August 30, 2026 at 12:16 PM
In 2017, someone called my Cosmos DB demo "an hour-long marketing pitch," too pricey at €1,000/month.
Nine years on, it's replacing the cache + SQL + vector stack most AI agents use for memory. Post 1 of 6.
sjwiggers.com/2026/08/30/w...
Nine years on, it's replacing the cache + SQL + vector stack most AI agents use for memory. Post 1 of 6.
sjwiggers.com/2026/08/30/w...
Cloudflare Wallets gives agents three spending controls: an allowance, a merchant allow-list, a max transaction size.
Each checks one payment against a limit. None expresses a relationship between them.
Only handle claiming ships today.
www.infoq.com/news/2026/08...
Each checks one payment against a limit. None expresses a relationship between them.
Only handle claiming ships today.
www.infoq.com/news/2026/08...
Cloudflare Wallets Arrives Late to x402, and the Spending Controls Stop at the Payment
Cloudflare announced Wallets, giving agents a stablecoin balance and spending controls, though only handle claiming is live and squatting complaints have already surfaced. Payments run on x402, now ho...
www.infoq.com
August 28, 2026 at 11:18 AM
Cloudflare Wallets gives agents three spending controls: an allowance, a merchant allow-list, a max transaction size.
Each checks one payment against a limit. None expresses a relationship between them.
Only handle claiming ships today.
www.infoq.com/news/2026/08...
Each checks one payment against a limit. None expresses a relationship between them.
Only handle claiming ships today.
www.infoq.com/news/2026/08...
Identity secures who the agent is. It doesn't touch what a poisoned tool result makes the agent do :injection rides in as data the agent asked for, inside the loop, past the perimeter. Series finale:
sjwiggers.com/2026/08/27/w...
sjwiggers.com/2026/08/27/w...
When Agentic Workloads Break the PaaS Assumptions - Cloud Perspectives
Explore how agentic workloads challenge traditional assumptions in system integrations and transform operational dynamics.
sjwiggers.com
August 27, 2026 at 6:30 AM
Identity secures who the agent is. It doesn't touch what a poisoned tool result makes the agent do :injection rides in as data the agent asked for, inside the loop, past the perimeter. Series finale:
sjwiggers.com/2026/08/27/w...
sjwiggers.com/2026/08/27/w...
Every diagram of Functions behind API Management draws one arrow into the function. There is always a second one, and it skips every policy you wrote.
Six gaps the happy path leaves out, plus an azd sample that proves it.
sjwiggers.com/2026/08/26/a...
Six gaps the happy path leaves out, plus an azd sample that proves it.
sjwiggers.com/2026/08/26/a...
Azure Functions Behind API Management: What the Happy Path Diagram Leaves Out - Cloud Perspectives
The Client to APIM to Function diagram is right and incomplete. Six gaps that decide whether your Azure API design survives a security review, plus an azd sample.
sjwiggers.com
August 26, 2026 at 6:02 AM
Every diagram of Functions behind API Management draws one arrow into the function. There is always a second one, and it skips every policy you wrote.
Six gaps the happy path leaves out, plus an azd sample that proves it.
sjwiggers.com/2026/08/26/a...
Six gaps the happy path leaves out, plus an azd sample that proves it.
sjwiggers.com/2026/08/26/a...
"Is it built?" and "Can we operate it?" are different questions. A platform can pass the first comfortably and fail the second completely, and the second one decides go-live. On production readiness and the execution gap:
sjwiggers.com/2026/08/25/f...
sjwiggers.com/2026/08/25/f...
Production Readiness: Closing the Execution Gap - Cloud Perspectives
Explore the concept of production readiness and understand what it truly means for your integration platform.
sjwiggers.com
August 25, 2026 at 6:47 AM
"Is it built?" and "Can we operate it?" are different questions. A platform can pass the first comfortably and fail the second completely, and the second one decides go-live. On production readiness and the execution gap:
sjwiggers.com/2026/08/25/f...
sjwiggers.com/2026/08/25/f...
Power Automate isn't actually an Azure service. It's licensed through Microsoft 365/Power Platform, not Azure, a different bill and admin center than Functions or Logic Apps.
Wrote up all three: sjwiggers.com/2026/08/21/a...
Wrote up all three: sjwiggers.com/2026/08/21/a...
Azure Functions vs. Logic Apps vs. Power Automate: When to Use What - Cloud Perspectives
A practitioner's comparison of Azure Functions, Logic Apps, and Power Automate, covering integration realities, the Integration Account cost most guides skip, and why Power Automate is not actually Az...
sjwiggers.com
August 21, 2026 at 10:02 AM
Power Automate isn't actually an Azure service. It's licensed through Microsoft 365/Power Platform, not Azure, a different bill and admin center than Functions or Logic Apps.
Wrote up all three: sjwiggers.com/2026/08/21/a...
Wrote up all three: sjwiggers.com/2026/08/21/a...
A monitoring standard that depends on discipline isn't a platform capability; it's a hope. Observability and FinOps as one discipline in two currencies: what is the platform doing, and what is it costing?
sjwiggers.com/2026/08/20/a...
sjwiggers.com/2026/08/20/a...
Azure Observability and FinOps for Integration Architects - Cloud Perspectives
Explore azure observability and its crucial role in managing production environments effectively with visibility in costs and performance.
sjwiggers.com
August 20, 2026 at 7:36 AM
A monitoring standard that depends on discipline isn't a platform capability; it's a hope. Observability and FinOps as one discipline in two currencies: what is the platform doing, and what is it costing?
sjwiggers.com/2026/08/20/a...
sjwiggers.com/2026/08/20/a...