Leon Yen, Author at Inside Track Blog

Powering data governance at Microsoft with Purview Unified Catalog

Leon Yen — Thu, 05 Feb 2026 17:00:00 +0000

Data fuels everything that we do here at Microsoft, from the daily operations that keep the business running to the innovations that shape the future.

But as data sprawls across teams, systems, and borders, the task of ensuring that it remains secure, accurate, and well-governed is a daunting one. A sound approach to data governance is the backbone of responsible data use across the enterprise, creating clarity around data ownership and access.

In an organization the size of Microsoft, no single team can carry this responsibility on its own. Effective data governance must be a distributed effort across all departments and functions.

This story explains how our marketing organization uses the Microsoft Purview Unified Catalog to organize and standardize the data we rely on daily. By putting clear ownership, consistent definitions, and reliable governance in place, we’re turning fragmented, unreliable data into an advantage that supports faster decisions and more effective campaigns.

Data governance at scale

As companies grow, their data governance becomes increasingly complex, with different teams creating their own versions of key data concepts, often without realizing it. The complexity is most visible in the way users across an organization define foundational terms.

“We found adoption to be much easier when helping teams focus on building more value in their data instead of driving governance like a compliance effort.”
Nick Doughty, senior product manager, Microsoft Purview Unified Catalog

Examples in marketing include what counts as a customer (active vs. inactive, marketing- or sales-qualified), what constitutes sensitive data (personally identifiable information, behavioral data, partner data), and what a metric means (conversion, engagement, attribution windows).

When inconsistent practices take hold, ownership becomes murky. With the increasing demands that managing data quality and integrity put on our leaders and their teams, effective data governance becomes one more hurdle to productivity.

“We started off implementing data governance like an issue register,” says Nick Doughty, a senior product manager within Microsoft Purview Unified Catalog. “Then we progressed to more of an enforcement method, similar to how we were doing security at the time. We found that when we started to push really hard on teams, similar to how we drove other compliance efforts, it was difficult for them to justify or understand why they would want the added governance.”

The introduction of Microsoft Azure Purview in 2020 marked a turning point.

A united platform for data governance, security, and compliance, Purview helps organizations understand, protect, and manage data across environments. It also addresses fragmented data, lack of visibility into where sensitive data lives and how it moves, compliance complexity with regulations (including GDPR and HIPAA), and security risks.

“Our marketing teams used to spend hours hunting for the right customer list because multiple versions lived in different locations, each with unclear owners and inconsistent labels. Now our marketers can trust they are working from current information, while avoiding compliance risks associated with incorrect or unauthorized data.”
Sourabh Mathur, principal engineering lead, Global Marketing Engines and Experiences

The Purview Unified Catalog serves as the AI-powered backbone, automatically discovering, classifying, and organizing information so users can easily find and trust the data they need.

By launching the unified catalog, we gave our users a consistent way to understand and use their data, while reinforcing strong governance and compliance practices. The result is data that’s more discoverable, reliable, and actionable. (The product was renamed Microsoft Purview in 2022 and became part of Microsoft 365 compliance tools.)

“Our marketing teams used to spend hours hunting for the right customer list because multiple versions lived in different locations, each with unclear owners and inconsistent labels,” says Sourabh Mathur, a principal engineering lead in Global Marketing Engines and Experiences, who helped set up Purview for our marketing organization.

With the unified catalog in place, Purview surfaces the dataset, shows its lineage, and applies the correct sensitivity classifications.

“Now our marketers can trust they are working from current information, while avoiding compliance risks associated with incorrect or unauthorized customer data,” Mathur says.

Powering marketing at Microsoft with Purview

With more than 200 Microsoft Azure subscriptions, our marketing organization manages one of the largest data estates at the company. The team faces the constant challenge of scattered data, unclear data ownership, and inconsistent governance practices that slow down campaigns and increase compliance risk.

“Marketing can now scale governance across hundreds of data products, support self-service data collection with guardrails, automate access decisions, and enable AI workloads on trusted data.”
Deepak Kumar Biswal, principal software engineering lead, Global Marketing Engines and Experiences

By adopting Purview, our marketing team gained unified visibility, clearer classification standards, and smoother collaboration with other departments, like IT and legal. This reduces friction while strengthening data protection.

The result is an organization that moves faster with greater confidence in how it handles customer and campaign data.

Instead of relying on legacy knowledge, forcing users to dig through different servers and SharePoint sites, or constantly sending queries to the engineering teams, our marketing professionals can now explore the curated Purview Unified Catalog, making streamlined, efficient data discovery possible.

“Marketing can now scale governance across hundreds of data products, support self-service data collection with guardrails, automate access decisions, and enable AI workloads on trusted data,” says Deepak Kumar Biswal, a principal software engineering lead in Global Marketing Engines and Experiences. “Purview turns responsible data use into everyday practice, not extra work.”

Data governance and security: Two sides of the same coin

For our marketing organization, data governance and security are inseparable concepts. As soon as you have customer information, you need to make sure it’s secure—sensitive data must be carefully defined, consistently managed, and protected from misuse or breach.

Purview supports this goal by combining governance capabilities with security and compliance controls that provide added layers of protection.

Within marketing, the governance and security teams work closely together. Good governance measures ensure our data is properly defined and standardized, while strong security policies ensure it’s handled with proper safeguards. By pairing governance with strong security practices, our marketing team can remain compliant with data privacy laws, prevent misuse of sensitive information, and foster trust across their organization.

When our marketing team began its Purview journey five years ago, it adopted a centralized governance model. Much like the structure of a government—where federal, state, and local entities each play a role—our approach allows both centralized standards and local autonomy. This creates consistency across the organization without stifling agility.

Our Data Governance team took on the role of steward, defining standards, onboarding systems, and collaborating with its IT partners to connect data environments. Existing assets like data dictionaries and process flows were used to seed the catalog, ensuring the team started from known ground rather than reinventing definitions from scratch.

This deliberate, incremental approach allowed our marketing team to thoughtfully build out healthy governance practices. By moving slowly, the team learned from each step on its journey, refining processes and establishing consistent practices as it moved along.

For example, working closely with our team in Microsoft Digital allowed them to experiment with different ways of discovering and cataloging their data. This involved taking learn and refine how Purview tuned their data before they rolled anything out broadly.

Our goal is to transition to a completely federated model in which responsibility shifts outward. Rather than the marketing governance team doing all the stewardship, individual groups will take ownership of their data within Purview. This shift distributes accountability, embeds governance deeper into daily operations, and makes it easier for teams to monitor data quality and enforce standards on their own.

Impact across the enterprise

Since adopting Purview Unified Catalog, we’ve seen tangible results across our data estate and our data governance practices in marketing and across all verticals within the company. Here are some companywide highlights:

Better consolidation: We’ve unified five catalogs into one.
Increased scale: We added 250 data sources onboarded in six months, representing roughly 10 million assets.
Higher internal adoption: We set up more than 50 governance domains, an effort we supported with reusable training assets, guides, and onboarding materials.

The benefits also include and extend beyond marketing:

Teams across the company are gaining increased confidence in their data definitions.
Compliance and privacy obligations are being met more effectively.
Business value is being generated through better, more trusted use of data.
Organizations are benefiting from faster time-to-insight.

Launching the marketing governance domain

We’re using Purview to combine essential capabilities like data governance, classification, and quality checks across our Microsoft services, which creates a unified foundation for our enterprise-wide metadata management. These unified capabilities make Purview an indispensable tool for us, and for large-scale enterprises.

“With various role types like data curator and data reader, we can add more visibility into our data—where it lives, how it’s being used, and who are its primary owners. Clearly defining these parameters helps us use the data governance framework as a starting point and improve our data governance capabilities.”
Vinny Singh, principal program manager, Global Marketing Engines and Experiences

As early adopters of Purview Unified Catalog, the group launched the Marketing Governance domain, registering more than 200 data products using the Unified Catalog’s data map.

The products, spanning various datasets, are aligned with strict internal governance standards. This gives marketing the ability to govern, classify, and track data across its ecosystem—ensuring adherence to GDPR and other regulatory compliance measures.

“With various role types like data curator and data reader, we can add more visibility into our data—where it lives, how it’s being used, and who are its primary owners,” says Vinny Singh, a principal program manager in Global Marketing Engines and Experiences. “Clearly defining these parameters helps us use the data governance framework as a starting point and improve our data governance capabilities.”

Key takeaways

Our journey with Microsoft Purview Unified Catalog has generated key insights that you can apply to your own data governance efforts. These include:

Start small: Don’t try to “boil the ocean.” Begin with three to five governance domains and scale from there.
Leverage what you have: Data dictionaries, glossaries, and existing documentation provide a strong starting point for a governance platform founded on the Purview Unified Catalog.
Focus on value, not enforcement: Governance resonates when teams see how it helps them, not when it’s mandated.
Adapt to your organization: Each team at your company will use Purview differently. Flexibility helps encourage adoption.
Build community: Data governance is not a solo effort. Collaboration among stakeholders produces stronger standards and better results.

Try it out

Deploying Microsoft 365 Copilot in Viva Engage at Microsoft

Leon Yen — Thu, 18 Dec 2025 17:00:00 +0000

Microsoft Viva Engage is a critical tool for communicating with our employees internally here at Microsoft.

It’s where our employees go to have two-way dialogue, our leaders use it to engage with their teams, and it’s how we listen and respond to our employees at scale.

It was a major milestone internally at Microsoft when we brought Microsoft 365 Copilot to Viva Engage, first launched in the spring and expanded in September.

“Copilot in Viva Engage is allowing us to bring the power of generative AI to our employees where they are,” says Ife Kolawole, a senior product manager in Microsoft Digital, the company’s IT organization. “Our employees are using it to more easily discover conversations and topics that they’re interested in.”

With Copilot added in, it has become even more useful to our employees.

“It used to be that staying informed meant manually scrolling through updates to piece together what mattered,” says Soumik Maji, who leads customer feedback and go-to-market efforts for Copilot in Viva Engage for the Microsoft Viva product group. “As a user, I’d need to manually scroll through all the posts, pick communities I’m interested in, and try to keep up. Even with prioritization, it could be overwhelming.”

That’s no longer the case with Copilot in Engage.

“The Copilot feature enables users to get a quick summary of the conversations and comments across all communities.”
Soumik Maji, Senior Program Manager, Microsoft

Now employees can quickly catch up on all the communications they have access to across their community feeds, home feed, and posts from leaders. Copilot gives them real-time, comprehensive summaries of what’s most relevant to them, eliminating hours of manual scrolling and reading.

And because the process is fully automated, people can surface key insights with just a single click.

“The Copilot feature enables users to get a quick summary of the conversations and comments across all communities,” Maji says. “For example, if Satya Nadella shares a post about a major company initiative, Copilot helps me quickly understand the sentiment of all the comments and highlights the main themes being discussed.”

Read our Viva Engage guide

Community with purpose: Deploying Viva Engage at Microsoft in three chapters

The leader’s perspective

Here at Microsoft, leaders use Viva Engage to connect and listen to employees. However with the volume and scale of information that is shared, they also need a way to listen and respond to what matters most.

“Now with Copilot in Engage, I can instantly see what’s trending, understand how it connects to my team’s priorities, and communicate authentically. I can address feedback from employees based on these conversations from Copilot in our next All hands, or with a post in our community.”
Murali Sitaram, corporate vice president, Viva Engage

Staying connected required scrolling through feeds and piecing together context.

That’s changing.

“Now with Copilot in Engage, I can instantly see what’s trending, understand how it connects to my team’s priorities, and communicate authentically,” says Murali Sitaram, corporate vice president for Viva Engage. “I can address feedback from employees based on these conversations from Copilot in our next All hands, or with a post in our community.”

It’s another effective way that we’re bringing Copilot to where our employees—and our customers—are living at work.

“Powered by organizational data, Copilot is evolving from a helpful assistant into a true strategic partner-one that helps me inspire, inform, and engage at scale,” Sitaram says.

Powering Corporate Communications with Viva Engage

Community engagement in Viva Engage started with thoughtful, but manual processes that built strong connections. Now Copilot in Engage elevates those efforts with intelligence and time-saving tactics.

“We would have to dig through hundreds of comments and posts to get an idea of what employees were engaging with. It was a lot of effort, especially when trying to respond or adjust strategy in real time.”
Amy Morris, director of global employee and executive communications and employer brand, Microsoft

Amy Morris, director of global employee and executive communications and employer brand, and John Cirone, senior director of global employee and executive communications, describe how challenging and resource-intensive it was for their Corporate Communications team to connect with employees across the company.

“We would have to dig through hundreds of comments and posts to get an idea of what employees were engaging with,” Morris says. “It was a lot of effort, especially when trying to respond or adjust strategy in real time.”

Morris and Cirone oversee global communications for all employees across the company and lead the Global Executive and Employee Communications team (GEEC), which supports communicators throughout Microsoft as they work to scale the company’s internal communications. They invested time thoughtfully reviewing conversations and tracking sentiment to understand what mattered most to employees.

This often left Viva Engage community managers relying on intuition and scattered anecdotal feedback. Decisions about content and engagement were slow, driven by guesswork, and difficult to scale. Now Copilot accelerates that process with AI.

“Before Copilot, we had manual efforts for community management, like analyzing trends and themes, which meant a lot of manual effort for community management,” Morris says. “But now Copilot helps by providing insights from community conversations, sentiment analysis, and content suggestions for leaders. We can easily see what’s trending, which helps us be more responsive.”

Staying connected to what matters most

Community managers must stay closely connected to the audiences they serve, and one of the most effective ways to achieve this is by providing accurate and thoughtful responses to the questions that matter most to them.

“As a community manager, I can appreciate a huge time savings, since Copilot helps by surfacing answers to frequently asked questions,” Morris says. “It gives a first-pass answer based on the resources available in the community and has been a huge help in reducing manual work.”

With Copilot in Viva Engage, much of this responsiveness is seamlessly automated.

“The insights we get from Copilot, like understanding what employees are discussing, have been incredibly useful. They help us tune into the conversations that matter most, and with real-time feedback, we can adjust our strategy quickly. It’s all about listening and responding at scale to employees.”
John Cirone, senior director of global employee and executive communications, Microsoft

Copilot also helps leaders create content by suggesting relevant topics based on community sentiment. This is a major time-saver and helps our teams focus their content creation efforts on what employees are most engaged with.

“The insights we get from Copilot, like understanding what employees are discussing, have been incredibly useful,” Cirone says. “They help us tune into the conversations that matter most, and with real-time feedback, we can adjust our strategy quickly. It’s all about listening and responding at scale to employees.”

For communicators working across multiple platforms, Copilot offers a seamless way to pull together the information they need to create posts that are timely, relevant, and meaningful. Its ability to tailor content for the right audience is especially helpful for leaders sharing updates with their teams or the broader organization.

“We want to be able to find those conversations and use that feedback to make improvements.”
Eva Etchells, senior content program manager, Microsoft Digital

Still, one of the biggest hurdles is often just getting the first words on the page.

“Employees often experience writer’s block when trying to craft a message,” Maji says. “Copilot helps by pulling together the relevant information from your Microsoft Graph, your emails, meetings, and Teams chats, and uses that data to generate a tailored post. Whether you’re summarizing your week’s work or sharing a company initiative, Copilot gives you the structure and content you need.”

IT Communications and community content

In Microsoft Digital, we often run marketing campaigns and promotions in Viva Engage to let employees know about new features that we’d like them to try or other similar updates. For example, we might encourage them to try a new Copilot feature or inform them about an upcoming change that they will need to make to their PCs.

Our goal is always to raise awareness and encourage adoption, but we also want feedback. While employees do provide feedback within apps, they also often go to Viva Engage to post about their issue or complaint.

“We want to be able to find those conversations and use that feedback to make improvements,” says Eva Etchells, a senior content program manager within Microsoft Digital.

Copilot in Viva Engage is also helping the IT Communications team identify important trends that they should respond to.

“Copilot’s features can help us track trending topics and identify common questions. It gives us a better understanding of what people are asking about and helps us provide more targeted responses.”
Sarah Lundy, senior content program manager, Microsoft Digital

For example, Sarah Lundy, a senior content program manager for Microsoft Digital, is currently working on communications for the Employee Self-Service Agent that supports HR, help desk, and campus services.

She’s using Copilot in Viva Engage to gather community feedback on the agent, to quickly consolidate that feedback into actionable insights, to summarize the top themes that it calls out, and to generate content based on those insights.

“It’s a huge time-saver,” Lundy says.

Lundy also manages a community called “TechConnect,” where employees can bring their questions about Microsoft Digital.

“Copilot’s features can help us track trending topics and identify common questions,” Lundy says. “It gives us a better understanding of what people are asking about and helps us provide more targeted responses.”

With faster, more accurate insights, the IT Communications Team and the individual employees who lead Viva Engage communities can both more easily stay responsive to the needs of each community at the company.

“If I need to create an FAQ or a content piece based on what’s trending in a particular community, Copilot can help pull all that information together and save me time,” Lundy says. “I’m excited to see how it will help me stay on top of community conversations, especially as things ramp up.”

Key takeaways

Keep in mind the following crucial considerations when implementing Microsoft 365 Copilot in Viva Engage to improve your enterprise’s internal communication at scale:

Start with clear objectives: Define what Copilot should help solve—content creation, summarization, trend detection, or feedback consolidation.
Be specific with prompts: The more specific and detailed your request, the better results you’ll get, and clear prompts lead to clearer insights.
Treat Copilot as a collaborator: AI works best with humans-in-the-loop, where users iterate, refine, and build on its suggestions.
Promote adoption through real examples: Leaders should use Copilot publicly and share their results and learnings to inspire employees.
Create your own Microsoft 365 Copilot community: Having a centralized Copilot community helps your employees get access to the latest updates and serves as a knowledge base for questions, answers and experts.

Try it out

Microsoft 360 Copilot in Viva Engage is available to customers with the appropriate Microsoft 365 Copilot license. The functionality, which includes easy-to-use catch-up features and content generation tools, is now a central part of our employee experience.

‘Putting your meetings in your earbuds’: How we now catch up on missed meetings with Audio Recap podcasts

Leon Yen — Thu, 09 Oct 2025 16:00:00 +0000

Here at Microsoft, we’re putting our meetings into our earbuds.

That’s the best way to think about the new Audio Recap feature in Microsoft Teams.

Designed to cut through the noise of information overload, it’s a new feature that transforms recorded meetings into easy to digest podcast-style summaries.

For our employees juggling scheduling conflicts, this feature is a game-changer—instead of sifting through lengthy transcripts or replaying entire recordings, they can quickly catch up by listening to concise, tailored recaps.

“It’s like putting your meetings in your earbuds,” says Lesley Montgomery, a principal product manager within Microsoft Digital, the company’s IT organization. “It’s flexible, mobile, and makes catching up on meetings unexpectedly engaging.”

Think about your favorite podcasters talking conversationally about a meeting that you need to catch up on—that’s what this is like.

Boosting meeting accessibility in the modern workplace

Our employees frequently find themselves double- or even triple-booked, forcing them to choose which meetings to attend live and which to skip. Audio Recap provides a practical solution by making missed content far more accessible. With this feature, employees can catch up on discussions while commuting, working out, or even during short breaks between tasks. No need to carve out extra time to sit down at a desk, open a transcript, and scroll through pages of text.

“With Audio Recap, any recorded Teams meeting can be rendered as an audio recap, like a podcast. Instead of reading through a transcript or replaying the entire recording, it lets you take a recorded meeting and turn it into a podcast session.”
Lesley Montgomery, principal product manager, Microsoft Digital

Audio Recap also reflects the reality and needs of today’s digital-first culture, where people expect information to be quick, available on mobile, and consumable on their own terms. Just as TikTok popularized short-form video and podcasts redefined long-form storytelling, Audio Recap is a new medium for workplace knowledge sharing—one that respects time, privacy, and attention spans.

“With Audio Recap, any recorded Teams meeting can be rendered as an audio recap, like a podcast,” Montgomery says. “Instead of reading through a transcript or replaying the entire recording, it lets you take a recorded meeting and turn it into a podcast session.”

Audio Recap allows for a high degree of customization, and users can tailor how their recap is delivered—choosing the timeframe, selecting up to eight meeting transcripts, and picking from three distinct podcast styles to match their listening preferences:

Executive: Dual-host format highlighting strategic insights, critical decisions, and essential context
Newscast: Single-voice delivery focused on key facts for quick, no-frills catch-up
Casual: Conversational dual-host style offering lighter, more engaging summaries

This level of personalization ensures that each employee gets the version of the recap that works best for them. Some may want the highlights in five minutes; others may prefer a more narrative-style recap to catch subtle details.

“I literally just did an audio recap of some meetings this week,” says Sara Bush, a principal PM manager within Microsoft Digital. “And they were so good that I took the transcript for one and made it into a PowerPoint deck—all using AI, in minutes. I chose the newscast version, which is more succinct.”

Audio Recap also streamlines meeting reviews through consolidation. Instead of jumping between multiple meeting links or trying to track down recordings, users can view all recorded meetings in a single, unified space. By stitching together multiple recaps, Audio Recap creates a smoother experience and helps reduce friction in catching up on important discussions.

This also ensures employees don’t miss critical updates, even if their calendars are packed. Imagine a day with five overlapping meetings. Instead of toggling between recordings and transcripts, an employee can simply request audio recaps of each meeting and listen to them in sequence. It’s like having a personalized “meeting playlist” that makes the workday easier to manage.

Designed for users, built on privacy and convenience

Audio Recap was developed out of a collaboration between our product groups and our team here at Microsoft Digital, acting as Customer Zero for the company, which means testing features internally before the company rolls them out to customers. Our focus has been squarely on user benefit, not just product capability. By looking closely at how Audio Recap fits into real workflows, we’ve ensured the feature aligns with user needs. The guiding principle for us is to meet employees where they are and let them consume meeting information in ways that feel natural, intuitive, and efficient.

Privacy is another element that Audio Recap adds to the meeting replay experience. Reading transcripts or replaying video meetings can lead employees to feel exposed, especially in shared workspaces where colleagues might glance at their screen. With audio, employees can simply plug in their headphones and consume content discreetly. This not only protects sensitive information but also adds comfort and flexibility. Whether at home, in the office, or on the go, users can catch up on meetings without feeling tethered to a desk.

“You can be mobile, take it with you, and listen on the go—without worrying about someone looking over your shoulder,” Montgomery says. “It’s flexible, convenient, and makes catching up on meetings a fun and engaging experience.”

Staying current with generation TikTok

The workplace is evolving alongside cultural shifts in how people consume content.

“With this solution, we’re solving for time. We’re simplifying and democratizing communication in the ways that people take it in best, or prefer to take it in.”
Sara Bush, principal PM manager, Microsoft Digital

Quick, engaging formats on mobile devices dominate outside of work—and employees expect similar options inside the workplace.

Audio Recap taps into this trend by making meeting content consumable in the same way people enjoy podcasts or streaming audio.

By offering meetings in podcast form, Microsoft Teams continues to evolve as a modern, forward-looking platform that keeps pace with the changing expectations of a digital workforce.

“With this solution, we’re solving for time,” Bush says. “We’re simplifying and democratizing communication in the ways that people take it in best, or prefer to take it in. For example, this podcast summary for my drive to work is a perfect format for me, whereas that quick video format might be just right for somebody else.”

Audio Recap is part of the company’s broader effort to reshape how work gets done in a digital-first era. By giving employees the freedom to decide how they consume meeting information, Teams becomes not just a tool for collaboration, but a productivity amplifier.

Meetings are a necessary part of work, but how we handle the content they generate doesn’t have to feel outdated. Audio Recap makes catching up not only easier, but also more enjoyable—and where time and attention are in short supply, this shift is invaluable.

Key takeaways

If you’re interested in providing employees with a new productivity tool to streamline Teams meeting recaps, take note of these practical scenarios where Audio Recap shines:

Overbooked calendars: Catch up on two or three meetings you couldn’t attend live without wasting extra hours.
Long commutes: Turn drive time or train rides into productive catch-up sessions.
Global teams: Recaps can bridge time zones, letting employees listen when it’s convenient rather than staying up for late-night calls.
Focus time: Instead of multitasking during a live meeting, employees can skip it, then consume the recap later when they can give it full attention.

Try it out

Download Microsoft Teams today.

Transforming our VPN with Global Secure Access at Microsoft

Leon Yen — Thu, 25 Sep 2025 16:00:00 +0000

Ensuring safe and secure access to resources in the enterprise has always been a delicate balance. Protecting corporate assets from intrusions and misuse is paramount. But a system that neglects usability for employees creates frustration and inefficiencies.

At Microsoft, we’re in the midst of a major transformation in how we manage access to our corporate resources. The cornerstone of this change is Microsoft Global Secure Access (GSA), a security service edge (SSE) solution that replaces traditional VPNs with a modern, identity-centric model. GSA provides three core services integrated into a unified framework: Microsoft 365 Access, Internet Access, and Private Access. This approach not only strengthens our enterprise security posture but also simplifies connectivity for both users and administrators.

“Years ago, the concept of a VPN was simple: a single virtual private network gave employees access to the company’s entire internal network. Today, this model presents serious risks.
Pete Apple, principal cloud network engineer, Microsoft Digital

Over 158,000 of our employees are already using the GSA client and Microsoft 365, with full rollout of private and internet access planned in the coming months. Here’s how we’re building a more secure, seamless, and future-ready access experience across Microsoft’s ecosystems.

Beyond VPNs: the future of secure access

The idea that an internal network is inherently safer than the open internet has always been risky, and modern threats make that assumption dangerous. This is why we’ve embraced the Zero Trust model, shifting away from blanket access and moving toward least-privilege access—ensuring users only get what they need, when they need it, and nothing more.

Adopting a Zero Trust approach across the enterprise makes moving beyond traditional VPNs imperative. For years, we’ve relied on Microsoft VPN and Azure VPN to access internal resources. While effective, these traditional models operate on an “all-or-nothing” basis: once connected, employees gain broad access, regardless of role or security context.

“Years ago, the concept of a VPN was simple: a single virtual private network gave employees access to the company’s entire internal network,” says Pete Apple, a principal cloud network engineer in Microsoft Digital, the company’s IT organization. “Today, this model presents serious risks. If a user’s identity or device is compromised—or if a man-in-the-middle attack occurs—the attacker can connect through the VPN and gain broad access to sensitive data, soft targets, and critical systems.”

“One of the primary reasons for this shift to GSA is that we get more granularity within this identity-based security solution that we can control access on a very fine level.”
Gary Triv, principal network engineer, Microsoft Digital

This creates challenges for organizations like ours—and yours.

That’s where GSA can help.

It shifts the paradigm by introducing fine-grained, identity-based controls. Through deep integration with Microsoft Entra, administrators can enforce policies that adapt in real time, ensuring only the right users, devices, and conditions grant access to sensitive resources.

“One of the primary reasons for this shift to GSA is that we get more granularity within this identity-based security solution that we can control access on a very fine level,” says Gary Triv, a principal network engineer in Microsoft Digital.

The four pillars of GSA security

Our focus on security is built into everything we do.

“Conditional access, identity-centric controls, and other core elements of Zero Trust are built directly into the solution,” says Lalitha Mahajan, global technical program manager for Global Secure Access.

At the heart of GSA are four foundational security features:

Conditional Access (CA): Unlike VPNs, which provide blanket access, CA enforces contextual rules to ensure role-appropriate access at all times. For example, an engineer may be allowed access to a security portal, while another user may only see Power BI dashboards.
Continuous Access Evaluation (CAE): Access control doesn’t stop at login. CAE evaluates user context in real time. If an employee’s role changes, their credentials are revoked, or they leave the company, their active sessions are immediately terminated.
Network Filtering: GSA allows administrators to define exactly where users can go on the internet or within corporate networks. This ensures employees have access only to approved destinations, reducing exposure to threats.
Compliant Network (CN): Access is tied to the source network. For instance, a device in Redmond may be allowed, but the same device in an untrusted region could be blocked automatically.

Together, these pillars make GSA a secure and adaptive solution, fully aligned with the principles of Zero Trust.

“With the Zero Trust model, our goal is to enforce least-privilege access. That means locking down internal resources, improving segmentation, and using firewalls and other controls so users can’t reach everything by default,” Apple says. “Instead of relying on a blanket VPN network, we’re moving to the Entra Global Secure Access model, which combines network and identity. Instead of granting broad visibility into the entire internal network, access can now be scoped to a user’s identity—so employees only connect to the resources defined for them.”

“Unlike traditional VPNs, GSA delivers both client-side and server-side insights, all of which we own. This gives us deeper visibility and allows us to make the data more actionable for our use cases.”
Lalitha Mahajan, program manager, Microsoft Digital

A perfect example is a Microsoft developer—one of our most common employee roles.

Our developers may need access to specific source code, certain labs, and designated file shares. With GSA, we can grant access only to those resources—and nothing else. This shift from a blanket “once connected, you can see everything” approach, to a tightly defined, identity-based model is a major security improvement and one of the most exciting reasons we’re moving forward with this product.

A key differentiator and critical Zero Trust enabler is GSA’s rich telemetry, which provides real-time visibility into user activity, device health, and network traffic. This continuous stream of data enables early detection of threats, anomaly detection, and precise policy enforcement—strengthening Zero Trust in practice.

“Unlike traditional VPNs, GSA delivers both client-side and server-side insights, all of which we own,” Mahajan says. “This gives us deeper visibility and allows us to make the data more actionable for our use cases.”

The key components of GSA

Private Access is just one of three offerings that make up GSA. Together, these offerings are unified under a single client that creates three dedicated tunnels—one for each service—while administrators centrally define routing and policy rules. GSA consists of:

Microsoft 365 Access: Optimized, policy-controlled connectivity for Office apps and services.
Internet Access: Secure browsing with TLS inspection, URL filtering, and content controls.
Private Access: A modern replacement for legacy VPNs that enable granular access to internal resources.

For Internet Access, GSA supports two deployment models: branch connectivity, where IPSec tunnels secure traffic from devices without a client (like printers), and client connectivity, where the GSA client routes laptop or desktop traffic directly to the GSA Edge. Both approaches enforce consistent policies, differing only in how traffic reaches the framework.

Advanced features and monitoring

Unlike fragmented VPN and firewall logs, GSA provides consistent visibility through unified logging, which consolidates session data—including user identity, device, source, destination, and applied policies—into a single view. We can now easily validate whether security features are working as intended and forward logs to Microsoft Sentinel for extended monitoring.

This holistic view provides us with a major advantage against cyber threats, enabling faster investigations and clearer correlations between user behavior and network activity.

Our rollout of GSA is well underway internally at Microsoft. With more than 158,000 GSA client and Microsoft 365 users already onboard, the next phase will expand private access company-wide, followed by broader adoption of internet access. Early pilots have demonstrated strong results, with positive feedback on both usability and the ability to solve unique access challenges.

By delivering a complete, identity-based secure access solution—spanning Microsoft 365, internet, and private connectivity—Microsoft is redefining enterprise access for the cloud-first era. The result is a future where connectivity is not only seamless but also secure, adaptive, and tightly aligned with user identity and context.

Key takeaways

Our experience transitioning to GSA Private Access has left us with several key insights that other enterprises can apply to their own efforts to modernize remote access:

Adopt least-privilege access: Move away from blanket network access to ensure employees only reach the resources they need.
Reduce risk from compromised accounts: Limit the blast radius of identity or device breaches by segmenting and scoping access.
Continuously evaluate trust: Treat access as dynamic, adapting in real time to changes in user roles, device health, or network conditions.
Improve visibility through telemetry: Use detailed activity and traffic data to spot anomalies early and strengthen security decisions.
Unify security and connectivity: Align access with identity and context, creating a balance between strong protection and seamless user experience.

Try it out

Smarter labs, faster fixes: How we’re using AI to provision our virtual labs more effectively

Leon Yen — Thu, 24 Jul 2025 16:00:00 +0000

Providing technical support at an enterprise of our size here at Microsoft is a constant balancing act between speed, quality, and scalability. Systems grow more complex, user expectations continue to rise, and traditional support models often struggle to keep up. Beyond the usual apps and systems everyone uses, many of our employees require virtual provisioning for diverse tasks in many of our businesses. Supporting these virtualized environments is a special challenge.

To meet the growing demand for virtual lab usage across the organization, we turned to AI, not just to automate support responses but to fundamentally rethink how user issues are identified and resolved. This vision came to life through the Managed Cloud Labs platform (formerly called MyWorkspace), where we in Microsoft Digital, the company’s IT organization, introduced a domain-specific AI assistant to streamline how we empower our employees to deploy new virtual labs.

The results have been dramatic: what was once a slow, manual process is now fast, efficient, and frictionless.

But the benefits extend beyond faster resolution times. This transformation represents a new approach to enterprise support—one that uses AI not just as a tool for efficiency, but as a strategic enabler. By embedding intelligence into the support experience, we’re turning complexity into a competitive advantage.

Scaling support in a high-demand environment

Managed Cloud Labs is our internal platform for provisioning virtual labs. Originally developed to support internal testing, diagnostics, and development environments, it has since grown into a critical resource used by thousands of engineers and support personnel across the company.

Scaling the platform infrastructure was straightforward—adding capacity for tens of thousands of virtual labs was a technical challenge we could solve with ease, thanks to our Microsoft Azure backbone. As usage grew, the real strain didn’t show up in CPU load or storage limit, but rather in the support queue—every few months, a new wave of users was onboarded to Managed Cloud Labs: partner teams, internal engineers, and external vendors. These new users, often with minimal experience of the platform, needed fast access and guidance from support.

The questions, though simple, piled up quickly.

Several Tier 1 support engineers repeatedly encountered the same questions from users, such as how to start a lab, what an error meant, and which lab to use for a particular test. These weren’t complex technical issues—they were basic, repetitive onboarding questions that represented a huge opportunity to introduce automation.

“We also found that there were a lot of users who found more niche issues, and those issues had been solved either by our community or by ourselves. In fact, we had a dedicated Teams channel specific to customer issues, and we found that there was a lot of repetition and that other customers were facing similar issues, and we did have a bit of a knowledge base in terms of how to solve these issues.”

Joshua Deans, software engineer, Microsoft Digital

Unblocking a bottleneck with AI

Our support team set out to tackle a familiar but costly challenge: high volumes of low-complexity tickets that consumed valuable time without delivering meaningful impact. Instead of treating this as an unavoidable burden, we saw an opportunity to turn it into a self-scaling solution. If the same questions were being asked repeatedly—and the answers already existed in documentation, internal threads, or institutional knowledge—then an AI system should be able to surface those answers instantly, without human intervention.

“We also found that there were a lot of users who found more niche issues, and those issues had been solved either by our community or by ourselves,” says Joshua Deans, a software engineer within Microsoft Digital. “In fact, we had a dedicated Teams channel specific to customer issues, and we found that there was a lot of repetition and that other customers were facing similar issues, and we did have a bit of a knowledge base in terms of how to solve these issues.”

That insight led the team to begin building what would become a transformative AI assistant: an automated support layer purpose-built for the Managed Cloud Labs platform. Unlike traditional chatbots that rely on scripted responses or rigid decision trees, this assistant would leverage generative AI trained on a rich dataset of real-world support conversations, internal FAQs, and official documentation.

“So that’s where we found this opportunity to turn this scaling challenge into a scaling advantage, with help from AI. We took all those historical conversations of tier one staff helping new users—trained our AI to provide user education based on that training—and saved our Tier 1 staff from answering potential tickets.”
Vikram Dadwal, principal software engineering manager, Microsoft Digital

The result was a context-aware, responsive system capable of resolving common issues in seconds—not hours or days—dramatically easing the load on support teams while improving the user experience.

Built on Azure and Semantic Kernel

The Managed Cloud Labs core infrastructure is fully built on Azure services. At any given moment, it manages tens of thousands of virtual machines, scaling up and down with demand. That elasticity, combined with our internal developer tooling and AI orchestration capabilities, provided the perfect environment for an AI-powered support layer.

“So that’s where we found this opportunity to turn this scaling challenge into a scaling advantage, with help from AI,” says Vikram Dadwal, a principal software engineering manager within Microsoft Digital. “We took all those historical conversations of tier one staff helping new users—trained our AI to provide user education based on that training—and saved our Tier 1 staff from answering potential tickets.”

To build the assistant, the team used our Microsoft open-source framework, Semantic Kernel. Designed for generative AI integration, Semantic Kernel allows engineers to create prompt-driven, modular systems that can interact with large language models (LLM) without vendor lock-in.

This approach gave the team several advantages:

Flexibility in choosing and switching between LLM providers.
Fine-grained control over how prompts were structured and updated.
Extensibility through plugins and actions that tie the assistant into the broader ecosystem.

Crucially, the assistant was designed to be part of the platform’s architecture, capable of operating at the same level of scale and responsiveness as the labs it supported. Also, the assistant was initialized with a well-scoped system prompt, limiting its responses strictly to the Managed Cloud Labs domain.

“On average, we measured these interactions at around 20 minutes from ticket submission to problem resolution. Now compare that with a 30-second AI interaction for resolving the same class of issues—that’s a 98% reduction in resolution time, a number we’ve validated with our support team and continue to track.”
Nathan Prentice, senior product manager, Microsoft Digital

Shifting from tickets to conversations

Whether users had questions about lab types, needed clarification on configuration details, or sought guidance during onboarding, the AI provided accurate, interactive responses without requiring human escalation. The experience was both faster and significantly better. Support engineers saw a noticeable reduction in repeat tickets, as common issues were resolved on the spot. Onboarding friction decreased, and users were confident that they could get the answers they needed instantly—no ticket, no delay, no need to track a support contact.

“On average, we measured these interactions at around 20 minutes from ticket submission to problem resolution,” says Nathan Prentice, a senior product manager in Microsoft Digital. “Now compare that with a 30-second AI interaction for resolving the same class of issues—that’s a 98% reduction in resolution time, a number we’ve validated with our support team and continue to track.”

Smart, interactive, and intuitive

Our Microsoft Digital team has recently implemented a new version of the Managed Cloud Labs AI assistant that includes several major enhancements. The assistant now features adaptive cards, polished layouts, and a Microsoft 365 Copilot-aligned user experience, making it feel familiar and trustworthy for internal teams. The assistant can now distinguish between a question and an action. If a user says, “Start a SharePoint lab,” it responds with an interactive card and begins provisioning, bridging the gap between passive support and active enablement.

“One of the primary bottlenecks we previously faced in creating an AI solution to address frequently asked user questions was the lack of technology capable of generating accurate answers for complex technical queries and understanding nuanced user input. With the availability of Azure OpenAI models, we were able to effectively overcome this challenge, enabling our AI solution to deliver precise and context-aware responses at scale.”

Anjali Nair, senior software engineer, Microsoft Digital

To guide our employees and improve discoverability, the assistant offers recommended prompts—just like Copilot does—helping new users understand what they can ask and how to get started.

Users can now rate responses, giving a thumbs up or down. These signals are aggregated and reviewed by the engineering team, ensuring continuous improvement and fine tuning over time.

Intelligent provisioning with multi-agent orchestration

At Microsoft Digital, we’re reimagining how labs are provisioned by integrating AI-driven intelligence into the process. Traditionally, users are expected to know exactly what kind of lab environment they need. But in complex virtualization and troubleshooting scenarios, these assumptions often fall short. Should a user troubleshooting hybrid issues with Microsoft Exchange spin up a basic Exchange lab, or one that includes Azure AD integration, conditional access policies, and hybrid connectors? To eliminate this guesswork, our team is building a multi-agent system powered by the Semantic Kernel SDK multi-agent framework. This system interprets the user’s support context—often expressed in natural language—and automatically provisions the most relevant lab environment.

For example, a user might say, “I’m seeing sync issues between SharePoint Online and on-prem,” and the assistant will orchestrate the creation of a tailored lab that replicates that exact scenario, enabling faster diagnosis and resolution. With agent orchestration, each agent in the system is specialized: one might handle context interpretation, another lab configuration, and another cost optimization. These agents collaborate to ensure that the lab not only meets technical requirements but is also cost-effective. By leveraging telemetry and historical usage data, the system can recommend leaner configurations—such as using ephemeral VMs, auto-pausing idle resources, or selecting lower-cost SKUs—without compromising diagnostic fidelity. This intelligent provisioning framework is designed to scale, adapt, and continuously learn from usage patterns.

“One of the primary bottlenecks we previously faced in creating an AI solution to address frequently asked user questions was the lack of technology capable of generating accurate answers for complex technical queries and understanding nuanced user input,” says Anjali Nair, a senior software engineer in Microsoft Digital. “With the availability of Azure OpenAI models, we were able to effectively overcome this challenge, enabling our AI solution to deliver precise and context-aware responses at scale.”

With multi-agent orchestration, we’re taking a step towards a future where lab environments are not just automated, but intelligently orchestrated, context-aware, and cost-optimized—empowering engineers to focus on solving problems, not setting up infrastructure.

Scaling support without scaling headcount

The Managed Cloud Labs assistant is a powerful example of how enterprise support can evolve through intelligence. By embedding AI into the support experience, we’ve turned complexity into a competitive edge—reshaping knowledge work and operations through AI’s problem-solving capabilities. As Microsoft advances as a Frontier Firm, Managed Cloud Labs shows how we can scale support on demand, with intelligence built in. Routine queries are offloaded to AI, freeing Tier 1 teams to focus on critical issues and giving Tier 2 engineers space to innovate. Most importantly, support now scales with user demand—not headcount.

But this system does more than just respond—it learns. Every interaction becomes a data point. Each resolved issue feeds back to the assistant, sharpening its accuracy and expanding its knowledge. What started as a reactive Q&A tool is now growing into a proactive orchestrator that surfaces insights and points users to solutions, resolving issues before they ever become tickets.

“We have a lot more telemetry now, so users can provide feedback to our responses—for example, thumbs up or thumbs down feedback,” Deans says. “And we can actually view where the model is giving incorrect or inappropriate information, and we can use that to make adjustments to the prompt provided to the model.”

In this model, support becomes a seamless extension of the user experience. With the right AI architecture in place, it transforms a cost center into a strategic asset. The assistant fulfills its role as an embedded, intelligent teammate—delivering answers, driving actions, and continuously improving over time.

Ultimately, our journey with Managed Cloud Labs shows that meaningful AI adoption doesn’t have to begin with sweeping transformation. Sometimes, it starts with a helpdesk queue, a recurring issue, and the choice to build something smarter—something that learns, adapts, and empowers at every step.

Key takeaways

Here are some of our top insights from boosting our internal deployment of Managed Cloud Labs with AI and continuous improvement.

Start small and specific. Focus on a defined domain—like Managed Cloud Labs—and use existing support logs to train your assistant.
Invest in AI infrastructure. Tools like Semantic Kernel provide flexibility, especially in enterprise settings where vendor neutrality and customization matter.
Design for trust. Align your assistant’s UI with well-known systems like Microsoft Copilot to build user confidence.
Don’t wait for perfection. Launch a V1, gather feedback, and make improvements. AI assistants get better over time if you let them learn.
Think outside the ticket queue. The future isn’t just faster support—it’s intelligent, anticipatory systems that eliminate friction before it begins.

Try it out