For years, our security groups operated without consistent, policy‑based guardrails. As a result, we couldn’t uniformly control guest access to sensitive resources or apply governance consistently across different group types.

Addressing this required a complex, coordinated effort by our team here in Microsoft Digital, the company’s IT organization, and the Microsoft Entra product team.

“Because IT security is our highest priority at Microsoft, we knew we needed a better approach to limiting access to groups within our tenant. And we realized that Microsoft Entra was a powerful in-house solution that represented our best path forward to solve for this challenge.”

David Johnson, principal product manager architect, Microsoft Digital

The result is a new approach to sensitivity labels across the organization that strengthens our security posture, which benefits Microsoft and our customers.

“Because IT security is our highest priority at Microsoft, we knew we needed a better approach to limiting access to groups within our tenant,” says David Johnson, a principal product manager architect in Microsoft Digital. “And we realized that Microsoft Entra was a powerful in-house solution that represented our best path forward to solve for this challenge.”

Go deeper

Learn how to assign sensitivity labels to Microsoft Entra security groups.

Closing the security gap

Sensitivity labels for Microsoft 365 groups are labels that govern join and access restrictions for membership and sharing. They have been a product feature since 2020. But sensitivity labels for security groups—labels that enforce rules about who can join a group—had no equivalent.

This meant that organizations that wanted to govern who could join a security group or determine if guests are permitted and how group membership is managed had to either lock down the group creation process entirely, or rely on reactive scanning after the fact.

“Security groups are a key piece of our efforts to secure sensitive resources,” says Mohit Bhargava, a principal product manager on the Microsoft Entra team, which manages the Entra family of identity and network access products. “We wanted to apply policies to protect who could be in security groups so that the sensitive resources in those groups would remain secure.”

“Whoever gets into an Azure security group can have access to all the resources associated with the Azure subscription. That’s a potential high-severity threat.”

Basanth Kakumani, software engineer II, Microsoft Digital

The security risk is real. If an unauthorized guest account ends up as a member of a security group that governs access to an Azure subscription, that guest gains access to every resource inside that subscription.

“Whoever gets into an Azure security group can have access to all the resources associated with the Azure subscription,” says Basanth Kakumani, a software engineer II in Microsoft Digital. “That’s a potential high-severity threat.”

Another priority was the need for consistency across experiences.

“Microsoft 365 groups have supported labeling for a very long time,” Bhargava says. “Customers have an expectation that there’s parity across group types, so that they can govern them uniformly. That was another driving factor for this work.”

Security groups reuse the same sensitivity labels already configured for Microsoft 365 groups and SharePoint sites in Microsoft Purview—so admins don’t need to create or manage a separate set of labels. This reuse reduces configuration overhead and supports a more consistent governance model across group types.

Security workarounds, and why they fell short

Without sensitivity label support, we had to make do with alternative solutions. The most common one was simply preventing certain users from creating any security groups at all.

In the Microsoft tenant, this meant that employees who needed a security group had to fill out a form that had custom business logic behind it.

“We had on-premises, Active Directory, synchronization, tooling, and customization,” Johnson says. “This caused latency, from the time you created your group to the time it would show cloud membership. If you wanted to manage your membership, you had to do it on premises, AD, and then wait for it to sync to Entra.”

Neither centralized control nor reactive governance was a satisfying solution to prevent policy violations.

“This is really about making reactive things more proactive. We want to catch problems before they occur.”

John Begley, principal software engineer, Microsoft Digital

Typically, IT is going to manage this in one of two ways: Either we turn off self-service and manage everything on behalf of users, or we do reactive governance, which includes scanning groups and looking for policy violations.

Those aren’t super effective at preempting violations.

“This is really about making reactive things more proactive,” says John Begley, a principal software engineer in Microsoft Digital. “We want to catch problems before they occur.”

A collaborative solution

Coming up with a solution to this challenge required a genuine partnership.

We at Microsoft Digital approached the Entra product team and explained the problem we were trying to solve. Rather than simply handling this as a feature request, the two teams agreed to a co-development arrangement.

“Having access to a very large customer who cares deeply about security was extremely helpful. If it works for Microsoft, which is so complicated and huge, it’s going to work for smaller-sized tenants too.”

Mohit Bhargava, principal product manager, Microsoft Entra

Microsoft Digital team members would work alongside Entra engineers as the feature was built, serving simultaneously as implementation partner, design critic, and test environment—what we like to call our Customer Zero role.

Bhargava found the partnership equally illuminating from the product side.

“Having access to a very large customer who cares deeply about security was extremely helpful,” he says. “If it works for Microsoft, which is so complicated and huge, it’s going to work for smaller-sized tenants too.”

For Begley and his team, working closely with the product team revealed how complex the solution actually was.

“Both the product team and Microsoft Digital walked into this thinking a fix was going to be simpler than what it turned out to be,” Begley says. “It’s been eye-opening to see how the product is built, how it runs, what all the moving parts are. We learned early on that there was significant co‑development happening within Entra itself, across teams with very different areas of expertise.”

That dynamic played out in specific feature decisions. The team’s original plan did not include support for agent access controls and didn’t include the ability to prevent AI agents from joining sensitive security groups. This is something the product group quickly addressed and resolved after our team in Microsoft Digital raised it as a concern.

“One of the first customers who raised it was Microsoft Digital,” Bhargava says. “They said we needed need to start thinking about it ahead of time to get ahead of the problem.”

Sensitivity labels for Microsoft Entra cloud security groups are now in public preview. The same labels you publish in Microsoft Purview for Microsoft 365 groups and sites now apply to Entra security groups. Visit Microsoft Learn for scope, supported scenarios, and current preview behaviors.

Changes afoot for IT admins and employees

The practical impact of this solution lands on both sides of the relationship between Microsoft Digital and the company’s employees.

“Now I can’t accidentally have guests in an internal-only group, which changes the dynamic. Employees can create their own Entra security groups now, without us having to worry that they’ll be inviting guests where they shouldn’t be.”

David Johnson, principal product manager architect, Microsoft Digital

For IT admins, the shift is from reactive remediation to proactive prevention. For employees, it means self-service action with security groups become viable again, without the security risks that made organizations reluctant to enable it before.

“Now I can’t accidentally have guests in an internal-only group, which changes the dynamic,” Johnson says. “Employees can create their own Entra security groups now, without us having to worry that they’ll be inviting guests where they shouldn’t be.”

Johnson underscores the broader ambition behind the shift, which is to allow employees to create and manage groups directly in Entra.

“A company that can unblock self-service action by its employees with confidence, knowing that there’s an additional level of protection—that’s very important,” he says.

Looking ahead: AI and the expanding policy surface

Labeling support for security groups is already being extended across the organization, with AI governance in mind.

Adding the ability to block agents from joining sensitive security groups is our next logical step. Guest membership is enforced via allow-to-add guest policy, but agents won’t join in the same way. Rather, we will set policies in Purview and then use labels to control if an agent can join a group.

The longer-term vision involves extending oversharing prevention beyond Entra itself. This will make it impossible (not just detectable) to accidentally assign a highly confidential resource to an unlabeled or inappropriately scoped security group. The foundation we’ve built with labeling in Entra is what makes this vital step possible.

“We want to get into the preventative aspect,” Johnson says. “The goal is to make it so it’s not possible to overshare in the first place.”

Key takeaways

Here are some tips as you consider ways to address how you manage your own security labeling practices:  

• Reuse existing labels—no extra setup required. Security groups reuse the same sensitivity labels already configured for Microsoft 365 Groups and SharePoint sites in Microsoft Purview, eliminating duplicate configuration and helping admins apply a consistent governance model across group types.
• Understand label immutability at launch. Unlike Microsoft 365 Groups, sensitivity labels on security groups are initially immutable—a deliberate design choice to ensure protections are enforced from the moment a group is created. Controlled label mutability will be introduced in a subsequent update.
• Know what’s in scope today. Labeling currently applies to static, non–mail-enabled security groups. Dynamic membership groups, mail-enabled security groups, and distribution lists aren’t supported at launch, so admins should plan accordingly.
• Shift from reactive cleanup to proactive protection. Label-driven membership controls prevent policy violations—such as unintended guest access—before they occur, reducing the need for post-creation audits and remediation.
• Enable safe self-service with guardrails. With labels enforcing access rules automatically, employees can create and manage security groups without increasing risk, restoring self-service without sacrificing control.
• Lay the foundation for future governance scenarios. Using sensitivity labels as the backbone of access policy creates a scalable framework that can extend to additional protections over time, including broader enforcement and emerging governance needs.

Try it out

Learn more about configuring security with Microsoft Entra.

Related links

• Learn how we’re using sensitivity labels to make Microsoft more secure.
• Get an overview of Microsoft Entra fundamentals documentation.
• Find out how self-service sensitivity labels to help our employees stay productive without exposing sensitive information.
• See what it took to transition our company to a Zero Trust security model.
• Explore how we’re boosting our Secure Future Initiative with a new approach to wired network security.

The post Transforming our approach to sensitivity labels at Microsoft with Microsoft Entra appeared first on Inside Track Blog.

Now, a team in Microsoft Digital—the company’s IT organization—is working to shrink that lengthy nine-month timeline to a single day.

The problem is architectural.

As our cloud footprint has grown, it has evolved into something richly segmented, tightly secured, and increasingly automated—a far cry from the relatively flat, monolithic corporate network that we originally extended into the cloud.

Getting those two worlds—on-premises and the cloud—to talk to each other securely and efficiently has become one of our most stubborn infrastructure challenges.

The solution we’re building is a fundamentally new operating model for hybrid cloud integration. It’s powered by AI-driven intake, end-to-end automation, and a set of repeatable patterns that treat the cloud as the new core of the network, rather than a distant branch of the old one.

The gap between cloud speed and network complexity

To understand the problem our team in Microsoft Digital set out to solve, it helps to understand how our company’s network architecture evolved over the past decade. When Microsoft first embraced Azure, the cloud was conceived as an extension of the existing corporate network.

“We have a development assembly line, and our goal is to give engineers the most efficient, frictionless experience doing software development for the company. Every day we delay solving this issue systemically is another day for the problem to get bigger.”

Tom McCleery, principal group cloud network engineering manager, Microsoft Digital

But the cloud grew faster than anyone anticipated.

Product engineering teams, drawn by the speed and flexibility of cloud-native tooling, began self-organizing their systems in Azure. They built segmented, purpose-built environments optimized for security and automation that looked nothing like the sprawling on-premises network they were supposed to connect to.

This shift had real consequences for Microsoft developers.

A software engineer sitting in building 32 on campus, for example, might have her Azure environment provisioned in half a day. But if she needed network connectivity to a physical Azure Stack lab down the hallway, getting that connection established—through firewalls, virtual routing frameworks, access control lists, and cross-team coordination—could take weeks or months.

“We have a development assembly line, and our goal is to give engineers the most efficient, frictionless experience doing software development for the company,” says Tom McCleery, principal group cloud network engineering manager in Microsoft Digital. “Every day we delay on solving this issue systemically is another day for the problem to get bigger.”

Why on-premises networks aren’t going away

Why not simply move everything to the cloud?

For Microsoft, the answer comes in many forms. As a company we build physical hardware, requiring hundreds of on-premises labs for software and hardware testing. We operate conference rooms, badge readers, thermostats, and wireless access points that will always require a physical network presence.

More fundamentally, Microsoft as a company hosts the cloud itself. If Azure were ever to go offline, our engineers responsible for recovery would need robust on-premises access that doesn’t rely on the very infrastructure they’re trying to restore.

Compounding all of these challenges are security requirements introduced by our Secure Future Initiative (SFI). The drive to reduce lateral threat movement across our network—limiting how far an attacker could reach if they compromised a single identity or device—has pushed our teams toward increasingly segmented environments. For our developers, that segmentation has meant navigating multiple networks, maintaining multiple identities, and juggling Yubikeys, smart cards, and authenticator apps just to move from one system to another.

The challenge, in short, is not that our network has too many pieces to be easily connected, it’s that those pieces weren’t designed to talk to each other efficiently.

This is what we had to fix.

Automation, patterns, and the path to ‘A Customer a Day’

Raghavendran Venkatraman is the principal engineering manager in Microsoft Digital who first pitched the vision of delivering a hybrid infrastructure in a single day.

“If we are not fast enough, our customers are going to outpace us and do it themselves—and they may not be adhering to all our enterprise security standards. The faster we deliver reliable infrastructure, the higher their confidence in us.”

Raghavendran Venkatraman, principal engineering manager, Microsoft Digital

The concept, which the team calls “A Customer a Day,” is built around the idea that it’s possible to deliver hybrid connectivity within 24 hours of finalizing requirements. Gathering, validating, and completing those requirements is where the team had to put their focus.

“If we are not fast enough, our customers are going to outpace us and do it themselves—and they may not be adhering to all our enterprise security standards,” Venkatraman says. “The faster we deliver reliable infrastructure, the higher their confidence in us.”

Three sequential domains of opportunity were identified, each a distinct bottleneck in the process. They all boasted impressive potential for improvement:

AI-driven unified intake

Customer describes requirements once. AI interprets and routes to the right pattern—no human coordination needed.

Replaces: Weeks of cross-team meetings before any build begins.

Predefined network patterns

A catalog of validated blueprints matches each request to a proven solution—no custom work from scratch.

Replaces: One-off negotiations restarted for every customer engagement.

End-to-end automation

A single workflow deploys from Azure all the way to the on-premises endpoint—no manual handoffs between teams.

Replaces: Days or weeks of manual steps after the cloud build is finished.

The result of these three innovations was the ability to make hybrid infrastructure live in one day, not months.

AI-driven unified intake. Today, when an engineering team needs hybrid connectivity, they become the conduit between multiple groups—networking teams, architecture teams, program managers, and security reviewers—that each have their own requirements, timelines, and vocabularies. The intake process alone can consume weeks of meetings before any actual implementation begins. The new model replaces that with an AI-powered interface that captures requirements directly from the customer, interprets them, and routes them to a predefined deployment pattern.

Predefined network patterns. Most hybrid workloads map to a small set of repeatable architectures. Rather than treating each onboarding as a custom engagement, the team has catalogued the most common hybrid connectivity scenarios and translated them into repeatable, validated patterns. The patterns drive both the AI intake and the automation layer, creating a system where the right solution can be identified and deployed without starting from scratch each time.

“The long pole in the tent used to be just getting the infrastructure up and running, but we are now able to do that pretty fast,” McCleery says. “Now, the challenge is sitting down with our customers, figuring out their requirements, and interpreting those into tasks that we can go implement in a matter of hours.”

End-to-end automation. On-premises, transport, and cloud network automation operate separately, but one-day delivery requires unified, pattern-aware orchestration. An AI orchestration agent manages sequencing, dependencies, and exceptions, enabling the hybrid stack to deploy as a single pipeline instead of in fragmented steps.

“The key architectural insight we reached is that any code touching device configuration should come from the service lines that own those devices. That’s a DevOps boundary—you own the customer experience, you specify the requirements, and then you call upon what we’ve built to interact with the back end. That’s a fundamentally different way of thinking about hybrid automation, and it’s what makes the end-to-end build possible.”

Juan Jimenez, principal cloud network engineer, Microsoft Digital

This is the work that Juan Jimenez, a principal cloud network engineer on the team, has been driving with multiple engineering cohorts.

“The key architectural insight we reached is that any code touching device configuration should come from the service lines that own those devices,” Jimenez says. “That’s a DevOps boundary—you own the customer experience, you specify the requirements, and then you call upon what we’ve built to interact with the backend. That’s a fundamentally different way of thinking about hybrid automation, and it’s what makes the end-to-end build possible.”

Building consensus across the network stack

Perhaps the hardest part of getting to “A Customer a Day” has been organizational. Bringing together cloud networking teams, on-premises network engineers, identity teams, security stakeholders, and program managers around a common framework requires a level of cross-disciplinary alignment that is extremely difficult.

What has helped is having a clear, human-scale goal that everyone can immediately understand and rally behind. When Venkatraman first named the initiative “A Customer a Day,” something shifted.

“You go over to the identity folks and say we’re trying to get a customer onboarded in a day—they’re like, ‘That would be great!’” McCleery says. “Same thing with on-premises networking. That message is easier to land than going in and saying, ‘Your engineers need to learn more about cloud.’ That’s when people start taking mental health days.”

One of the deeper mindset shifts the team has also been working to drive is a redefinition of what connectivity means. Historically, connectivity meant simply the network. In a cloud-first, AI-accelerated world, that definition is no longer sufficient.

“Connectivity means network and identity—together,” Venkatraman says. “That is the new definition, but it is not prevalent everywhere yet. Any CIO or CTO should pivot their entire organization to think about it that way. Don’t have two separate teams making decisions in silos and then trying to integrate. Get them in the room together from the start.”

Where we are today, and what comes next

Our Microsoft Digital team is candid about where we are in the journey: We’ve made meaningful progress, but we’re not yet at the finish line. The near-term goal is to complete the first customer launch scenarios within the next quarter, followed by broader adoption of the pattern framework in the quarter after that.

The goal isn’t 100% automation. The team is clear that a portion of hybrid networking will always require the custom work that complex or security-sensitive scenarios demand.

“We’re always going to have a longtail of scenarios that need human judgment,” McCleery says. “But for the 80% of common scenarios, if a customer is going down the compliant, paved path, things should happen a lot faster.”

For a team that’s spent years watching the gap between cloud and on-premises connectivity grow wider, the prospect of closing it—one customer, one day at a time—feels less like a moonshot and more like a welcome, needed correction.

Key takeaways

If your organization is wrestling with hybrid cloud integration, here are concrete steps you can act on today, informed by what we’ve learned on our journey:

• Audit your hybrid integration timeline. If connecting a new cloud environment to on-premises networks takes more than a few weeks, map where the delays actually live—requirements gathering, cross-team handoffs, on-premises automation gaps, or other issue. You can’t fix what you haven’t measured.
• Redefine connectivity to include identity. Bring your network and identity teams into the same room before any hybrid integration project begins. Treating these as separate workstreams is a primary source of rework, security gaps, and delay.
• Identify your most common connectivity scenarios and document them as repeatable patterns. Even before you build automation, codifying your top five to ten hybrid connectivity use cases into standard blueprints gives every team a shared vocabulary and an accelerated starting point.
• Set a single, human-scale goal your teams can align on. A unifying outcome (like “integrate a new environment in one day”) is more effective at driving cross-team alignment than a technical mandate. Find the shared aspiration before prescribing the solution.
• Extend cloud tooling and automation frameworks to your on-premises teams. Don’t wait for on-premises engineers to independently upskill on cloud-native tooling. Invest in democratizing that capability deliberately, or the automation gap between your two environments will continue to widen.
• Design intake around your systems, not your customers. Any hybrid integration process that requires an internal team to act as coordinator between multiple groups is a bottleneck by design. Use AI-assisted intake to make the requirements capturing self-service and the routing automatic.
• Promote the framework before the tooling is finished. Publishing your architectural principles and patterns early (even when implementation is still in progress) aligns teams, accelerates buy-in, and gives other organizations a head start on their own journey.

Try it out

Learn how to Integrate ARM templates with Azure Pipelines.

Related links

• See how we’re modernizing our cloud networking infrastructure with a DevOps mindset.
• Read more about how we made to the move to the cloud with Microsoft Azure.
• Get our seven tips for moving to a “cloud native” device management strategy.
• Find out how we’re using AI to help secure our network environment.
• Learn how we migrated our remote and VPN access infrastructure to a cloud-based solution.

The post Reinventing hybrid cloud integration at Microsoft—from months to one day appeared first on Inside Track Blog.

As a group program manager in Microsoft Digital, she oversees strategic areas of our license management, key third-party software, and suppliers for our AI models. She is also helping lead our organization into the AI era, all while quietly building a reputation as a sought-after mentor in the IT space. Her approach is rigorous, direct, and deeply human.

Hovhannisyan came to the United States from Armenia as a graduate student in 1997 with no family and no financial safety net. She credits the experience with instilling her with the tenacity, grit, and self-advocacy that define her career.

Building a career from the ground up

Hovhannisyan’s path to Microsoft began at Texas Tech University, where she earned a master’s degree in electrical engineering. She graduated in 1999 just as the software industry began to boom, and she was hired directly into a support engineer role at Microsoft.

“You have to self-advocate, perform at the highest level, and line up mentors to help drive your career forward. That is the recipe.”

Anahit Hovhannisyan, principal group product manager, Microsoft Digital

For her first seven years at Microsoft, Hovhannisyan remained in that same role by necessity. As a foreign national awaiting her green card, switching jobs would have reset the immigration process. She used that time to broaden her technical expertise across multiple disciplines within the developer support space.

“You have to self-advocate, perform at the highest level, and line up mentors to drive your career forward,” Hovhannisyan says. “That is the recipe.”

After she received her green card, Hovhannisyan moved through a series of field-based roles in the Microsoft Dallas office. In 2013, she relocated her family to the Seattle area for an IT-specific role at Microsoft headquarters.

IT was new territory for her, but her appetite for calculated risk is something she now sees as central to her identity as a leader.

From one partnership to an enterprise function

Within Microsoft Digital, Hovhannisyan is best known as the general contractor and product management lead for the company’s long-term strategic relationship with ServiceNow. Over the past few years, her team delivered solutions on the Service Now platform that helped multiple organizations within Microsoft with Service Desk, Help Desk, and operational needs.

“My previous mentor always said, ‘What got you here won’t get you there.’ Things change at a rapid pace. Learn, adapt, and pivot—those are the three things that have moved my career forward, and they matter more than ever in the AI era.”

Anahit Hovhannisyan, principal group product manager, Microsoft Digital

More recently, Hovhannisyan’s responsibilities expanded to include managing a portfolio of 18 third-party software suppliers, in addition to the Service Now product ownership

Today, her team is both building and deploying AI agents; contributing to IntelliLicense, an AI-powered software licensing platform; and rolling out ServiceNow’s NowAssist to drive AI-powered case summarization across the business. Microsoft Digital was an early adopter of these capabilities, and Hovhannisyan’s organization now shares what it learned with external customers seeking to understand how enterprise IT can evolve.

“My previous mentor always said, ‘What got you here won’t get you there,'” Hovhannisyan says. “Things change at a rapid pace. Learn, adapt, and pivot—those are the three things that have moved my career forward, and they matter more than ever in the AI era.”

A mentor who makes the path visible

The importance of building the right network of support is a theme that runs through Hovhannisyan’s career, and she’s precise about who that network should include. She distinguishes between a mentor, a coach, and a sponsor, insisting all three are essential.

“A mentor gives direction and shares experience. A coach asks open-ended questions and helps you find your own answers. A sponsor advocates for you behind closed doors,” Hovhannisyan says. “All three are absolute must-haves.”

“Anahit helped me understand how to build a strategy, gain visibility beyond my core group, and develop relationships with people who will be in rooms I’m not in.”

Katina Reece, principal technical program manager, Infrastructure, Network and Tenant group at Microsoft

Katina Reece, a principal technical program manager in the Infrastructure, Network and Tenant group at Microsoft, has been working with Hovhannisyan as a mentee for nearly eight years. When they met, Reece had been at Microsoft for three years and was watching colleagues advance around her. Hovhannisyan helped her reframe her obstacles, showing her that visibility, relationship-building, and strategic positioning were just as important as performing well at her job.

“Anahit helped me understand how to build a strategy, gain visibility beyond my core group, and develop relationships with people who will be in rooms I’m not in,” Reece says.

“Anahit is very thoughtful about understanding what gives people energy and finding the right places to leverage those strengths. The strongest leaders recognize that different people bring different talents, and Anahit does that well.”

Dawn Lee, principal product manager, Microsoft Digital

For Dawn Lee, a principal product manager who has worked directly with Hovhannisyan for more than two years, the impact has been just as concrete.

“Anahit is very thoughtful about understanding what gives people energy and finding the right places to leverage those strengths,” Lee says. “The strongest leaders recognize that different people bring different talents, and Anahit does that well.”

Why IT is the place to be

Hovhannisyan pushes back on the perception that IT is a less exciting path than working on products.

“IT is an amazing place to learn fast,” Hovhannisyan says. “You have a broader purview across multiple product groups, your knowledge grows dramatically, and you have more opportunity to observe and adapt your career than you would in a narrower role.”

“If I, as a foreign student with nothing, could make that kind of progress, I feel like everybody can do it. The keys are tenacity, grit, and self-advocacy. If you don’t have a mentor, get one. If you don’t have a sponsor, find one. These are not optional.”

Anahit Hovhannisyan, principal group product manager, Microsoft Digital

Looking ahead, Hovhannisyan aspires to eventually lead both program management and software engineering functions within Microsoft Digital.

She continues to mentor a wide network of over 20 employees across the company, understanding that the path she navigated from immigrant student to senior leader is one worth sharing.

“If I, as a foreign student with nothing, could make that kind of progress, I feel like everybody can do it,” Hovhannisyan says. “The keys are tenacity, grit, and self-advocacy. If you don’t have a mentor, get one. If you don’t have a sponsor, find one. These are not optional.”

Meanwhile, she’ll keep showing up the way she always has: Advocating for her team, coaching the next generation, and doing the consequential work that makes the whole enterprise run.

Key takeaways

Here’s what you can learn from Anahit Hovhannisyan’s career:

• Build your support network intentionally. A mentor shares experience and direction; a coach asks the questions that help you find your own path, and a sponsor advocates you when you’re not in the room. Seek out all three.
• Self-advocacy is a career skill. Performing well is the baseline. Actively communicating your aspirations to leadership, courting feedback, and ensuring the right people know your goals is what moves the dial.
• Lead change by helping people understand “What’s in it for me?” When driving organizational change, paint a clear vision, answer what team members gain from it, then back your words with visible action so trust builds over time.
• Good mentors see what mentees can’t yet see in themselves. Spotting someone’s potential before they recognize it—and giving them a specific opportunity to prove it—is one of the most high-impact things a mentor or leader can do.

Try it out

Learn more about working in IT at Microsoft by reading our Inside Track blog.

Related links

• Who else works in Microsoft Digital? Read about Olutunde Makinde, a senior service engineer.
• Considering a career at Microsoft? See current openings in the Microsoft Careers portal.
• Read about a day in the life of a Microsoft employee using Copilot.
• Discover how Microsoft employees use the Total Rewards Portal to understand their value.
• Learn how Microsoft HR is using Viva and Microsoft 365 Copilot to empower our employees.
• Find out how the Microsoft Power Platform at Microsoft empowers employees.
• Connect with regional employees more effectively at Microsoft with Viva Amplify.

The post Building from the inside: Anahit Hovhannisyan’s impact on IT at Microsoft appeared first on Inside Track Blog.

Maybe you’re a product manager with a backlog that you can’t ever get to. Perhaps you’re a designer who can never seem to get engineering resources assigned to you. Or maybe you’re a program manager who routinely gets stuck copying data between systems by hand.

These are common challenges knowledge workers face everywhere, including here at Microsoft. A year ago, AI enthusiasts knew agents with tools could fix these problems—they just didn’t know where to start.

Some of our employees in Microsoft Digital, the company’s IT organization and Customer Zero for the company, took a grassroots approach to solving this problem. They built something called the Frontier Forge, our pro‑code “harness” that enables our less-technical employees to get work done with agents. They use it to quickly build agentic instructions and instantly share their solutions with peers, which accelerates our productivity across the company.

The Frontier Forge represents a cultural shift in how our product managers, designers, program managers and other “I’m not an engineer but I want to build stuff” employees now apply AI tools directly to their work.

What first began as a hackathon experiment has evolved into a thriving Microsoft-internal community with nearly 100 engaged contributors, an active Teams channel, and a GitHub repository filled with templates, learning modules, and ready-to-use AI agents. The impact is measurable: Forecasting, backlog grooming and communication tasks that collectively took weeks now take hours or minutes.

“I saw myself and others spending too much of our time on data wrangling and admin tasks when we wanted to be strategizing. Nobody was building what felt truly agentic. So, we did it ourselves.”

Brett Reifers, senior product manager, Microsoft Digital

Employees who never saw themselves as technical are now building sophisticated data visualizations, automating workflows, creating prototypes, and generating learning modules. These were capabilities previously reserved for specialized engineering teams.

The “Forge” is where it’s all happening now.

From a hackathon to a movement

In early 2025, Brett Reifers, a senior product manager in Microsoft Digital, spotted a problem he couldn’t ignore. His peers, smart and driven product managers, kept asking the same question: “How do I use agents for my actual work?”

Beginner tutorials about prompt engineering felt trivial. Advanced agents with tools assumed engineering expertise. The middle ground, where AI meets real jobs, didn’t exist.

“I saw myself and others spending too much of our time on data wrangling and admin tasks when we wanted to be strategizing,” Reifers says. “Nobody was building what felt truly agentic. So, we did it ourselves.”

So, Reifers partnered with colleague Humberto Arias, a senior product manager in Microsoft Digital whose work explores the intersection of AI and productivity. Arias had been independently researching agentic solutions that could click through interfaces, open applications, and complete tasks autonomously.

The insight that unlocked everything came from a deceptively simple observation:

“Everything on the internet is a form—every site, mobile app, every click,” Reifers says. “If agents could fill out my forms in Azure DevOps, they could handle any web-based task.”

They pitched the concept of Copilot fulfilling form-based processes as an entry for Microsoft’s annual hackathon to Sean MacDonald, partner director of product management in Microsoft Employee Experience. MacDonald immediately recognized its potential.

“My reaction was simply, ‘This sounds amazing,’” MacDonald says. “This solution was exactly what we needed.”

The event proved agents could automate PM workflows: managing Azure DevOps items, generating summaries, and querying data systems. After the hackathon validated the concept, Arias suggested pushing the project to GitHub for wider exposure. Reifers then used GitHub Copilot itself, recursively using the very tools they were building, to open source the first Frontier Forge repository in 15 minutes.

A pro-code environment with natural language accessibility

The Forge combines GitHub Copilot, Visual Studio Code (VS Code), and MCPs into a framework that makes professional development tools easily accessible to non-engineers.

“The Frontier Forge is a place where you can learn regardless of your skill level. You can adopt what’s out there, even if you don’t know where to start.”

Sean MacDonald, partner director of product management, Microsoft Employee Experience

The core idea: Give employees a workspace seeded with community-created templates, learning modules, and custom agents tailored to Microsoft Digital contexts. Then let them build from there.

For MacDonald, the Forge has proven to be an accessible entry point for almost anyone, regardless of experience.

“The Frontier Forge is a place where you can learn regardless of your skill level,” MacDonald says. “You can adopt what’s out there, even if you don’t know where to start.”

An architecture for context-first AI

The technical architecture of The Frontier Forge leverages three layers simultaneously:

• VS Code provides the enterprise managed workspace where everything happens.
• GitHub Copilot offers chat functionality and AI assistance, with access to multiple models including Claude, GPT, and Gemini.
• Tools like Model Context Protocols (MCPs) act as standardized connectors that let agents access tools, data, and services locally. This unlocked what Copilot could decide and do with user approval.

“With GitHub Copilot and MCPs, there are literally no boundaries. It’s hard to explain just how transformational this can be for a product manager. Whatever you ask is transformed into code with a purpose, allowing you to do something you couldn’t before.”

Humberto Arias, senior product manager, Microsoft Digital

The MCPs connect to services like Azure DevOps (for roadmap planning and backlog management), Microsoft Documentation, Figma (for design work), and dozens of other platforms that are essential to product manager workflows. New MCPs appear daily, expanding capabilities organically as the community builds them.

Employees can even ask GitHub Copilot to build custom MCPs for services lacking official integrations. When Arias needed a PowerPoint creator that didn’t exist, he asked GitHub Copilot to create one.

“With GitHub Copilot and MCPs, there are literally no boundaries,” Arias says. “It’s hard to explain just how transformational this can be for a product manager. Whatever you ask is transformed into code with a purpose, allowing you to do something you couldn’t before.”

The shift from prompt engineering towards context engineering is another reason why the Forge works. Its workspace settings, agent instructions, skills and hooks provide a harness with guardrails that help colleagues adopt and use this.

The Forge provides a curated starting point: Microsoft Digital-specific templates, governance frameworks, security guidelines grounded in Microsoft’s Responsible AI framework, and working examples employees can immediately use and modify.

Transformational impact

The productivity gains generated by The Frontier Forge are very real. Our employees report saving weeks or even months on certain projects, especially those that previously required extensive manual work or specialized technical skills.

Case in point: Laura Oxford, a senior content program manager in Microsoft Digital, had four years’ worth of Excel files and communication metrics reports. She had always intended to use the data to create marketing forecasts, but she could never find the necessary time or resources to perform the analysis.

“The key to creating the agent was going deep into the context. It was an iterative conversation, going back and forth to fine-tune the agent until I was consistently getting the output I wanted. But it truly was just a conversation—no tech skills needed.”

Laura Oxford, senior content program manager, Microsoft Digital

Through iterative, conversation-based prompting, Oxford’s agent analyzed patterns, created projections, and produced visualizations. Oxford now has a robust historical analysis that enables prediction of future campaign performance.

“The key to creating the agent was going deep into the context,” Oxford says. “It was an iterative conversation, going back and forth to fine-tune the agent until I was consistently getting the output I wanted. But it truly was just a conversation—no tech skills needed.”

Drafting clear, executive-ready communications for complex initiatives was what brought Mark Stratford, a senior product manager with the email and calendaring service team in Microsoft Digital, to the Forge.

Before the Forge, communicating status updates to leadership meant he had to manually synthesize data from CSVs, track several approval chains at once—often in messy emails—and iterate on visualizations for what seemed like days and days.

Put more succinctly, these tasks are time-consuming chores that are perfect for AI.

“The Forge’s architecture changes how you think about the problem,” Stratford says. “Instead of iterating on prompts, you declare intent and desired outcome. The Forge’s architecture handles the rest.”

Using this pattern, Stratford created:

• Over a dozen interactive dashboards for portfolio roadmaps, migration tracking, and service health monitoring.
• Approval matrix visualizations mapping multi-stakeholder sign-off dependencies.
• Data analysis pipelines transforming raw telemetry into executive-ready narratives.

“I didn’t need to fight ambiguity or handhold the model. The architecture gave the agent a stable, skills-driven foundation from the start, which dramatically accelerated development time and improved clarity.”

Mark Stratford, senior product manager, Microsoft Digital

The Forge’s clean separation between intent, constraints, tools, and data inputs eliminated the prompt-tuning loop. Stratford mapped his objectives into the agent framework once, relying on built-in structure and guardrails.

His analysis and drafting time dropped from days to minutes. Outputs like roadmaps and data visualizations went directly into decision workflows with no manual cleanup required.

“I didn’t need to fight ambiguity or handhold the model,” Stratford says. “The architecture gave the agent a stable, skills-driven foundation from the start, which dramatically accelerated development time and improved clarity.”

Building community and sharing knowledge

A simple continuously improving repository has grown into something larger: a community of nearly 100 enthusiasts. Contributors are building templates, learning modules, and specialized MCPs tailored to their job functions. Teams are sharing wins and unlocked achievements.

“At its core, The Frontier Forge is an open-source, community‑driven experience. It’s a safer environment that will help people learn and apply Microsoft’s AI at work.”

Brett Reifers, senior product manager, Microsoft Digital

The Forge succeeds because of its emphasis on community and knowledge sharing. Its GitHub repository serves as collaborative workspace where employees contribute agents, templates, and learning resources.

This sharing culture creates a compounding cycle. One employee’s outcome becomes another’s starting point. Contributors share useful agents immediately, without lengthy approvals. This grassroots approach lets innovation spread at the pace of curiosity.

“At its core, The Frontier Forge is an open-source, community‑driven experience,” Reifers says. “The Forge is a safer environment that will help people learn and apply Microsoft’s AI at work.”

Building a safe-to-fail path

For IT leaders looking to replicate something like the Forge, MacDonald’s guidance starts with reframing the challenge.

“Find the people who are super curious and who want to learn. They will be the ones who drive innovation with AI agents and other newly developed tools.”

Sean MacDonald, partner director of product management, Microsoft Employee Experience

The barrier to agent adoption for non-engineering roles isn’t access to tools. It’s all about giving them the confidence needed to build them and then put them to work. Providing a safe, hands-on environment where people can learn at their own pace, regardless of skill level, has been an essential key to success.

Another key has been to empower the people in your organization who are eager to innovate and try new things. The Forge began with two curious product managers who decided to experiment and then shared their idea with peers.

“Find the people who are super curious and who want to learn,” MacDonald says. “They will be the ones who drive innovation with AI agents and other newly developed tools.”

For IT leaders currently trying to prepare their organizations for an AI-driven future, the story shows that the answer isn’t to wait around for perfect tools or comprehensive employee training.

“The leaders that create safe spaces for non-engineers to build with AI now will compound that advantage for years,” Reifers says. “The ones that wait will spend 2027 trying to catch-up.”

Our knowledge workers don’t need to wait for help any longer, now they can forge their own path with an agent or other AI tool they build themselves.

Key takeaways

Here are some insights your leaders can use to build grassroots-led, AI-forward communities in your organization:

• Start with volunteers, not mandates. The Forge grew to 100 contributors with zero top-down requirements. Organic growth from curious employees creates sustainable adoption.
• Highlight your quick wins. Reifers’ and Arias’ live demos of MCPs, Oxford’s 90-minute forecast and Stratford’s 20-minute drafts became the recruiting pitch for the next wave of adopters. Show your people results like these, then hand them the tools.
• Lower barriers without lowering standards. Accessibility and quality aren’t mutually exclusive. Governance and security are non-negotiable. Configure it all into the harness.
• Prioritize knowledge sharing and attribution. When one person solves a problem and shares it, dozens benefit immediately. Reward provenance.
• Ship fast, improve later. The Forge repo was built in 15 minutes. Four months later, it contained 50+ templates and agents. As much of 80% what is produced in the Forge is rewritten every other week as tools evolve. Ship MVPs and evolve based on real usage.
• Reframe outcomes > tools. Shifting from “developer tool” to “Copilot workspace” helps knowledge workers see they belong.

Try it out

Start building and sharing AI agents today with GitHub Copilot.

Related links

• See how we enable Microsoft employees to build AI agents that help them complete important tasks.
• Learn more about GitHub Copilot for Azure.
• Discover how we’re transforming our employee experience with AI. 
• Take a course on building AI agents for beginners in GitHub Copilot.
• Follow our step-by-step guide to building API-powered agents. 
• Find out how continuous improvement helps us identify agentic opportunities, and how it can help your company, too. 

The post The Frontier Firm: How knowledge workers are forging their own AI tools at Microsoft appeared first on Inside Track Blog.