I am so freaking tired of dealing with Azure bullshit. Why this cloud just CANNOT work like it is supposed to? It is unreal. To give you some example.

For the past month we've been debugging a case, where applications running on AKS (Linux-based VMs) have connectivity issue. The conclusion was: it is (of course) fucking Azure. Literally a bunch of VMs from the same zone, at the same time becomes unresponsive (most likely running on the same rack/host). Inbefore "but muh Azure has Freeze events" - no, our instances haven't received a single event of this type.

Kumar and Krishna from support weren't useful (anyone surprised?). We decided to change VM series (from Dasv6 to Dsv7).. and magically all freezes dropped to 0. Check attached image.

The only problem is that Dsv7 costs 50% more than Dasv6. What a joke.

I've been tasked to move the entire AD domain over to the new syncing tool from Microsoft. The way it's currently setup we use on-prem AD to create and manage the accounts which gets sync'd to Azure. We don't have anyone using on-prem AD to authenticate against as they always use Azure for that. None of their computers are hybrid joined as it's all Azure joined.

Any gotchas I should be aware of? Seems the Connect Sync is doing a full sync of the AD domain. From what I understand I can add the cloudNoFlow and JoinNoFlow to prevent Connect Sync from exporting objects adds, object deletions, and non-reference attribute updates.

How well does the automatic migration tool work or should I just try doing this manually? I am aware of the 150K objects limit.

This has been going on since Friday but they finally just updated the Service Health dashboard - Region East US 2

Hi everyone i'm trying to understand something about DLP mostly for Sharepoint and Onedrive

I made a policy for audit that checks Exchange, Teams, Onedrive and Sharepoint, then i have some rules that check for stuff sent outside our tenant and some inside

The issue i'm having is

1) It seems that each time someone uploads something to a sharepoint that has sensitive information it triggers the DLP rule, i though it was only for sharing? (ye i know Sharepoint is a share site so i'm guessing uploading a file is auto considered a sharing action?)

2) Onedrive we are getting hit from users that are disabled for like 3 months ago and their onedrive are disabled, it says the document was shared, but i cannot find to who, when i go to audit no one tries to access his Onedrive, user is disabled without a licence and when we try to get more info it says the onedrive is archived

Thanks

We're rolling out MFA to about 800 users across multiple sites. We have a CA policy that requires MFA when users are offsite, but not when they're onsite. That part works fine.

The issue I'm running into is getting everyone registered before we enforce the policy. I want users to be forced to set up Authenticator while they're onsite, but not have to use MFA every time they sign in onsite.

I've tried the Authenticator registration campaign and the Identity Protection MFA registration policy, but neither seems to prompt users to register while onsite.

I know we could just enable the CA policy and let users register whenever they eventually sign in offsite, but I don't really like that approach. Some users may never sign in offsite, so they could go months without registering. My bigger concern is that if one of those accounts gets compromised before the user registers, an attacker could potentially register their own MFA method.

I could temporarily enforce MFA for everyone to get them registered, but that seems like a stupid workaround for something that should be pretty simple, especially with 800 users.

Am I missing something here? How are you guys handling this?

Who have Az.

🔥What if you could build a custom Azure Bicep extension that provides day zero support for Microsoft Graph APIs, allowing you to use newly released Graph capabilities directly from Bicep? In this blog I will show how to deploy Microsoft Teams, Conditional Access Policies and Administrative Units using Bicep!

Azure weekly update #42 is here. This week's updates focus on new capabilities in Azure Backup, Azure Monitor, and networking services. Several services have received new features, including Item-Level Recovery and keyless TLS termination.

Detailed list: * Launched | Generally Available: Item Level Recovery for Azure VMs with Premium SSDv2 and Ultra Disks in Azure Backup. Azure Backup now supports Item-Level Recovery (ILR) for Azure VMs with Premium SSD v2 and Ultra disks, allowing file/folder recovery without full VM restore. Teams should verify the 10 GB size limit and 1 GB/hour transfer speed. * Launched | Generally Available: ABFS Vectored Read for Azure Data Lake Storage. ABFS Vectored Read is now generally available for Azure Data Lake Storage. This feature reduces network round trips for selective reads in compatible Spark workloads by combining nearby file ranges. * Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra. Microsoft Entra ID introduces Choose Your Own Telephony (CYOT) starting October 30, 2026. This allows organizations to use third-party providers for SMS/voice authentication. Teams must verify if phishing-resistant methods meet user requirements before adopting CYOT. * Launched | Generally Available: Azure Cosmos DB Safe Key Rotation. Safe Key Rotation is now generally available in Azure Cosmos DB. This introduces a temporal constraint on key usage, mandating a minimum 12-hour inactivity window prior to key regeneration protocols. * In preview | Public Preview: Disable VNet peering route. Disable VNet peering route is in public preview to simplify route management in hub-and-spoke networks. It suppresses system-generated peering routes, requiring teams to verify replacement UDRs are correctly configured. * Launched | Generally Available: Service tag match condition for Azure Front Door Premium WAF. Azure Front Door Premium WAF now supports service tag match conditions. This allows custom rules to match request source IPs against automatically updated Azure service IP prefixes. * Launched | Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM. Azure Application Gateway now supports keyless TLS termination. This uses certificates whose private keys remain in Azure Key Vault Managed HSM, requiring verification of specific Crypto Officer and Crypto User roles. * Launched | Generally Available: Advanced platform metrics for Azure Monitor. Advanced platform metrics are now generally available in Azure Monitor. These provide granular, paid metrics, and teams must verify the specific enablement instructions for their resource provider. * Launched | Generally Available: Metrics usage insights for Azure Monitor workspace. Azure Monitor's new Metrics usage insights GA allows teams to optimize costs. It helps identify unused metrics and usage trends within their Azure Monitor workspace. * Launched | Generally Available: Azure DNS enables DNS-based load balancing through Traffic Manager linked records. Azure DNS now supports direct association with Traffic Manager profiles. This eliminates the need for CNAME records and reduces DNS lookup latency. Teams should verify their existing DNS record configurations to ensure proper integration.

Yes yes I know. Crazy last 10 days :-) Maybe I should do another AMA so you can yell at me :-)

📽️ https://youtu.be/WjdPF-6fbx4

📄 https://www.linkedin.com/pulse/azure-weekly-update-24th-october-2026-john-savill-hp1ic

• Traffic Manager Azure DNS integration (00:50) - You can now link an Azure DNS record set directly with a Traffic Manager profile instead of having to go via the cname of the trafficmanager.net which adds a hop and delay. I now create a new record set trafficManagementProfile which causes Azure DNS to resolve the profile internally and return the endpoint IP or FQDN depending on the record as the response.
• App GW keyless TLS with AKV managed HSM (01:47) - This enables private keys to stay in the Azure Key Vault Managed HSM which means the TLS handshake signature is performed inside the HSM so the gateway never sees the private key.
• AFD WAF service tag matching (02:13) - For Azure Front Door Premium Web Application Firewall you can now leverage service tags (which are Microsoft maintained sets of IP addresses for specific services like Storage, SQL) as part of your custom source IP rule so you no longer have to try and maintain the IP addresses used by Microsoft services. For example you could now easily allow Azure monitoring capabilities in to talk to your services.
• Disable vnet peering route (02:53) - When you peer virtual networks it adds routes between the vnets for traffic routing. This enables you to disable a vnet peering route without removing the actual peer. This would be useful if you wanted traffic to go via some appliance and wanted to avoid having to override every single route and instead use a summarized UDR, think of hub-and-spoke networks and route summarization! This is huge.
• Azure Backup VM item-level recovery (04:03) - If you protect Azure VMs with Premium SSDv2 or Ultra disks using Azure Backups you now have Item-Level recovery enabling specific files or folders to be restored instead of full disk/VM restore. This works with 512-byte and 4-KB logical sector sizes and works across Windows and Linux. This joins the existing support for standard HDD/SSD and premium SSDv1. You run a script against the restore point then select what to restore.
• Azure Databricks private network gateway (04:40) - This enables Azure Databricks serverless compute to connect to resources in your vnet through a single managed gateway resource that lives in a delegated subnet in the vnet. This could be private endpoints, VMs, even other networks via firewalls, i.e. you can control egress via your security devices. If it lives in the vnet or can be contacted via the vnet then the databricks serverless compute can talk to it. Note if you also have a specific private endpoint to a resource that is also available via the managed gateway then the private endpoint path would take precedence as its most specific.
• Azure Monitor workspace usage insights (05:40) - For your Azure Monitor workspace you can now get visibility into what is driving the metric usage across the workspace including usage trends, unused metrics and changes in ingestion volume.
• Azure Monitor advanced platform metrics (05:57) - These are more granular signals that can be enabled as part of a paid, premium tier. These are only available for select resources, at time of recording Storage only which adds detail such as container level blob capacity and container blob count.
• Cosmos DB safe key rotation (06:25) - This is really about visibility into the use of the two account keys. There is now timestamp metadata on the account keys so you can see when last used ahead of any key rotation or retirement, i.e. you won’t retire an inuse key breaking something!
• ADLS ABFS vectored read (06:47) - Bit of a mouthful here but the Azure Data Lake Storage (gen2) where we have hierarchical namespace has improved read performance when you read portions of columnar files, e.g. parquet files where data is stored by column rather than by row. This is when using the Azure Blob File System (ABFS) driver and it works by combining requests for nearby ranges into a smaller number of larger storage requests as opposed to large numbers of very small independent reads. The reader still submits the desired ranges but ABFS does the work of sorting then combining nearby ranges to optimize and better fit its read buffers. What this means is less request overhead, coordinated I/O and there is no need to change the underlying queries when using the ABFS path.
• Sovereign updates (07:54) - The focus is all around an organizations need to understand and control where data and compute reside in addition to who can access and resilience against disconnection. There are layers to this. Sovereign in the public cloud - Where the scale and innovation drives the use of the public cloud customers now have a sovereign control panel highlighting their sovereign posture to identify gaps and actions to take. For the EU the data guardian is rolling out where adds European oversight for MS engineer remote access to systems in addition to tamper resistant audit logs.We are also continuing the rollout of external key management which means although the data physically lives in our datacenters the root decryption material lives with the customer on their (or partner) vaults giving them greater control. Confidential Clean Rooms also allow companies to work together on sets of data without exposing their raw data directly to each other. Sovereign private cloud - Builds on Azure Local by extending capabilities with SQL, Document DB, Blob in addition to lifecycle management of apps with GitHub Enterprise Local AND local inferencing with Foundry Local. Confidential VMs will also be available along with the ability to switch Azure Local from connected to disconnected giving organizations greater edge capabilities and resilience where needed. They can even share infrastructure among tenants. National Partner Clouds - for select entities for example in France there are partners operating subsets of Azure capability with their own local expertise.
• Project Perception updates (10:00) - There is increased focus on insider risk of agents. Satya wrote in a blog last week that the most trustworthy super intelligence system is not the one with the model we trust most, it will be the one that enables us to trust the model the least. This is core to our focus around intelligence and trust and the controls, governance, security, isolation we put around models.Our latest news is Project Perception, that was primarily focused on external human and AI risk, is being enhanced to also protect against the insider risks of agents that are primarily driven to provide results so may perform unanticipated actions to achieve the needed result or may be manipulated. Through a sharing of signals between Project Perception and Agent 365 a new breed of "guardian agents" can continually look at the evidence which changes risk which changes policy which changes what the agent is allowed to do. It will adapt what agents can access and perform based on the observed signals and where behavior deviates from the expected, this is dynamic agent risk.When we hear of agents going rogue this is our answer to not trust the model, but instead is part of our complete stack to observe and control based on the calculated risk from the correlated signals across the stack.
• Entra CYOT (12:36) - Entra recently announced the native SMS and voice authentication retirement in 2027 as there are more secure options, including passkeys. However should you wish to continue to use SMS and/or phone you can now use the Choose Your Own Telephony to bring your own provided for the purposes of SMS and voice authentication where it must be used.
• OpenAI Decisions API (13:05) - We saw Jev from TypeSafe that instead of inferencing tokens it inferenced probabilities making it great for decision making and judgement. Microsoft shortly released their own decision model, Microsoft-Decision-1, and now the OpenAI Decisions API is available in Foundry making it easy to add decision making into your applications that complements language models. For example it could pick the right tool to use, where specialized expertise is required. Note, this is an API using an existing model (GPT 6 Luna) as opposed to the TypeSafe and Microsoft approach of a specialized model for judgement (but even there they took different approaches).
• Copilot Studio agent ID (14:10) - This is a huge deal. Copilot Studio agents now each get their own agent ID. When we think about giving agents least privilege, observing their actions over tools, data etc, controls this is huge so wanted to ensure people were aware.

Hi can anyone help in guide to this? I need it badly for my startup.

Hi all,

I wanted to Learn AZURE , and needed Reddit Community members help. If someone can help me referring to a good tutor or AZURE Developer would be greatly appreciated.

We've had a few internal discussions around what we would do if our MAC discount reduced or vanished, this would be a multimillion pound problem for us. As an aside there's also the risk of the US interference or denial of service. It prompted us to evaluate what an Azure exit would look like, what was the most difficult change and what practices we can do now to help.

Initial findings were rough, a large portion of the estate could not be replatformed without significant development effort.

I'm aware that not leaning into the cloud-native PaaS offerings or trying to be fully cloud native just ends up with IaaS, expense and overhead. We were keen to avoid losing these benefits.

Since the discussion we've updated our development standards to ensure that platform integrations are decoupled from the business logic and have introduced DAPR or open source APIs (e.g Mongo or AMQP) where it makes sense to and features permit so that database, messaging and other integrations are easier to change. We were in the process of adopting OpenTelemetry and Dynatrace but have given that more effort to ensure that all logs, metrics and traces from apps and infra can be dynamically routed. Finally we've formalised that containerisation should be the standard for backends and jobs where possible. From a data perspective we were already a big Databricks house so we have started to make more use of that as opposed to Data Factory. Where ADF remains we are exploring methods to map the flow and integrations so it could be moved with less effort.

For AI workloads I started from the ground up with a neutral approach which aligned with the industry anyway. We use Foundry and Gemini for model serving only, routed via an AI gateway using the OpenAI APIs so all models are modular. Memory is served from MongoDB, OTEL for tracing and eval routing and for agent hosting we have N8N for simple stuff or containerised deployments for anything else.

We've also leveraged AI to help enforcement along with skills that can support the replatforming process where we're cloud-native.

It's not perfect and any migration is going to be a big job regardless but I was interested to see other people's stance on this.

Hi, so currently I have experience on power apps, power automate, ai builder, azure logic apps, azure ai doc intelligence, blob storage. Also I don’t wanna claim I am too good with power apps, I really do not like power automate and power apps for some reasons, and I liked working with azure portal and stuff, and now I have 14 lpa fixed in India with 4+ yoe and I am aiming for 24 lpa fixed by December 2026 , so if anyone can guide me in reaching this target, coz I am a bit lost in terms of what to learn coz with just power apps and power automate I felt I cannot get 24lpa as I feel I am not super good at those things and really not interested to deep dive in this for some reasons, and now my doubt is should I shift to azure ai foundry and copilot or should I learn fabric and stuff so I can move towards data engineer?? your suggestion would be great help. I actually have loads of time coz I am jobless rn so I can spend more time on learning.
If it has more details please dm I am open to convo and more views
Thanks in advance

Azure list of 5 changes that help you cut costs:

• Azure Monitor workspaces now show which resources create your metric data. This makes it simple to find and stop unused metrics before they run up your bill. Source
• Microsoft added more detailed platform metrics for core services. You can catch usage spikes and bad changes faster without paying for extra custom monitoring tools. Source
• Auto-balance VM scale sets across zones: Virtual Machine Scale Sets now rebalance instances across availability zones on their own. This stops compute drift and saves your team from fixing uneven capacity by hand. Source
• Copy Azure Files across regions without custom scripts: Storage Mover now syncs Azure Files across regions natively. This cuts out custom backup scripts and saves hours of maintenance work for disaster recovery. Source
• Link Azure DNS directly to Traffic Manager: You can now connect Azure DNS alias records straight to Traffic Manager endpoints. This cuts down complex DNS routing setups and saves network configuration time. Source

Source: FinOps Weekly Newsletter

Check out my new blog post! When does CI come into play when you start development on something new?

I'm studying for AZ104 and a lot of labs through MS Learn or Github labs require a Microsoft Entra ID P1 license. Do you guys buy this for yourselves in order to study? I'm out of the trial and can't get any more free Azure trials.

can anyone help me, I've filled out my details and tried this out multiple times, yet the 'next' button is always greyed on and unclickable.

Anyone else experiencing this issue? Anyone knows how to solve it?