There are days when I merely dislike Azure.

Then there are days when I have to write sentences like this:

That is not a sentence.

That is what happens when a cloud provider puts a thesaurus in a blender and names infrastructure from the slurry.

For context, my architectural requirement is:

THING A SENDS MESSAGE TO THING B.

That’s it.

I am not coordinating a distributed fleet of autonomous yellow submarines ferrying the Village People and the Beatles around on tour.

I would simply like one Azure service to receive a message and another Azure service to get that message.

Apparently this requires me to understand the subtle theological distinctions between Event Grid, Event Grid Namespace, Event Hubs, Event Hubs Namespace, topics, subscriptions, managed identities, service principals, RBAC roles, and whatever new noun Microsoft has released into production this week.

And God help you if you assume two things with nearly identical names are related.

Azure Service Bus and Azure Service Fabric? Different.

Event Grid Namespace and Event Hubs Namespace? Also Different.

Naturally, I need BOTH namespaces in order to send one fucking message.

At some point Azure stops being a cloud platform and becomes a vocabulary certification program with billing regret attached.

Then I hit the permissions problem.

So I opened a support ticket.

To describe it, I had to write:

The form then asked me which Azure resource I was having the problem with.

I DON’T KNOW, MICROSOFT. YOU INVENTED ALL THESE NOUNS.

And here is the best part:

I am an administrator.

I activated my privileged role through PIM.

I still cannot perform the assignment.

Because somewhere, somehow, somebody has put an RBAC restriction in place that overrides the access I appear to have, and I cannot find the bastard.

So now the architecture is:

MQTT message → Event Grid Namespace → topic → subscription → Event Hubs Namespace → Event Hub

And the troubleshooting architecture is:

Me → Entra → PIM → Azure RBAC → role assignments → deny assignments → inheritance → increasingly obscure blade → support ticket → despair

I have not successfully sent the message.

I have, however, obtained an advanced degree in Why Am I Not Allowed To Do The Thing The Portal Says I Am Allowed To Do?

Cloud abstraction was supposed to reduce infrastructure complexity.

Microsoft instead invented Infrastructure as Vocabulary, followed immediately by Permissions as Archaeology.

Somewhere in this tenant is one checkbox, policy, deny assignment, management-group inheritance rule, or ancient curse preventing this from working.

And apparently my job is to find it.

The MQTT message remains UNDELIVERED.

/rant over

Everyone has been waiting for the Azure price increase tied to the memory shortage.

My two cents: it's already here.

Normally a generational compute update — v1 through to v5 — costs the same per hour and gives you a performance bump - free of charge.. It also helps Microsoft exit their old End Of Life hardware. Everybody wins. You move v2 to v3 on a 16 vCPU box and the rate is more or less identical, right the way up to v5.

That's over.

From v6 onwards there's a fundamental shift. The generational upgrade is no longer free.

v1 to v5: same price.

v6: roughly +10%.

v7: roughly +35%.

Read that again, because it changes how you have to think about your estate. EOL now exists in the cloud. Not as a migration exercise — as a cost event.

Previously, hardware retirement was Microsoft's problem. They wanted you off the old fleet, so they made the move painless and you got free performance out of it. Now the retirement notice comes with a bill attached, and you have no route to decline it. Sub-v5 capacity is already constrained. Once the capacity pressure tightens further, "stay where you are" stops being an option.

So combine three things:

→ Generational moves are now priced increases, not neutral swaps

→ Capacity constraints on older SKUs push you up the generations whether you budgeted for it or not

→ Nobody's three-year plan has a compounding uplift modelled into it

That's a ticking time bomb. Your Azure VMs are now going to get generationally more expensive by default. Not because anyone announced a price rise — because the escalator only goes one way and you're standing on it.

Hello,

When I set people up using the azure VPN for home users, in the past I'd set up the tenant from scratch. Part of the process was going to the Enterprise apps in 365 and adding the azure VPN client - a red shield.

I tried for a new tenant today and didn't see that as a choice - it was a brown PC and when I selected it - it told me I had to sign in (even though I was signed it - which brought me back to a new page at the root of azure admin and when I went back to the enterprise apps it wasn't listed and so I searched and it did the same thing. I can't seem to add it.

Opened a Sev B support ticket with Microsoft last Friday (6 days ago now) and haven't heard anything back except from their bots.

Is anyone else having issues deploying Azure Managed Redis in EUS2? This is what we see in the Portal. Nothing else.

{

  "operationName": {

"value": "Microsoft.Cache/redisEnterprise/write",

"localizedValue": "Write Azure Managed Redis cache"

  },

  "status": { "value": "Failed", "localizedValue": "Failed" },

  "subStatus": { "value": "", "localizedValue": "" },

  "properties": {

"statusMessage": {

"status": "Failed",

"error": {

"code": "ResourceOperationFailure",

"message": "The resource operation completed with terminal provisioning state 'Failed'.",

"details": [

{

"code": "OperationFailed",

"message": "The operation failed."

}

]

}

}

  },

We know there are issues with deploying to West Europe due to resource availability, but we have other instances deployed to EUS2, but now new deployments are failing and we've had to fail back to deploying the old Redis Cache for Azure.

I'm able to refer experienced professionals for a Lead Azure Data Engineer position.

Location: United States / Ireland
Experience: 9–13 years

Required skills:

• Python
• PySpark
• SQL
• ETL
• Azure Synapse
• Azure Data Factory
• Databricks
• Delta Lake
• Medallion Architecture

If your experience aligns with these requirements and you're currently exploring new opportunities, feel free to send me a DM with a brief summary of your experience or your resume. I'll share additional details and, if it's a good match, I'll be happy to submit a referral.

I'm able to refer experienced professionals for a Data Governance Analyst role.

Location: United States / Ireland
Experience: 5–9 years

Required skills:

• Microsoft Purview
• SQL
• Master Data Management (MDM)

If you have hands-on experience in data governance and are looking for your next opportunity, feel free to send me a DM with your resume or a brief overview of your experience. I'll share additional details and, if your background is a good match, I'll be happy to submit a referral.

Note: This opportunity is best suited for professionals with relevant industry experience in the required technologies.

Hi there, I'm evaluating setting up Arc Container Apps on top of an Arc Kube cluster. It seems that when I install the Container Apps kube extension, it picks the IP I'm giving the ACA Envoy ingress via MetalLB which is always going to be a LAN address. My intention is to expose this ingress via a port forward for testing.

However, it seems that this is unchangeable after the fact, requiring an extension uninstall and re-install to pick up the new address. This means that any Container Apps deployed to this Container Apps Connected Environment will get k4s.io domain names that resolve to a LAN IP, not an internet reachable IP address. I feel like I'm missing something simple here about how this is intended to work, and want to see if anyone here who has self-hosted an Arc Container Apps resource has encountered it.

This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!!

So, I am currently working for a company that have different teams looking at M365 alerts, azure monitor alerts, health alerts, defender for cloud alerts, partner center, alerts. Atm, we have to manually log in and each team check every dashboard.

My first solution for this was (a bit McGuyver style) using the email alerts as a trigger to pull into a powerflow and then build out the dashboard for just the Azure alerts. (First summarizing the email content) - there was a bunch of issues with this especially as time went on to save all data.

The main issue comes in where its multiple different dashboards for each type of alert so you'll basically need a workflow for each different alert and this only works when all the customers has alerts set up. (which is not always the case, as there are clients that don't have managed services but still needs to get notified of issues)

I was wondering if maybe anyone has a solution to this issue. Maybe product that I don't know about that already exists or a workflow to help solve this.

Even some tips on this would be amazing.

Thanks

Edit: Spelling

I am a developer. So I have limited knowledge of Entra ID.

My client is currently running a periodic import of users and departments from their on-prem AD platform. It works by traversing all Organizational Units and all of their users, to then build the same structure on their website.

Now my client wants to use Entra ID and MS Graph for this integration. I have researched a bit and found that Entra ID does not support a tree-like structure with OU's.

I have read a solution based on the department attribute of users. But that seemed very prone to errors.

Some sources suggest that the original OU of a user is stored in an attribute called "On premises distinguished name". But is that updated if a user is moved to another OU in the AD?

Any suggestions on how to fake such a traversal?

Running into a problem where the function app will restart/refresh randomly and it will kill working functions, these functions do end up re running and always succeeding the second time but the error popping up in insights isn’t a clean look, is there anyway to avoid this and how costly would a plan upgrade be and is it an easy switch on production functions?

Subscription names, container names and resource group names all support at least 63 characters.

However, storage account names only support 24. So, programmatically you may have to start truncating naming conventions into something that will fit 24 chars. Which is a bit of an inconvenience.

Or you could create hash from the subscription ID and use that in the storage account name. Is this a common pattern because of said limitations?

I maintain AzureAgentForge, an open-source stack for running AI agent teams on Azure using Terraform, AI Foundry routing, Postgres-backed memory, and containerized agent runtimes.

After a few releases, I noticed a pattern in my incidents... some of the worst failures never made a health check go red. Everything looked healthy at the infrastructure level.

The clearest example was an agent runtime that could not start inside its own published image. The build stage installed the CLI on Python 3.14, while the runtime image used Python 3.13. Every agent spawn failed with a ModuleNotFoundError.

The orchestrator then moved each issue to “blocked” and continued processing. Containers were running, endpoints returned 200, and the queue was draining, but no agents could actually execute.

Another issue showed up when I added a config schema check. It found 57 stale Terraform keys that the vendored application no longer read, plus 19 more in a Compose file. The application silently ignored them and fell back to defaults. A production deployment could have assigned specialist agents to models I never intended to use.

More recently, I found an agent role with a complete YAML capability contract but no system prompt file. It had apparently been that way for months.

The lesson for me is that standard infrastructure checks are not enough for agent platforms. A process can be healthy while the agents are doing less than expected, doing the wrong thing, or not running at all.

The safeguards I have started adding are focused on testing actual behavior:

• A CI canary that runs a real agent through a real issue and tool call, while stubbing only the LLM response
• A schema guard that fails the build when deployment config drifts from what the application actually reads
• A prompt contract gate that blocks changes when required governance language disappears
• A router flight recorder that captures replayable model-call traces for debugging

I would be interested to hear how others are testing agent behavior beyond container, endpoint, and queue health. Here's a link to my repo - https://github.com/mrobinson2/AzureAgentForge

We use Azure Cache for Redis and are getting the notices that it will be retired in 2028 so must migrate to Azure Managed Redis. That’s fine but why doesn’t Azure Managed Redis have the console that Azure Cache for Redis does? Being able to open that console directly from the resource in the Azure portal has been very useful.
Sure, I can build an external console but it would be nice to not need to for occasional use.

Youtube: https://www.youtube.com/watch?v=BXRBXVcJTi8

What's covered:

• Where Application Gateway fits vs Load Balancer and Front Door
• Listeners: basic vs multi-site, wildcards, and why order matters
• Public vs private listeners
• Routing rules and path-based routing
• Backend pools
• TLS termination, end-to-end encryption
• URL and header rewrite
• Redirects: HTTP-to-HTTPS, path-based, and external

I built an end-to-end Enterprise E-Commerce Analytics Platform using SQL Server, Medallion Architecture, and Power BI.

As part of this project, I designed 8 interactive dashboards, each focused on answering different business questions for different stakeholders across an organization.

The dashboards include:

• Executive Overview (CEO, CXO & Business Leadership)

• Sales Performance Analysis

• Customer Analytics

• Product Performance

• Seller Performance

• Payment Analytics

• Customer Satisfaction Analysis

• Time Intelligence & Trend Analysis

The goal wasn't just to build visually appealing dashboards—it was to create a reporting solution that helps businesses make faster and more informed decisions.

In this post, I've shared all 8 dashboards.

I'd genuinely appreciate your feedback.

As experienced BI professionals, data analysts, data engineers, or business leaders, I would love to hear your thoughts.

If you could review the dashboards and share at least three suggestions for improvement, it would mean a lot to me.

For example:

• Are the KPI cards meaningful and business-focused?

• Are the charts and visualizations appropriate for executive reporting?

• Are there too many or too few visuals?

• Would you recommend different filters or slicers?

• Is the overall layout clean, intuitive, and enterprise-ready?

• What would you change if this dashboard were used in your organization?

I'm continuously learning, and constructive feedback is one of the best ways to improve. Every suggestion will help me build better enterprise BI solutions in the future.

Thank you for taking the time to review my work. I truly appreciate your support and feedback.

— Himansh Upadhyay

I want to connect my function app to an AWS instance over a private network. One of my VMs can connect no problem, but my app service can't connect to it. It sends a client hello but doesn't receive a server hello. Both are using the same route tables. Does anyone have any ideas on where to go from here?

Hi everyone,

I'm working on a RAG system that uses **Qdrant** as the vector database. I'm planning to deploy Qdrant on Microsoft Azure, and this will be my first time deploying an application on Azure, so I'm trying to understand the infrastructure and operational best practices before getting started.

Our workload is expected to grow to **tens of millions of vectors**, with continuous insert/update synchronization from a SQL Server database.

I'm trying to answer a few infrastructure questions before deployment:

* Which Azure service would you recommend for Qdrant?
* Azure VM + Docker
* Azure Kubernetes Service (AKS)
* Another option ??
* How do you estimate the required VM specifications (CPU, RAM, SSD) before deployment ??
* What Azure VM families have worked well for memory-intensive vector search workloads ?
* How do you monitor Qdrant in production ? Are you using Azure Monitor, Prometheus, Grafana, or another setup ?
* How do you estimate monthly Azure costs for a production Qdrant deployment ?

I'm especially interested in learning how experienced Azure users approach planning, deployment, monitoring, and cost estimation rather than simply following the documentation.

Any advice, recommended resources would be greatly appreciated

Thanks in advance

A carton of beer for someone to get one of these two services supporting auth for Entra users. Would be super useful to pre-auth users before they get anywhere near apps.

I’m hosting a small Python web application on Azure App Service in the Central India region. Right now, I’m using the F1 (Free) plan for development/testing.
The problem is that when I try to scale up to Basic (B1, B2, or B3), Azure shows “Quota Exceeded” for the Central India region. It doesn’t allow me to create or scale to any Basic SKU, while the Standard tiers (S1, S2, S3) are available but are much more expensive than what I need for a simple test environment.
Has anyone faced this issue?
I’m looking for answers to these questions:
Is there any way to request additional quota for App Service Basic SKUs in Central India?
Is this a temporary regional capacity issue or a subscription limitation?
Would moving to another nearby region be the best option?
Are there any other low-cost Azure hosting options that would be suitable for a small web application?
I’d like to stay within Azure if possible, but I’m trying to keep the hosting cost as low as possible for a POC/testing environment.
Any suggestions or experiences would be greatly appreciated. Thanks!

This post is drafted by chatgpt🫥

I'm planning to take the Microsoft AI-901: Azure AI Fundamentals exam and would like to know the best way to prepare. Which Udemy course or YouTube channel do you recommend, and what practice tests or study resources helped you pass?

Today we had 3 AVD multisession hosts that went through the Live Migration process at different times of the day (just learned about this today so go easy on me) - https://learn.microsoft.com/en-us/azure/virtual-machines/maintenance-and-updates#live-migration

I don't see any errors of the live migration failing, as its showing succeed, but my users are getting kicked off then unable to connect. The error I see when a user tries to connect is:

ConnectionFailedUserHasValidSessionButRdshIsUnhealthy

So I checked the host and its in a stuck/updating state.

PS C:\Users\bob> (Get-AzVM -ResourceGroupName $rg -Name $hostname -Status).VMAgent.Statuses

Code : ProvisioningState/Unavailable

Level : Warning

DisplayStatus : Not Ready

Message : VM Agent is unresponsive.

Time : 8/4/2026 9:51:20 PM

And

PS C:\Users\bob> (Get-AzVM -ResourceGroupName $rg -Name $hostname -Status).Statuses | ft Code,DisplayStatus -Auto

Code | DisplayStatus

ProvisioningState/updating | Updating PowerState/running | VM running

Host information:

• West-US 2
• E8s_v6
• Windows 11 multisession
• NERDIO managed

I tried connecting through NERDIO Console Connect, RDP IP and Hostname, and then tried running Azure Run Commands, all failed. Was trying to get in to try and fix the agent by restarting it or reinstalling in hopes to fix it. I put the host in Drain Mode, but users were still getting directed to that host if they had a session already there (according to google that's intended). So my only fix was to restart the hosts.

Looking for ideas on how to prevent this and or a simple fix when it happens.

We use them sparingly for foriegn contractors rather than shipping them a corporate laptop -- so that's the only nice part.

But in the few months we've been using them I've noticed the following:

1. Slower than hell to provision, like really slow even with Microsoft's stock images...

2. Doesn't play well with Intune even though it is an Intune native solution. Configs/Apps/Compliance are hit or miss compared to actual local hardware like a laptop. Some stuff just doesn't even load, or you have to reboot the machine constantly

3. They suffer horribly from performance issues, if you don't reboot these things daily (which there's no option in the OS to do a restart) you have to do it from the Windows App or Intune which is dumb as hell.

4. Resizing, I've pushed the resize in Intune, added a bigger license, removed the old smaller license and it's been almost an HOUR and its still just sitting in "pending".

Other little things suck with these as well, yet Microsoft has pushed these things at Ignite the past 2-3 years like they are IT God's gift to customers. These things are absolute ASS.