标签：#Azure

Microsoft released a dedicated AI Gateway tier of Azure API Management in public preview, with a control plane built around models, MCP servers and tools rather than APIs. It fronts Foundry, Bedrock, Vertex AI and OpenAI behind one endpoint, with policy cards instead of XML. Architects welcomed the consolidation while questioning where the governance boundary sits. By Steef-Jan Wiggers

Part 3 of the User Connectivity Architecture series. Introduction The first post in this series described the pattern: a heartbeat on a timer, an Event Hub, a worker writing sessions into Redis, and Redis key expiration driving facility online/offline status. One detail matters later. The heartbeat interval is not hard-coded in the client. The API tells the client when to call next, and the default is 30 seconds. The second post covered two years of running that in production. This post is about the month it stopped working. In January 2026 our heartbeat traffic went from boring to terrifying and stayed there for about four weeks. This is the story of what broke, why the original design had a ceiling we never noticed, and the changes that fixed it: more Event Hub partitions, Azure Container Apps, and KEDA . The Storm A normal day looked like this: 51,000-58,000 heartbeats per hour , hour after hour Roughly 15-16 events per second at idle Flat, predictable, forgettable On January 5, around 7:00 AM PST , it stopped being flat. Time (PST) Heartbeats/hour Baseline ~57,000 12:00 PM 80,005 1:00 PM 216,351 5:00 PM 343,480 9:00 PM 466,760 That is eight times normal event volume in a single hour, and it was still climbing. Events were only half the story. SignalR connection counts told the other half. At the worst of it we were holding roughly eleven times the connections we normally maintain, and every one of those was a browser session we had to track, keep alive, and report status for. It did not spike and recover. It stayed elevated for weeks while we hunted for the cause. When we finally found it, the answer was almost funny: 507 zombie sessions that never ended, running months-old cached client code, and a single user account responsible for 33% of all our token API traffic . One account. Eight times the load. Four weeks. What Eight Times Load Actually Did Here is the part that matters, and it has nothing to do with the number itself. Our Event Hub had one partition. I

CryptoCabana: Azure Cloud CTF Walkthrough 🏖️ Introduction Room: TryHackMe - CryptoCabana Category: ☁️ Cloud Difficulty: Medium Objective: Exploit a misconfigured Azure cloud environment to retrieve a hidden flag. This writeup details a classic cloud privilege escalation path: an exposed SAS token → storage enumeration → credential discovery → Key Vault access → secret reconstruction. The challenge simulates a real-world scenario where poor security practices lead to a complete compromise. Table of Contents Reconnaissance & Initial Access Cloud Enumeration Service Principal Discovery Key Vault Exploration The "Freshly Rotated" Clue Reconstructing the Flag Key Security Takeaways Tools Used Reconnaissance & Initial Access Action: Visited the target website: https://cryptocabanaf5scjagc.z13.web.core.windows.net/ Finding: The website offered to back up seed phrases. Right-clicking and selecting "View Page Source" revealed critical information in the JavaScript code. JavaScript Code: javascript const STORAGE_ACCOUNT = "cryptocabanaf5scjagc"; const BACKUPS_CONTAINER = "backups"; const BACKUP_SAS = "?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D"; Analysis: The SAS (Shared Access Signature) token was hardcoded in client-side JavaScript. Permissions: Read (r) and List (l) Expiration: 2099 – far too long! This token grants anyone access to the storage account. bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Cloud Enumeration Action: Listed all containers in the storage account. Command: bash az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table Output: Name Lease Status Last Modified $web 2026-07-16T18:26:22+00:00 backups 2026-07-16T18:26:22+00:00 vault 2026-07-16T18:26:23+00:00 Analysis: $web: Standard container for Azure Static Website hosting. backups: Appeared empty. vault: Hidden

In a recent Azure Architecture blog article, Azure lead engineer Kishorekumar Pattabiraman outlines practical criteria for choosing between skills, sub-agents, and other approaches when building AI systems, emphasizing reusability, simplicity, and long-term maintainability. By Sergio De Simone

Microsoft's Agent Framework now ships a supported runtime. Build 2026 brought the Agent Harness, the GitHub Copilot and Claude Agent SDK connectors, and the orchestration patterns to stable release; the harness and Foundry Hosted Agents have since reached GA. The shift is from an SDK for building agents to a governed platform for running them. By Steef-Jan Wiggers

The Situation Our team's CI/CD pipeline on Azure DevOps was taking 15 minutes to complete on every push to develop. You'd merge a PR, grab a coffee, come back — and it was still running. A 15-minute feedback loop breaks flow state — by the time the pipeline finishes, you've already switched context twice and forgotten what you were checking. I spent an afternoon digging into the Azure DevOps logs. Here's what I found. The Numbers (Before) Artifact content (uncompressed): 1,218 MB (1.2 GB) Artifact downloaded (compressed): 614 MB Download time: 3-4 min Pipeline breakdown: Build stage: ~5 min (Docker build + artifact) Download artifact: ~3 min (614 MB over the wire) Configure App Service: 2m54s (5 Azure API calls) Deploy (AzureWebApp@1): ~1 min Validate: 2m07s (sleep 30 + 3×30s probes) ───────────────────────────────── Total: ~15 min Root Cause #1: Ignoring output: 'standalone' next.config.js had this: const nextConfig = { output : ' standalone ' , // ← was there the whole time ... }; output: 'standalone' tells Next.js to produce .next/standalone/ — a self-contained directory with only what's needed at runtime. Trimmed node_modules . Auto-generated server.js . No source files. No dev dependencies. But the pipeline was ignoring it: # Old pipeline — copies everything from Docker docker cp deployImage:/app/node_modules . # 600 MB 😱 docker cp deployImage:/app/src . docker cp deployImage:/app/.next . docker cp deployImage:/app/server.js . # ... more files /bin/zip -r deploy.zip .env .next public node_modules package.json \ next.config.js jsconfig.json postcss.config.mjs decs.d.ts src server.js # Then published the ENTIRE working directory as the artifact - task : PublishPipelineArtifact@0 inputs : targetPath : ' $(System.DefaultWorkingDirectory)' # 1.2 GB of loose files + zip Azure DevOps compressed this to 614 MB for transfer. The deploy stage downloaded 614 MB to use a 24 MB zip buried inside it. The fix: # New pipeline — standalone only docker cp deployImage:/app/.next/

Microsoft has released a reference architecture for routing agent traffic on Azure Kubernetes Service. It breaks down the issue into three key choices: which model answers a call, how the call is managed, and which GPU replica handles it. By Claudio Masolo

Before we start This is a series about the intermediate results of an ongoing effort, not a finished story. It isn't an academic paper — it's a record of real engineering work and the insights that emerged along the way. Also, it's not about AI generating code. The AI angle here is about investigation and research — a careful, governed use of AI as a tool, not an autopilot — something I'll come back to in the final part. A word on why now, with the project still unfinished: details fade — the small technical decisions, the intermediate observations, the context in which a given call was made. Writing this down while the work is still ongoing is partly how I keep that context from slipping away. And that context matters: it's a reminder that every past decision, mine or anyone else's, was made for reasons that made sense at the time. One more note: none of this happened instead of product work. All of it ran alongside building new features and fixing bugs — the roadmap never paused for it. On confidentiality: I don't name the Customer, and I avoid any personal data or details a competitor could use. For the same reason, I don't mention anyone by name and refer to colleagues only by role. I won't name them, but I want to acknowledge up front that much of what follows was only possible thanks to the people I work with. The numbers are approximate and rounded — the point is the order of magnitude and the reasoning, not the exact figure. And a framing to carry through the series: at this scale, optimization is less a sprint than a marathon — yes, probably the most overused metaphor around, but here it genuinely fits: steady pacing beats sprinting, and you get there one careful step at a time. How I ended up here I'm a software engineer, and I've spent most of my career close to backends and databases. I've also led teams as a technical team lead — though over time I've deliberately shifted back toward more hands-on technical roles, which is where I'm most effective and m

I recently passed the Microsoft AB-100 exam as part of the Microsoft Frontier Transformation Engineer journey. 🎉 After previously taking AI-103 , I found AB-100 to be a very different type of exam. While AI-103 is closer to the implementation and development side of building AI solutions, AB-100 is strongly focused on: Solution architecture Business requirements Technology selection Microsoft Copilot Studio Dynamics 365 Choosing the right Microsoft technology for each scenario Here are my main takeaways. AB-100 Is an Architecture-Oriented Exam The most important thing to understand is that AB-100 is not a coding exam . I did not encounter any code-oriented questions. Instead, the exam focuses on your ability to analyse a business scenario and determine how a solution should be designed. The questions are closer to: Which Microsoft technology should the organisation use? When should a company choose one platform instead of another? How should different services and products be combined? Which solution best satisfies the business and technical requirements? What are the architectural consequences of each decision? Memorising individual product features is not enough. You need to understand how the different Microsoft technologies fit together, where they overlap, and why one option is more appropriate than another under specific circumstances. Dynamics 365 Knowledge Is Important A good understanding of Dynamics 365 is important for this exam. You do not necessarily need to be a specialist in every Dynamics 365 product, but you should understand the role of the platform within a broader business solution. You should be comfortable identifying situations where Dynamics 365 is a better choice than: Building a custom application Using only Power Apps Using standalone Azure services Creating a solution entirely from scratch The exam expects you to reason about complete organisational solutions, not just isolated AI capabilities. You Need to Understand Microsoft Copilot Stu

A payroll and HR software team rebuilt three monoliths into over 120 smaller services over five years, with no dedicated migration budget. Every new feature was built as its own service instead of changing the old ones. The article covers the pull-based migration, the tools that made this possible, how costs were kept down, and the problems the team ran into along the way. By Prashanth Pasham

In my research on the topic of Azure and Cloud, Gemini mentioned the Cloud Resume Challenge , which I looked into and picked up a copy of the book for. This post will outline my steps as I work through it 😁. Week 00 :: AZ-900 The goal here is to work through necessary course-work so I can quiz for and obtain the Microsoft AZ-900 certification. I enrolled myself in the Microsoft Cloud Support Associate Professional Certificate offered by Coursera and, as I get closer to completing it, will keep this post up to date on my status... In lieu of just studying, I am jumping ahead to work on the project, which will be outlined below. Week 01 :: Cloud Resume (Front-End) 07/23/2026 Yesterday (and today) I worked on creating / securing my Azure account, setting up my environment for Azure development and building the front-end. The development environment is VS Code with the Azure Extensions, Azure CLI and Azure Functions Core Tools. The website is, in its current state, an exact replica of my PDF resume... made with Vue.js. I will be adding a separate page based solely around this project as I included Vue Router and already worked through layout components, a 404 page, etc.

A team lead asks the question in a planning meeting and the room splits three ways: do we build this agent in Copilot Studio, write the orchestration ourselves and host it, or hand our container to Foundry and let it run our code? All three are official Microsoft build paths in 2026, all three end up in the same tenant-wide agent inventory, and the wrong pick costs you a rebuild once the project outgrows it. The answer is not "the most powerful one." It is the one whose service model matches who is building the agent, who owns the runtime, and how much pro-code control over orchestration and protocols you actually need. This article is the decision framework for that choice, grounded in Microsoft Learn and current as of mid-2026. Two of these three paths are public preview, so this is a guide to architectural fit and direction, not a production-reliability scorecard. TL;DR Three build paths, picked by service model, not power. Copilot Studio: low-code managed SaaS for makers. GA. Foundry Hosted agents: managed PaaS runtime for your own container. Public preview. Microsoft 365 Agents SDK: pro-code, self-hosted, widest channel reach. Agent Framework orchestrator in public preview. Monday move: before picking a platform, write down four things for this agent - who builds it (maker or pro-dev), who must own the compute, what channels it has to reach, and whether you need custom protocols or background/async behavior. Those four answers pick the path more reliably than a feature checklist. The three paths in one paragraph each Microsoft's own Cloud Adoption Framework frames the build options as three service tiers, which is the cleanest mental model to start from. The CAF positions them as Copilot Studio (SaaS, no/low-code), Microsoft Foundry (PaaS, pro-code or low-code), and GPUs and Containers (IaaS, code-first frameworks for maximum flexibility). The first two are managed by Microsoft. The third is where the self-hosted SDK path lives when you own the compute end to e

If you're a .NET developer looking to break into AI engineering, agents are the single best place to start. They're the point where "calling an LLM API" turns into "building a system that reasons, uses tools, and takes action" — and Azure AI Foundry Agent Service, paired with .NET, makes this surprisingly approachable. In this post, I'll walk through exactly how to stand up your first agent end-to-end — from the Azure side setup to the actual C# code — and share the full walkthrough in video form as well. 🎥 Watch the full hands-on video here: https://youtu.be/mrsEsculrNg Why Agents, and Why Now Most of us started our AI journey with a simple chat completion call — send a prompt, get text back. That's fine for Q&A, but it falls apart the moment you need the model to do something: run code, search documents, call an API, or hold a multi-turn conversation with real state. That's exactly the gap Foundry Agent Service closes. An agent in Foundry is: Durable — it lives as a resource in your Foundry project, not in your app's memory Tool-aware — it can invoke built-in tools (like a code interpreter) or your own custom functions Stateful — conversations persist and carry context across turns And the best part for us .NET folks: the entire thing is callable from clean, typed C# — no wrestling with raw REST payloads. What You'll Need Before writing any code, set up the Azure side: An Azure AI Foundry project with a chat model deployed (e.g., gpt-4o-mini ) The Foundry User RBAC role assigned to your account at the resource/resource-group scope — this is the single most common blocker people hit (a silent 403 when calling the SDK), so don't skip it az login run locally, so your code can authenticate without hardcoding any keys If you've worked with Cognitive Services roles before, note that agent management needs this separate Foundry-specific role — that trips up a lot of people coming from plain Azure OpenAI usage. Setting Up the .NET Project dotnet new console -n FoundryAgen

How an unexpected regional constraint forced us to deeply understand Azure GPU VM families, naming conventions, and workload fit. Introduction As architects, we often assume that infrastructure decisions are straightforward: "The workload is already running successfully in Region A. Let's deploy the same Kubernetes workload in Region B." That's exactly what we thought. Our workload consisted of a Visual Element Detection (VED) service hosted on Kubernetes. The application uses a PyTorch model to analyze images and detect various visual elements in an image file. The service was already running successfully on a node pool backed by Azure's NVads_A10_v5 GPU VMs. Then we hit an unexpected challenge. The target region did not offer NVads_A10_v5 instances. What looked like a simple deployment exercise became a deep dive into Azure GPU virtual machine families, GPU architectures, VM naming conventions, and workload characteristics. This article shares what I learned in the hope that it helps others who find themselves evaluating Azure GPU SKUs for AI inference workloads. I am relatively new to the world of MLOps, Model deployments, GPU Workloads etc and equally interested and excited to learn more on this front. The Workload Before discussing VM selection, let's understand the workload characteristics: Model Type : PyTorch Model Size : less than 200 MB (.pth) Image Resolution : ~2000 x 2000 Expected Throughput : 5-7 requests/sec Platform : AKS (Kubernetes) Workload Type : Inference only This is important because GPU sizing should always start from the workload and not from the VM catalog. Step 1: Understanding Azure GPU VM Families Many engineers first encounter Azure GPU machines through names like: NV12s_v3 NV6ads_A10_v5 NC4as_T4_v3 ND96isr_H100_v5 The naming can be intimidating. The first breakthrough was understanding that Azure organizes GPU VMs into three primary families: N-Series ├── NV ├── NC └── ND NV Series – Visualization and Graphics NV-series VMs are designe

Two months ago I picked up a ticket that looked routine: a job that reads mailbox data from Microsoft 365 through EWS, running fine for over a year, started failing on a subset of mailboxes in one tenant. Same app registration, same code path, same service account. The error in the logs pointed at throttling, so that's where the admin had already spent three days looking. Wrong direction. The actual cause had nothing to do with throttling budgets. This mix-up happens constantly right now, and it's worth understanding why, because the fix for one problem does nothing for the other, and chasing the wrong one wastes days. TL;DR: if your EWS failures don't scale with request volume, stop tuning throttling and go check your Application Access Policy scope groups instead. What EWS throttling actually looks like Exchange Online throttles EWS the same way it always has: budget-based. Every account gets a policy (the default is EwsDefaultThrottlingPolicy , but plenty of tenants layer custom ones on top) that tracks a slowly-refilling budget rather than a simple call count. When you overspend it, you get back a 503 or 429 with an X-MS-Diagnostics header telling you which budget got exhausted, usually the connection count or the concurrent-request limit. The tell for real throttling is consistency. It scales with load, correlates with concurrency and batch size, and clears up within minutes once you back off. If you graph failure rate against request volume, you'll see a clean relationship. If you double your batch size, failures increase. If you throttle yourself proactively (respecting Retry-After , staying under EWSFindCountLimit for FindItem calls), it mostly goes away. That correlation is the whole diagnostic test. If your failures don't scale with volume, you're not looking at a throttling problem, no matter what the error message on the surface says. What actually changed Over the past year or so, Microsoft tightened enforcement in two places that both produce errors ea

Azure Storage SFTP is Microsoft's managed file transfer service on top of Azure Blob Storage, convenient, but billed continuously per endpoint (roughly $0.30/hour, ~$220/month) and tied to Azure AD. SFTPGo is an open-source file transfer server offering SFTP, FTP/S, and WebDAV with pluggable storage backends (local disk, Azure Blob, S3-compatible, GCS) and no per-endpoint charge. This guide deploys SFTPGo with Docker Compose and Traefik, sets up user auth (password + SSH key + 2FA), connects S3-compatible object storage, and covers the migration path from Azure Storage SFTP. By the end, you'll have a self-hosted file transfer server with the same capabilities at zero endpoint cost. Azure Storage SFTP → SFTPGo Mapping Azure Storage SFTP SFTPGo Equivalent Notes SFTP Endpoint SFTPGo SFTP Server Configurable port, default 2022 Azure Blob Storage Azure Blob backend Native support; point at the same container, no migration needed Azure AD Authentication LDAP/OIDC plugin External identity provider via plugin Local Users Web UI / REST API user management Hierarchical Namespace Virtual directories No HNS requirement Azure Monitor Built-in logging + webhooks/syslog Prerequisite: Linux server with Docker + Compose, a DNS A record for your domain, and (if migrating) an existing Azure Storage account with SFTP enabled plus the Azure CLI installed locally. Deploy with Docker Compose 1. Create the project directories: $ mkdir -p ~/sftpgo/ { data,config } $ cd ~/sftpgo 2. Create the environment file: $ nano .env DOMAIN = sftp.example.com LETSENCRYPT_EMAIL = admin@example.com 3. Create the Compose manifest: $ nano docker-compose.yml services : traefik : image : traefik:v3.6 container_name : traefik command : - " --providers.docker=true" - " --providers.docker.exposedbydefault=false" - " --entrypoints.web.address=:80" - " --entrypoints.websecure.address=:443" - " --entrypoints.web.http.redirections.entrypoint.to=websecure" - " --certificatesresolvers.letsencrypt.acme.httpchallenge=tr

Parts 1 and 2 of this series ( Microsoft Entra extensibility is a gift. It is also Control Plane. and Securing the code that decides who Entra trusts ) made two static decisions. Where the code lives: a dedicated Control Plane subscription, directly under the root management group or under a dedicated Control Plane management group, never in the platform identity subscription or an application landing zone. What credential it uses to call out: a managed identity by default, federated identity credentials when the call must leave Azure, certificates as a tolerated middle step, and static symmetric keys never. Both decisions are one-time. You make them, you walk away, you do not touch them for months. The third decision is not like that. It is continuous, and it is the one most teams quietly skip: how do you know the deployed code on that Function App is still the code your reviewers approved? How do you know the Logic App workflow definition has not been rewritten since last Tuesday? How do you know nobody added a federated identity credential to the managed identity at 3 a.m. on a Saturday? The answer is monitoring. Not "we have Log Analytics turned on." Monitoring with a specific operating contract attached. The posture inversion For most Azure workloads, the default operating posture is reasonable trust. Engineers deploy. Pipelines run. Configuration drifts a little. The team reviews changes weekly. Anomalies are caught eventually. For a Microsoft Entra extension, that posture is wrong. The default has to be inverted. Once an Entra extension lands in production, every change to it is suspicious by default. Not "needs review." Not "let's check first." Suspicious. The default state of an alert firing on a Function App that hosts a custom claims provider is "the SOC is investigating, prove this was approved." If you cannot prove the change was approved within the team's response SLA, the change is treated as an incident and rolled back. That posture is harsh on purpo

Claude models reached GA on Microsoft Foundry with Azure-native billing and governance, but no European data zone exists. Anthropic's own documentation confirms data residency guarantees apply to Bedrock and Vertex AI but not Foundry. European practitioners from banking and healthcare report the offering is unapproved for production. By Steef-Jan Wiggers

While setting up a self-managed Kubernetes cluster on Azure VMs, I hit this error when running sudo kubeadm init on a Standard_B1s VM (1 vCPU / 1 GB RAM): [ERROR NumCPU]: the number of available CPUs 1 is less than the required 2 After checking Stack Overflow and the official Kubernetes documentation ("Before you begin"), I confirmed that kubeadm requires at least 2 CPUs to install the control plane. The fix: I stopped the VM and resized it from Standard_B1s to Standard_B2s (2 vCPU / 4 GB RAM) from the Azure portal, then ran kubeadm init again — the preflight checks passed and the control plane initialized successfully. Posting this in case it helps someone hitting the same issue on a low-tier cloud VM. Thanks to the community for the answers that pointed me in the right direction!

Durante más de cuatro décadas, hablar de servidores era prácticamente sinónimo de hablar de arquitectura x86 . Desde los primeros servidores empresariales hasta la mayoría de los centros de datos modernos, Intel y AMD han dominado la infraestructura sobre la que funcionan nuestras aplicaciones. Sin embargo, algo está cambiando. De forma silenciosa, los principales proveedores de nube como Microsoft Azure están incorporando cada vez más procesadores ARM para ejecutar cargas de trabajo modernas. ¿La razón? No es únicamente el rendimiento. Es la eficiencia energética. El problema de los centros de datos modernos Cada vez que desplegamos una máquina virtual o un clúster de Kubernetes en Azure, detrás existe un servidor físico consumiendo energía. Ahora imaginemos un centro de datos con cientos de miles de servidores. Incluso una pequeña reducción en el consumo eléctrico por servidor representa un ahorro enorme cuando se multiplica por toda la infraestructura. Y no solo hablamos de electricidad. Menos energía implica: menos calor generado menor necesidad de refrigeración menores costos operativos menor huella de carbono Por eso la eficiencia energética se ha convertido en un factor estratégico para los hyperscalers (gigantes tecnológicos que poseen y administran infraestructuras de centros de datos masivas a nivel global). ¿Qué diferencia a ARM de x86? A grandes rasgos: x86 utiliza una arquitectura CISC (Complex Instruction Set Computing) , con un conjunto amplio de instrucciones complejas. ARM utiliza una arquitectura RISC (Reduced Instruction Set Computing) , basada en instrucciones más simples y optimizadas. Esto no significa automáticamente que ARM sea “más rápido”. Lo que sí significa es que puede realizar muchas cargas de trabajo consumiendo considerablemente menos energía. En otras palabras: ARM no busca ganar por fuerza bruta. Busca hacer más con menos. ¿Por qué ahora? Hace unos años, ARM estaba asociado principalmente a teléfonos móviles. Hoy la situación es muy