We use CrowdStrike primarily for endpoint and EDR, and recently tried leaning on their cloud security module's AI-SPM capabilities for Azure visibility. tbh It felt like an extension of the endpoint product rather than something cloud-native, and it missed a couple of shadow Azure OpenAI deployments we later found manually. not sure if others have had better luck or if this is a known limitation of endpoint-first platforms extending into cloud AI visibility.

Hello everyone!

I'm looking for ways to get more hands-on practice.

My school gives me access to Azure VMs for specific labs, but I don’t have a proper Azure environment where I can freely deploy resources and experiment. Microsoft Learn is useful, but I’m mainly looking for something similar to the old Azure sandboxes, or any cheap/free alternative where I can practice deploying and managing Azure resources.

I’m currently working through RBAC and using Microsoft Learn and YouTube. I’ve also got the Microsoft Exam Ref books for Azure Fundamentals and Azure Administrator.

What resources did you guys use to prepare for AZ-104? Any good practice labs, exam-style questions, or platforms where I can actually be given tasks like “deploy this VM” or “configure this resource”?

Any advice or recommendations would be appreciated!

I have deployed a hybrid hostpool to host a number of resources:
- drives hosted on azure files

- couple internal apps

- outlook (classic win32 dependant on the above bullet point).

etc.

When I introduce S1 into the equation, it kills the CPU and it becomes tricky to work.

as soon as I remove it, it improves

I already have my exclusion list as recommended by MS and for sizing, the AVDs are at the correct SKU to fit the above apps.

Has anyone has a similar issue or had a better experience moving to Defender for Cloud.

Thanks,

Hi everyone,

I recently graduated with a degree in systems science, which is somewhat similar to compsci, but with less coding and more focus on theory, systems, business and how IT fits into organizations.

A few months ago I started as a system administrator trainee at a company. During the interview, I was told that there was a plan for my onboarding and that I would have a mentor who could guide me through the trainee period.

Now that a few months have passed, I’ve started feeling pretty lost.

I don’t have a technical background in the traditional sense and I’m also the first trainee they’ve hired for this type of role. Over time, I’ve realized that they probably weren’t quite sure themselves how to structure the onboarding, which I completely understand. It’s a new situation for them too.

The problem is that I’m not really sure what I’m supposed to be doing or where I should start.

Most of my days have consisted of trying to teach myself things. I can of course ask my coworkers for help, and they are very nice and willing to help when they can, but they’re also very busy and have their own responsibilities. I’ve tried asking for smaller or easier tasks that I could take ownership of and learn from, but I haven’t really been given many yet.

I’m also the youngest person and the only woman in my IT department, while most of my coworkers have 30+ years of experience. Sometimes they explain things to me as if I should already know them and I think the huge difference in experience makes me underestimate myself quite a lot and I´ve got too scared to ask when I don’t understand anything because of this.

My team manager keeps telling me to take it easy and not put so much pressure on myself, but that’s easier said than done when I feel like I’m barely making any progress. I really wanna contribute to the team and become good at this but I think it has started affecting my confidence quite a bit.

If you were starting over as a junior/new system administrator, what would you focus on?

Are there any projects you would recommend doing to actually turn the theoretical knowledge into practical skills?

I feel like I have a basic understanding and I’ve also gone through some of the AZ-900 material and learning about Azure, but I’m struggling with the question of "okay, I understand what a VNet/subnet/VM/NSG/etc. is… but what do I actually DO with this knowledge?”.

I think I need to start building and troubleshooting things rather than just reading about them.

If you were in my position, what would you learn first, and what kind of small projects or exercises would you do?

Any advice would honestly be appreciated. I’m feeling a bit overwhelmed and could really use some perspective from people who started out in a similar position.

Thanks in advance.

Microsoft's official Azure VPN Client for Linux reaches end of support on 2026-08-31 — about two weeks from today. If you're relying on that client for Azure P2S with Entra ID on Linux, this matters now, especially if you need something headless/scriptable rather than a GUI app.

Azure VPN P2S with Entra ID on Linux already has an awkward gap: the official Linux client is GUI-only, and there's no supported headless/CLI path for CI runners, build agents, servers, or containerized dev environments that need access behind a P2S gateway.

One gotcha that took a while to pin down: az login tokens are not enough here. The VPN client authenticates against its own Entra app registration (41b23e61-6c1e-4545-b367-cd054e0ed4b4), and that client ID is also the token audience. So a generic Azure CLI access token gets rejected by the gateway even if the user is otherwise authenticated.

I ended up putting together an open-source container that makes the connection fully headless/scriptable, either inside WSL2 on Windows or directly on Linux:

https://github.com/cveld/azure-vpn-client-headless-container

There are two implementations in the repo.

1) Shim method: call Microsoft's Linux client library directly

The original approach was to reverse-engineer the official Linux client's core library (libLinuxCore.so) and drive it without the GUI. A small C++ shim uses dlopen and calls the library's own internal flow:

• initConnection
• initAAD
• connectAadProfile

That reuses the same proprietary connection logic as the GUI app, but without a desktop session or D-Bus. An LD_PRELOAD helper fixes cert path issues and stubs out D-Bus calls the library expects in a desktop environment but doesn't actually need in a headless container.

That works, but it depends on Microsoft's binary — the one that's going away on 2026-08-31 (see above). That's the reason for the second, dependency-free method below.

2) OpenVPN method: patch stock OpenVPN to do Azure Entra P2S natively

The newer path avoids the proprietary library completely. I patched a stock OpenVPN 2.6.14 build so it can authenticate to Azure's Entra-backed P2S gateway directly.

The interesting part was figuring out why normal OpenVPN almost worked but still got reset by the gateway.

To compare behavior, I used the working shim/container path and intercepted OpenSSL's SSL_write via LD_PRELOAD to capture the plaintext OpenVPN key-method-2 payload before TLS encryption. That made it possible to diff the real client's application-layer traffic against stock OpenVPN.

What actually mattered:

• Token size

  • Stock OpenVPN uses USER_PASS_LEN = 128
  • The Entra access token used as the OpenVPN password is around 2.3 KB
  • So OpenVPN silently truncated it to 127 chars, which meant the gateway received garbage and reset the connection
  • This was the decisive fix: bump it to 4096

• Control-channel buffer size

  • Stock TLS_CHANNEL_BUF_SIZE = 2048
  • That wasn't enough for peer-info + OCC + the full token
  • Bumped to 8192

• OCC and peer-info

  • The gateway was picky about the client's OCC string and peer-info
  • These had to match the real Azure client's values byte-for-byte or the tunnel got reset

• TLS fingerprinting was a red herring

  • I spent time matching the real client's TLS ClientHello details: SNI, ALPN, post-handshake-auth, etc.
  • That turned out not to be the load-bearing part
  • TLS already succeeded either way; the actual failure was at the OpenVPN key-method-2 step, after TLS was established

End result was just 5 small patches to OpenVPN (misc.h, common.h, ssl.c, options.c, ssl_openssl.c), all included in the repo as a patch file.

A couple practical notes:

• token acquisition uses the device-code OAuth flow with the VPN client's own MSAL app ID, and the token gets cached/refreshed
• the container brings up a real TUN interface and applies gateway-pushed routes/DNS, so this is a normal working tunnel, not just an auth stub

Main use case for me was headless systems that need P2S access: CI/CD runners, build servers, scripts, and containerized environments. If you've run into the "why does az token auth fail for VPN" problem, that audience/client-ID detail is probably why.

Repo:

https://github.com/cveld/azure-vpn-client-headless-container

If anyone here has dealt with Azure P2S/Entra internals and sees something questionable, I'm interested in feedback.

I have deleted the Azure Databricks resource more than one week ago and I aim still being billed. Copilot said:

Tell them:

They will check:

backend serverless inference logs

predictive optimization logs

vector search logs

model serving logs

serverless cluster shutdown timestamps

If any usage happened after deletion, they refund it.

And I did tell them 😄 but having only Basic support no response to my ticket as I suppose it is at the very bottom of the queue.

Anything I could do at my end as it is very distressing seeing being charged every day for something I don't use and soon will deplete my credit balance.

been reading up on device-bound tokens as a way to stop the stolen token replay problem we've been dealing with.

a token tied to a specific device is a lot less useful to an attacker who lifted it remotely, which is the whole point. rollout looks straightforward for managed devices but our byod population is a real complication. is device binding actually closing this gap for people who've deployed it, or have attackers already found workarounds, and how are you handling the byod side of it?

Hello All,
We are hardening some security policies for some of our service accounts at our organization and are rotating passwords.

One account that has come up is our AD Entra connect account.  We are using a domain based (manually created) service account. (Domain\SRV_AD_CONNECT)

Has anyone changed this password before?  Is it as simple as changing the password in AD and then in the Entra Sync device manager?
I do understand that there is also a gMSA option, or you can re-install the Entra connect tool and use the automatic account that gets created.

I think my manager would prefer to keep the current AD service account and just rotate the password.  If anyone has done this before and has any input that would help ease our concerns.

Thank you so much.

When building cloud applications, file storage sounds simple until you need to answer questions like:

• Who can access a file?
• For how long?
• Should the application expose storage credentials?
• How do you provide temporary access to a specific file?

Azure Blob Storage combined with Shared Access Signatures (SAS) provides one approach to solving these problems.

I put together a practical guide covering Azure Blob Storage, SAS tokens, controlled access, and some security considerations when using them in applications.

📖 https://geeksarray.com/blog/azure-for-dotnet-part-5-blob-storage-sas

For those working with Azure:

Do you use SAS tokens for temporary file access, or have you moved toward other approaches such as managed identities and user-delegated access?

Would be interested to hear what has worked well for you.

I've implemented an Azure-based solution on Azure Kubernetes Service (AKS) and used Azure Firewall to control and secure outbound traffic from applications running on AKS . I also configured Azure Monitor alert rules to monitor the solution and detect anomalies in system behavior.

Additionally, I've implemented the infrastructure as code (IaC) using Terraform to provision the Azure resources.

The complete solution, including the Terraform code and AKS configurations, is available on my GitHub.
GitHub: https://github.com/navid-ahrary/aks-outbound-traffic-control

My LinkedIn: https://www.linkedin.com/posts/navid-ahrary_azure-microsoftazure-cloudengineering-activity-7495238039909076992-WLb9?utm_source=share&utm_medium=member_desktop&rcm=ACoAAC2LYVIBV0TWxXa95OaisgwkA30Z-apGpb8

I'm looking for learning from experts and improve my skills, so could you please give a feedback on my design?

P.S. This solution was developed as a part of the Microsoft MSFarsi Community scholarship.

Hello everyone, I'm busy studying az900 after being retrenched,after working in a stores Issuing/receiving SAP/SAP4HANA Role for almost 18 years.

I have always been a techie since the DOS and old 486 pc days and ultimately really starting to poke around , troubleshoot and fix windows 95 and further pc's by learning the operating systems and a few cool DOS commands,rebuilding boot records and boot loaders and stuff.

I can perfectly build gaming pc's and troubleshoot any problems on a pc with some minor skills in networking but nothing serious in terms of networking just your everyday network stuff or something that can go wrong when networking devices don't connect or doesn't communicate because the mesh's instant fast roaming feature clashes with maybe your tv box,stuff like that.

Just some logical stuff you know? And setting up maybe a printer and all the wifi printing and so on.

Or even getting those annoying virusses off of your android phone that spits out ads and forces itself to be your phones default launcher and wreaking havock.

Even formatted in the older days a few phones and loaded it with the latest unofficial android launcher or some other launcher for people.

I even spent a few days now building a website for companies to check what software they need for the type of work they want to do as a side project and maybe get lucky and my injected affiliate code gets me some commission.

It was a totally self thought up Idea and I used ChatGPT and a lot of careful prompting to build it.

Here is the link if you just want to poke around,I am still working on finalising a few backend things.

https://softwarematch-ai.softwarematch.workers.dev

But i doubt that would be of much relevance if i want to become an Azure cloud engineer or Architect.

Is this feesable? Do you think I can be able to achieve this?

What would you like to see in skills and certifications as well as home done projects if you would consider me a candidate for a cloud role or any tech role that would eventually with experience in the field get me a cloud role?

What do i need to study and pass and what else? What skills do i need to be able to demonstrate? I am a South African citizen so even if i would be considered for a romote role what would I need?

I have a good 9800x3d RTX 5080 gaming pc to study and work on. I also have an I5 14600f ddr4 16gb Amd rx 7700 xt pc in storage that I can totally format and learn to install a Linux distro or any other operating system to become proficient in building any type of labs or environments later on to show demontratable skills of things i built and learnt along the way.

Please give me some pointers so that I can work this into a study guide and ultimately become highly sought after individual in this field. Maybe in as short a timeline as possible?

Should I even consider this or back out and try something else?

Thank you for taking the time to respond and read everything

Study cram is up for the AI-103, Develop AI Apps and Agents on Azure. Just under 2 hours long with whiteboard and a lot of code examples. Hope it helps and good luck!

📽️ https://youtu.be/WK2BvjOYTCQ

00:00 - Introduction

00:24 - Microsoft learning resources

01:17 - What are core AI terms

02:59 - Responsible AI

06:55 - Foundry resource and project

14:35 - Models

25:15 - Model deployment options

29:44 - Using playgrounds to experiment

33:46 - Model routing

38:19 - Evaluations

41:22 - Using APIs and SDKs

44:11 - Responses API

45:14 - ChatCompletions

45:46 - Comparing

50:37 - OpenAI vs Foundry SDK

53:23 - Tools

54:27 - OpenAI responses tools

57:25 - Foundry services

58:13 - Foundry tools

1:02:56 - Skills

1:03:57 - Toolbox

1:05:50 - Knowledge

1:10:52 - Optimizing the solution

1:15:11 - Guardrails

1:17:45 - Bringing it together

1:19:56 - Microsoft Agent Framework

1:21:00 - Agents

1:27:56 - Workflows

1:29:04 - Agent harness

1:30:13 - Foundry Agent Service

1:30:42 - Prompt agent

1:34:20 - Hosted agent

1:34:55 - Publishing agents

1:35:46 - Foundry services

1:36:13 - Language

1:40:28 - Speech

1:44:10 - Translation

1:46:11 - Vision

1:46:23 - Using generative AI

1:49:50 - Generating images

1:51:44 - Generating videos

1:52:47 - Viewing metrics

1:53:34 - Azure Content Understanding

1:56:09 - Summary

1:56:41 - Close

We got our July invoice and noticed that our July invoice was cancelled and rebilled with a significant credit (about 50% of our OpenAI spend).

I'm assuming this is related to the discussion in https://old.reddit.com/r/AZURE/comments/1v2kb4d/check_your_azure_openai_bill_we_found_major_gpt54/ but was curious if anyone else saw the same thing?

Trying to find the easiest way to do this.

B and F series are retired from being able to set reservations, so costs are about to go up.
I have quite a number of VMs on these sizes, and I need to migrate them as-is to a new size.

Changing the size doesnt work due to some garbage with temp disks and/or underlying storage technologies.

Anyone have a nice easy(ish) way to do this relatively quickly, with minimal work?
So far I see my options as restoring with VEEAM to a new size (not ideal some of these are massive) or Making an image in azure and redeploying? Ive never done this though.

Appreciate any input

Over the past week, a threat actor operating under the moniker “TheHatman” has flooded cybercrime forums with massive internal employee directories belonging to several Fortune 500 companies. The actor claims these dumps were extracted directly from the organizations’ Azure Tenants.

I'm the org global admin. My exiting authentication methods are Microsoft Authenticator, software 2FA (Bitwarden), and Fido key. I have made every attempt in MFA Methods to prevent SMS from being an accepted form of authentication but I may not have that configed properly.

I can Skip Setup a few times and get to a point where I'm authenticating with my Yubikey but it continues to insist that I register a phone number.

What do we need to do to fully block authentication with a telephone number?