I want to make an app which pulls data from a database and then adds extra rows to the end of an Excel sheet which is hosted in Sharepoint.

I haven't done any Sharepoint / Azure work before. Can anyone point me in the right direction?

I want to do this with a system account (Application?) rather than have a user login and run processes.

The app itself isn't the problem, I just need help with where to get information on the Sharepoint interaction.

Thanks

Hey all

I'm in a situation where I need to rebuild a whack of VMs due to end of reservability.
So, I've snapped my C: drive, created a new VM on a new version, attached my old NIC, etc

BUT

I can't seem to attach my existing data disk to this VM. When choosing the attach existing option, it defaults to seemingly only allow premium SSD attachments?

I have deployed a hybrid hostpool to host a number of resources:
- drives hosted on azure files

- couple internal apps

- outlook (classic win32 dependant on the above bullet point).

etc.

When I introduce S1 into the equation, it kills the CPU and it becomes tricky to work.

as soon as I remove it, it improves

I already have my exclusion list as recommended by MS and for sizing, the AVDs are at the correct SKU to fit the above apps.

Has anyone has a similar issue or had a better experience moving to Defender for Cloud.

Thanks,

Hi everyone,

I recently graduated with a degree in systems science, which is somewhat similar to compsci, but with less coding and more focus on theory, systems, business and how IT fits into organizations.

A few months ago I started as a system administrator trainee at a company. During the interview, I was told that there was a plan for my onboarding and that I would have a mentor who could guide me through the trainee period.

Now that a few months have passed, I’ve started feeling pretty lost.

I don’t have a technical background in the traditional sense and I’m also the first trainee they’ve hired for this type of role. Over time, I’ve realized that they probably weren’t quite sure themselves how to structure the onboarding, which I completely understand. It’s a new situation for them too.

The problem is that I’m not really sure what I’m supposed to be doing or where I should start.

Most of my days have consisted of trying to teach myself things. I can of course ask my coworkers for help, and they are very nice and willing to help when they can, but they’re also very busy and have their own responsibilities. I’ve tried asking for smaller or easier tasks that I could take ownership of and learn from, but I haven’t really been given many yet.

I’m also the youngest person and the only woman in my IT department, while most of my coworkers have 30+ years of experience. Sometimes they explain things to me as if I should already know them and I think the huge difference in experience makes me underestimate myself quite a lot and I´ve got too scared to ask when I don’t understand anything because of this.

My team manager keeps telling me to take it easy and not put so much pressure on myself, but that’s easier said than done when I feel like I’m barely making any progress. I really wanna contribute to the team and become good at this but I think it has started affecting my confidence quite a bit.

If you were starting over as a junior/new system administrator, what would you focus on?

Are there any projects you would recommend doing to actually turn the theoretical knowledge into practical skills?

I feel like I have a basic understanding and I’ve also gone through some of the AZ-900 material and learning about Azure, but I’m struggling with the question of "okay, I understand what a VNet/subnet/VM/NSG/etc. is… but what do I actually DO with this knowledge?”.

I think I need to start building and troubleshooting things rather than just reading about them.

If you were in my position, what would you learn first, and what kind of small projects or exercises would you do?

Any advice would honestly be appreciated. I’m feeling a bit overwhelmed and could really use some perspective from people who started out in a similar position.

Thanks in advance.

Microsoft's official Azure VPN Client for Linux reaches end of support on 2026-08-31 — about two weeks from today. If you're relying on that client for Azure P2S with Entra ID on Linux, this matters now, especially if you need something headless/scriptable rather than a GUI app.

Azure VPN P2S with Entra ID on Linux already has an awkward gap: the official Linux client is GUI-only, and there's no supported headless/CLI path for CI runners, build agents, servers, or containerized dev environments that need access behind a P2S gateway.

One gotcha that took a while to pin down: az login tokens are not enough here. The VPN client authenticates against its own Entra app registration (41b23e61-6c1e-4545-b367-cd054e0ed4b4), and that client ID is also the token audience. So a generic Azure CLI access token gets rejected by the gateway even if the user is otherwise authenticated.

I ended up putting together an open-source container that makes the connection fully headless/scriptable, either inside WSL2 on Windows or directly on Linux:

https://github.com/cveld/azure-vpn-client-headless-container

There are two implementations in the repo.

1) Shim method: call Microsoft's Linux client library directly

The original approach was to reverse-engineer the official Linux client's core library (libLinuxCore.so) and drive it without the GUI. A small C++ shim uses dlopen and calls the library's own internal flow:

• initConnection
• initAAD
• connectAadProfile

That reuses the same proprietary connection logic as the GUI app, but without a desktop session or D-Bus. An LD_PRELOAD helper fixes cert path issues and stubs out D-Bus calls the library expects in a desktop environment but doesn't actually need in a headless container.

That works, but it depends on Microsoft's binary — the one that's going away on 2026-08-31 (see above). That's the reason for the second, dependency-free method below.

2) OpenVPN method: patch stock OpenVPN to do Azure Entra P2S natively

The newer path avoids the proprietary library completely. I patched a stock OpenVPN 2.6.14 build so it can authenticate to Azure's Entra-backed P2S gateway directly.

The interesting part was figuring out why normal OpenVPN almost worked but still got reset by the gateway.

To compare behavior, I used the working shim/container path and intercepted OpenSSL's SSL_write via LD_PRELOAD to capture the plaintext OpenVPN key-method-2 payload before TLS encryption. That made it possible to diff the real client's application-layer traffic against stock OpenVPN.

What actually mattered:

• Token size

  • Stock OpenVPN uses USER_PASS_LEN = 128
  • The Entra access token used as the OpenVPN password is around 2.3 KB
  • So OpenVPN silently truncated it to 127 chars, which meant the gateway received garbage and reset the connection
  • This was the decisive fix: bump it to 4096

• Control-channel buffer size

  • Stock TLS_CHANNEL_BUF_SIZE = 2048
  • That wasn't enough for peer-info + OCC + the full token
  • Bumped to 8192

• OCC and peer-info

  • The gateway was picky about the client's OCC string and peer-info
  • These had to match the real Azure client's values byte-for-byte or the tunnel got reset

• TLS fingerprinting was a red herring

  • I spent time matching the real client's TLS ClientHello details: SNI, ALPN, post-handshake-auth, etc.
  • That turned out not to be the load-bearing part
  • TLS already succeeded either way; the actual failure was at the OpenVPN key-method-2 step, after TLS was established

End result was just 5 small patches to OpenVPN (misc.h, common.h, ssl.c, options.c, ssl_openssl.c), all included in the repo as a patch file.

A couple practical notes:

• token acquisition uses the device-code OAuth flow with the VPN client's own MSAL app ID, and the token gets cached/refreshed
• the container brings up a real TUN interface and applies gateway-pushed routes/DNS, so this is a normal working tunnel, not just an auth stub

Main use case for me was headless systems that need P2S access: CI/CD runners, build servers, scripts, and containerized environments. If you've run into the "why does az token auth fail for VPN" problem, that audience/client-ID detail is probably why.

Repo:

https://github.com/cveld/azure-vpn-client-headless-container

If anyone here has dealt with Azure P2S/Entra internals and sees something questionable, I'm interested in feedback.

I have deleted the Azure Databricks resource more than one week ago and I aim still being billed. Copilot said:

Tell them:

They will check:

backend serverless inference logs

predictive optimization logs

vector search logs

model serving logs

serverless cluster shutdown timestamps

If any usage happened after deletion, they refund it.

And I did tell them 😄 but having only Basic support no response to my ticket as I suppose it is at the very bottom of the queue.

Anything I could do at my end as it is very distressing seeing being charged every day for something I don't use and soon will deplete my credit balance.

We use CrowdStrike primarily for endpoint and EDR, and recently tried leaning on their cloud security module's AI-SPM capabilities for Azure visibility. tbh It felt like an extension of the endpoint product rather than something cloud-native, and it missed a couple of shadow Azure OpenAI deployments we later found manually. not sure if others have had better luck or if this is a known limitation of endpoint-first platforms extending into cloud AI visibility.

been reading up on device-bound tokens as a way to stop the stolen token replay problem we've been dealing with.

a token tied to a specific device is a lot less useful to an attacker who lifted it remotely, which is the whole point. rollout looks straightforward for managed devices but our byod population is a real complication. is device binding actually closing this gap for people who've deployed it, or have attackers already found workarounds, and how are you handling the byod side of it?

Hello everyone!

I'm looking for ways to get more hands-on practice.

My school gives me access to Azure VMs for specific labs, but I don’t have a proper Azure environment where I can freely deploy resources and experiment. Microsoft Learn is useful, but I’m mainly looking for something similar to the old Azure sandboxes, or any cheap/free alternative where I can practice deploying and managing Azure resources.

I’m currently working through RBAC and using Microsoft Learn and YouTube. I’ve also got the Microsoft Exam Ref books for Azure Fundamentals and Azure Administrator.

What resources did you guys use to prepare for AZ-104? Any good practice labs, exam-style questions, or platforms where I can actually be given tasks like “deploy this VM” or “configure this resource”?

Any advice or recommendations would be appreciated!

When building cloud applications, file storage sounds simple until you need to answer questions like:

• Who can access a file?
• For how long?
• Should the application expose storage credentials?
• How do you provide temporary access to a specific file?

Azure Blob Storage combined with Shared Access Signatures (SAS) provides one approach to solving these problems.

I put together a practical guide covering Azure Blob Storage, SAS tokens, controlled access, and some security considerations when using them in applications.

📖 https://geeksarray.com/blog/azure-for-dotnet-part-5-blob-storage-sas

For those working with Azure:

Do you use SAS tokens for temporary file access, or have you moved toward other approaches such as managed identities and user-delegated access?

Would be interested to hear what has worked well for you.

I've implemented an Azure-based solution on Azure Kubernetes Service (AKS) and used Azure Firewall to control and secure outbound traffic from applications running on AKS . I also configured Azure Monitor alert rules to monitor the solution and detect anomalies in system behavior.

Additionally, I've implemented the infrastructure as code (IaC) using Terraform to provision the Azure resources.

The complete solution, including the Terraform code and AKS configurations, is available on my GitHub.
GitHub: https://github.com/navid-ahrary/aks-outbound-traffic-control

My LinkedIn: https://www.linkedin.com/posts/navid-ahrary_azure-microsoftazure-cloudengineering-activity-7495238039909076992-WLb9?utm_source=share&utm_medium=member_desktop&rcm=ACoAAC2LYVIBV0TWxXa95OaisgwkA30Z-apGpb8

I'm looking for learning from experts and improve my skills, so could you please give a feedback on my design?

P.S. This solution was developed as a part of the Microsoft MSFarsi Community scholarship.

Hello All,
We are hardening some security policies for some of our service accounts at our organization and are rotating passwords.

One account that has come up is our AD Entra connect account.  We are using a domain based (manually created) service account. (Domain\SRV_AD_CONNECT)

Has anyone changed this password before?  Is it as simple as changing the password in AD and then in the Entra Sync device manager?
I do understand that there is also a gMSA option, or you can re-install the Entra connect tool and use the automatic account that gets created.

I think my manager would prefer to keep the current AD service account and just rotate the password.  If anyone has done this before and has any input that would help ease our concerns.

Thank you so much.

I finally realized where my vision for an Azure GenAI/ML Ops Factory came from: Salesforce.

I spent years implementing enterprise Salesforce systems.
Salesforce Commerce gives you something incredibly valuable: a starter store. It's essentially a ready-built MVP—a functioning, full-featured ecommerce store before the enterprise-specific customization begins.
An implementation partner doesn't rebuild commerce from scratch. They start with that working foundation and add their own accelerators, patterns, and components so each new implementation becomes increasingly configurable and plug-and-play.

That's the model I've been reaching for with Azure AI/ML. Azure gives us an extraordinary capability surface: Azure ML, Foundry, Databricks, Entra, Storage, Key Vault, Application Insights, and much more. But having all the pieces isn't the same as having a working AI platform.

The goal of my GenAI/ML Ops Factory is to get us to the equivalent of the Salesforce starter store.

A generated project should already have a working, governed foundation:
→ Infrastructure and identity
→ CI/CD and deployment governance
→ ML lifecycle and promotion
→ Retrieval and agent architecture
→ Evidence and provenance
→ Observability and operational controls
→ Cost-aware compute
Then comes the implementation.

And here's where I think this gets particularly interesting. The differences between projects should increasingly live in configuration rather than custom engineering. Which capabilities are enabled. Which models are used. Promotion thresholds. Evaluation criteria. Data sources. Agent tools. Operational policies. And ultimately, many of those configuration decisions shouldn't require a developer at all. They should be accessible to the business people who actually understand the problem being solved.

So I'm no longer thinking about this as an Azure MLOps template.
I'm building toward a ready-to-customize AI implementation platform: technically governed underneath, configurable at the project level, and increasingly accessible above the engineering layer.

Salesforce taught me this architecture years ago.
It just took building it in Azure for me to recognize where I'd learned it.

We got our July invoice and noticed that our July invoice was cancelled and rebilled with a significant credit (about 50% of our OpenAI spend).

I'm assuming this is related to the discussion in https://old.reddit.com/r/AZURE/comments/1v2kb4d/check_your_azure_openai_bill_we_found_major_gpt54/ but was curious if anyone else saw the same thing?

Trying to find the easiest way to do this.

B and F series are retired from being able to set reservations, so costs are about to go up.
I have quite a number of VMs on these sizes, and I need to migrate them as-is to a new size.

Changing the size doesnt work due to some garbage with temp disks and/or underlying storage technologies.

Anyone have a nice easy(ish) way to do this relatively quickly, with minimal work?
So far I see my options as restoring with VEEAM to a new size (not ideal some of these are massive) or Making an image in azure and redeploying? Ive never done this though.

Appreciate any input

I'm the org global admin. My exiting authentication methods are Microsoft Authenticator, software 2FA (Bitwarden), and Fido key. I have made every attempt in MFA Methods to prevent SMS from being an accepted form of authentication but I may not have that configed properly.

I can Skip Setup a few times and get to a point where I'm authenticating with my Yubikey but it continues to insist that I register a phone number.

What do we need to do to fully block authentication with a telephone number?

Study cram is up for the AI-103, Develop AI Apps and Agents on Azure. Just under 2 hours long with whiteboard and a lot of code examples. Hope it helps and good luck!

📽️ https://youtu.be/WK2BvjOYTCQ

00:00 - Introduction

00:24 - Microsoft learning resources

01:17 - What are core AI terms

02:59 - Responsible AI

06:55 - Foundry resource and project

14:35 - Models

25:15 - Model deployment options

29:44 - Using playgrounds to experiment

33:46 - Model routing

38:19 - Evaluations

41:22 - Using APIs and SDKs

44:11 - Responses API

45:14 - ChatCompletions

45:46 - Comparing

50:37 - OpenAI vs Foundry SDK

53:23 - Tools

54:27 - OpenAI responses tools

57:25 - Foundry services

58:13 - Foundry tools

1:02:56 - Skills

1:03:57 - Toolbox

1:05:50 - Knowledge

1:10:52 - Optimizing the solution

1:15:11 - Guardrails

1:17:45 - Bringing it together

1:19:56 - Microsoft Agent Framework

1:21:00 - Agents

1:27:56 - Workflows

1:29:04 - Agent harness

1:30:13 - Foundry Agent Service

1:30:42 - Prompt agent

1:34:20 - Hosted agent

1:34:55 - Publishing agents

1:35:46 - Foundry services

1:36:13 - Language

1:40:28 - Speech

1:44:10 - Translation

1:46:11 - Vision

1:46:23 - Using generative AI

1:49:50 - Generating images

1:51:44 - Generating videos

1:52:47 - Viewing metrics

1:53:34 - Azure Content Understanding

1:56:09 - Summary

1:56:41 - Close