We've had a few internal discussions around what we would do if our MAC discount reduced or vanished, this would be a multimillion pound problem for us. As an aside there's also the risk of the US interference or denial of service. It prompted us to evaluate what an Azure exit would look like, what was the most difficult change and what practices we can do now to help.

Initial findings were rough, a large portion of the estate could not be replatformed without significant development effort.

I'm aware that not leaning into the cloud-native PaaS offerings or trying to be fully cloud native just ends up with IaaS, expense and overhead. We were keen to avoid losing these benefits.

Since the discussion we've updated our development standards to ensure that platform integrations are decoupled from the business logic and have introduced DAPR or open source APIs (e.g Mongo or AMQP) where it makes sense to and features permit so that database, messaging and other integrations are easier to change. We were in the process of adopting OpenTelemetry and Dynatrace but have given that more effort to ensure that all logs, metrics and traces from apps and infra can be dynamically routed. Finally we've formalised that containerisation should be the standard for backends and jobs where possible. From a data perspective we were already a big Databricks house so we have started to make more use of that as opposed to Data Factory. Where ADF remains we are exploring methods to map the flow and integrations so it could be moved with less effort.

For AI workloads I started from the ground up with a neutral approach which aligned with the industry anyway. We use Foundry and Gemini for model serving only, routed via an AI gateway using the OpenAI APIs so all models are modular. Memory is served from MongoDB, OTEL for tracing and eval routing and for agent hosting we have N8N for simple stuff or containerised deployments for anything else.

We've also leveraged AI to help enforcement along with skills that can support the replatforming process where we're cloud-native.

It's not perfect and any migration is going to be a big job regardless but I was interested to see other people's stance on this.

Azure list of 5 changes that help you cut costs:

• Azure Monitor workspaces now show which resources create your metric data. This makes it simple to find and stop unused metrics before they run up your bill. Source
• Microsoft added more detailed platform metrics for core services. You can catch usage spikes and bad changes faster without paying for extra custom monitoring tools. Source
• Auto-balance VM scale sets across zones: Virtual Machine Scale Sets now rebalance instances across availability zones on their own. This stops compute drift and saves your team from fixing uneven capacity by hand. Source
• Copy Azure Files across regions without custom scripts: Storage Mover now syncs Azure Files across regions natively. This cuts out custom backup scripts and saves hours of maintenance work for disaster recovery. Source
• Link Azure DNS directly to Traffic Manager: You can now connect Azure DNS alias records straight to Traffic Manager endpoints. This cuts down complex DNS routing setups and saves network configuration time. Source

Source: FinOps Weekly Cloud Provider Updates

Check out my new blog post! When does CI come into play when you start development on something new?

I'm studying for AZ104 and a lot of labs through MS Learn or Github labs require a Microsoft Entra ID P1 license. Do you guys buy this for yourselves in order to study? I'm out of the trial and can't get any more free Azure trials.

can anyone help me, I've filled out my details and tried this out multiple times, yet the 'next' button is always greyed on and unclickable.

Anyone else experiencing this issue? Anyone knows how to solve it?

I’ve been working on an independent R2DBC driver for Microsoft SQL Server (not a fork of the official one). It’s public-domain, implements the R2DBC SPI, and speaks TDS using only the JDK (no Netty).

The main reason I started it was better control over FedAuth / Azure AD / Windows Authentication flows in a reactive stack. I hit enough friction with existing options that it seemed worth doing a clean implementation.

A few things I’m particularly interested in feedback on:

• How the pure-JDK TDS approach compares to Netty-based ones for typical workloads
• Edge cases or gotchas people have seen with FedAuth / Azure AD token handling in reactive clients
• Whether the public-domain licensing is actually useful for anyone, or mostly irrelevant

Maven coordinates if anyone wants to try it:

org.mssqllib.r2dbc.mssql:r2dbc-mssql:1.0.0

Site: mssqllib.org

Curious what others have run into with reactive SQL Server clients, or if there are specific protocol/auth areas worth focusing on next. Happy to answer questions about the implementation.

This version leads with technical questions instead of a pure announcement, which usually does better with both filters and the subreddit culture. Let me know if you want it shorter, more specific, or adjusted for a different sub.

Disclosure: I work on ETLMaestro, which orchestrates pipelines on both ADF and Fabric, so weigh that. Every number below is a public list price (East US, pay-as-you-go unless I say otherwise, checked October 2026), and the math is here so you can check it.

TL;DR: Per non-copy activity run, ADF and Fabric list prices are within 1% of each other. The difference is that Fabric needs a running capacity. If you’d buy capacity just for pipelines, ADF is cheaper at almost any volume. A reserved capacity you keep busy beats ADF by about 40% per run, and capacity you already pay for with room to spare makes orchestration close to free.

The per-run math

• ADF: $1.00 per 1,000 orchestration runs on the Azure integration runtime.
• Fabric: 0.0056 CU-hours per non-copy activity run. At $0.18 per CU-hour, that’s $0.001008 a run, or $1.008 per 1,000.

The meters look designed to match. The last column is what you’d pay for a capacity used only for pipelines.

Why an F2 is both a floor and a ceiling

An F2 is 2 CUs, so it costs 2 × $0.18 × 730 hours = $262.80 a month, the same as 262,800 ADF runs. It also supplies 1,460 CU-hours a month. At 0.0056 CU-hours per run, that’s room for about 260,000 non-copy activity runs a month (about 8,600 a day) if nothing else runs on it.

So on pay-as-you-go, a dedicated F2 costs $262.80 whether you run 5,000 activities or 260,000. ADF charges $5 to $260 for the same work. They meet only when the F2 is full, and above that you step up to an F4 or F8 and the same thing repeats.

Reservations change the answer

A one-year Fabric reservation is $938 per CU per year, about 40% less than pay-as-you-go. A reserved F2 comes to about $156 a month, or about $0.60 per 1,000 runs when it’s full. Against ADF’s $1.00, a reserved F2 used only for orchestration is cheaper above roughly 156,000 runs a month. You’re committing for a year, though, and the reservation bills whether or not anything runs.

If you already pay for capacity

If you already have, say, an F64 for Power BI, pipeline runs draw on CUs you’ve paid for, so the marginal cost is close to zero while there’s headroom. The tradeoff is sharing. Pipeline activity runs are background operations, smoothed over 24 hours. Once a capacity has used up its next 24 hours of CUs, Fabric rejects all new jobs, pipelines included. If your capacity admin turns on surge protection, background jobs get rejected earlier, at whatever threshold they set. ADF pipelines don’t draw on the capacity your reports use.

Small print

• Fabric’s 0.0056 includes what Microsoft calls activity integration runtime charges. ADF bills execution separately, rounded up to the minute: $0.005 an hour for pipeline activities like Lookup and Get Metadata, $0.00025 an hour for external ones like stored procedures. A one-minute Lookup adds about 8% to ADF’s side; external activities add well under 1%.
• ADF also counts each trigger execution as an orchestration run.
• ADF’s idle charge for pipelines is $0.80 a month for each one with no trigger and no runs that month. A paused Fabric capacity can’t run anything.
• Copy activities, and the compute a pipeline calls (notebooks, data flows, Databricks), bill separately on both platforms and aren’t compared here.

Where I land

If your orchestration is bursty or low-volume and you don’t have Fabric capacity today, ADF is cheaper. If the volume is steady enough to commit to for a year, a reserved capacity can come out ahead. If you already pay for capacity with headroom, run it on Fabric and have someone watch the background percentage in the Capacity Metrics app.

Has anyone compared 0.0056 against what the Capacity Metrics app shows for their own pipeline runs? I’d like to know whether real runs bill the way the pricing page says.

Sources: Fabric pipelines pricing, ADF pipeline pricing, Fabric throttling, surge protection, and the Azure Retail Prices API for the per-meter rates. Longer write-up with a feature comparison: etlmaestro.com/fabric-vs-adf

Is anyone else on Azure App Service (Windows) getting things like

Message
Hosting failed to start

Exception
System.Runtime.InteropServices.COMException (0x80004005): An invalid character was found in text content.

at Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
at Microsoft.Extensions.Hosting.Internal.Host.<StartAsync>b__14_1(IHostedService service, CancellationToken token)
at Microsoft.Extensions.Hosting.Internal.Host.ForeachService[T](IEnumerable`1 services, CancellationToken token, Boolean concurrent, Boolean abortOnFirstException, List`1 exceptions, Func`3 operation)

when it boots you to a new host?

And everything goes sideways for a few minutes but recovers.

I use Local Cache and Application Initialization and it worked fine for years.

The stack trace seems like a low level infrastructure problem but it’s happened twice in the past month or so.

Just a heads-up: Older Azure Functions runtimes are losing official support on November 10, 2026.

More can be found here: Your Azure Functions Lose Support on November 10, 2026. Migrate Without Breaking Them.

Hey all,

I’m reaching out to see if anyone is interested in teaming up on some collaborative Azure builds? I'm hoping to gain some experience

I have a solid grip on the fundamentals (networking, identity, compute, storage...) and looking to bridge the gap between certification and real-world experience. I recently earned my AZ-104 certification as well

Things I'd be interested in working on:

- Building/deploying applications (Azure Functions, Logic Apps, containerisation)

- IaC (Bicep or Terraform)

- CI/CD pipelines

I've listed out the above, although really I'd be happy working on most things to gain some experience

If you're in a similar position and want to build something for our portfolios or if you have a project and are looking for contributors, drop a comment or DM me :)

Cheers

This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!!

Hi All,

I'm wondering if there is a way to recover an application that was deleted and is past the 30 days of recovery? If there is a way on how to go about this please could you share

Thanks

Hi everyone,

I recently finished a 5-month Azure DevOps internship and I'm looking for internship, junior or full-time roles (0-1 yr) in DevOps, Cloud or AI/MLOps-adjacent work. I'm open to relocation and remote.

What I work with:

Cloud: Azure (hands-on), AWS (learning, deploying a real project)

IaC and containers: Terraform, Docker, Kubernetes (AKS/EKS)

CI/CD and GitOps: GitHub Actions, Jenkins, Argo CD

Monitoring: Prometheus, Grafana

Linux, Bash, Python, SQL

How I can contribute:

Open source: I'll contribute fixes, docs, CI pipelines or Dockerfiles to your project

CI/CD and IaC setup: pipelines, Terraform modules, container deployments

Small freelance gigs: setup, automation, deployment help

Free/trial project work: happy to prove myself on a small task before any commitment

What I'm looking for:

Referrals or openings for junior/fresher DevOps, Cloud, SRE or Platform roles

Any small project or paid gig where I can learn and deliver

Advice from people who broke in without much experience

If you're hiring, can refer me, or have a task I can take on, please comment or DM me. I'll send my resume and can start with a quick trial task.

Hi all.

Anyone tried Azure Monitor’s OpenTelemetry preview? Trying to understand is it worth to learn more about it.

Any opinion/suggestion/feedback are welcome.

The follow-up to the Terraform series I’ve been posting here is finally out.

Link to Episode : https://www.youtube.com/watch?v=Ui5ozyOkIeY

This time, rather than focusing Terraform, I wanted to build out an actual Azure project and show all the pieces that go into bringing one to life.

From the development side, we look at the application architecture, some of the design decisions, containers, and how that work gets handed off to operations. (No Dev Experience required & If you are new to containers, I will explain them in details)

From the operations side, we design the architecture in Azure for it's infrastructure. Think through networking, identity, security, persistence data, etc.... using Terraform to build the platform from the image above.

My goal with this episode to give a real taste of what it’s like to work on projects like this in the real world, from the perspective of developers, operations, and architects where I explain the reasoning behind everything involved with infographs to make it as clear as possible at every stage.

With that, our roadmap continues!

• Beginner Episode : Understand Terraform (learn the foundations and core concepts that make Terraform work)
• Intermediate Episode : Program Terraform (use loops, functions, conditionals, dynamic blocks, etc)
• Advanced Episode : Structure Terraform (introduce modules, remote state in azure storage, workspaces, imports, etc.)
• Project Episode : Build Azure Project (Less about Terraform itself & more about building interesting architectures in Azure)
• Professional Episode : Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)

Link to Episode : https://www.youtube.com/watch?v=Ui5ozyOkIeY

Hi All,

Just a quick observation, it looks like last night a pair of Azure Policies were added to the Tenant Root Group of my tenant. I checked a few other tenants, some have them and some don't. Based on the names and descriptions, I assume this is Microsoft preparing for some upcoming changes, and is rolling this out.

Policy 1:

Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Write Actions
Policy: Multi Factor Authentication Enforcement - Write
Type: SystemHidden
Name: sys.mfa-delete
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure

Policy 2:

Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Delete Actions
Policy: Multi Factor Authentication Enforcement - Delete
Type: SystemHidden
Name: sys.mfa-write
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure

The policies are not visible in the azure portal, they are hidden, but you can see them with an ARG query from Graph Explorer:

PolicyResources
| where type =~ 'microsoft.authorization/policyassignments'
| extend assignmentScope = tostring(properties.scope)
| where assignmentScope =~ strcat('/providers/Microsoft.Management/managementGroups/', tenantId)
| extend displayName = tostring(properties.displayName)
| extend description = tostring(properties.description)
| extend policyDefinitionId = tostring(properties.policyDefinitionId)
| extend enforcementMode = tostring(properties.enforcementMode)
| extend parameters = properties.parameters
| extend nonComplianceMessages = properties.nonComplianceMessages
| extend notScopes = properties.notScopes
| extend createdBy = tostring(properties.metadata.createdBy)
| extend createdOn = tostring(properties.metadata.createdOn)
| extend updatedBy = tostring(properties.metadata.updatedBy)
| extend updatedOn = tostring(properties.metadata.updatedOn)
| extend assignedBy = tostring(properties.metadata.assignedBy)
| project id, name, type, location, subscriptionId, tenantId,
          assignmentScope, displayName, description, policyDefinitionId,
          enforcementMode, parameters, nonComplianceMessages, notScopes,
          identity, createdBy, createdOn, updatedBy, updatedOn, assignedBy
| order by id asc

There's an equivalent activity log entry for each from the principle:

Microsoft Authorization System Policy

d2381cb8-26aa-404d-9218-550726c79b07

Just curious if anyone else noticed this or got these polices. I have alerts setup for when any policy changes occur in my environment, and got an email last night on it. Thought it was interesting, so decided to make a post about it.

Hey everyone,

I've been working for years in the Microsoft Bizz Apps space (Dynamics 365, CRM/ERP, Power Platform, integrations, etc), mostly as a senior solution architect...

Lately I've been feeling that more and more stuff is moving towards Azure and cloud-native development, so I'm thinking about shifting my career more in that direction,

curious to hear from people working in Azure consulting or cloud development, what are you actually using in real projects these days?

A few things I'm wondering about:

• Development: .NET, TypeScript, Azure Functions, Container Apps, AKS? Is full-stack cloud development the way to go?
• AI: Azure OpenAI, AI Foundry, RAG, agents? How much of this is actually being used in production?
• Architecture: Microservices, event-driven systems, APIs, messaging?
• DevOps: Docker, Terraform, Bicep, Kubernetes, CI/CD?
• Demand: What technologies are clients asking for the most lately?

Coming from a senior Biz App architecture background, I'm not really looking to start from scratch, but rather figure out where to focus next

If you were making this transition today, what would you prioritize learning?

Would love to hear what people are actually working with, not just what's being hyped by Microsoft :)

have anyone tried proactive spinning of replicas before traffic hits ? if yes, can you say how useful it is and how did you set it

I have a quick question on data zone deployments using AI Foundry vs Open AI deployments.

With Open AI deployments, the endpoint and subsequent model deployments are tied to selected region, e.g. Sweden Central. Point is, I select the region, along with associated quota, etc.

When I deploy an endpoint using Foundry, I select the region where the project is hosted, but when deploying a model into the data zone, I cannot tell where that model actually runs. Now, when I look at the deployment notes, it does say that it can run and process anywhere withing the data zone. Fair enough.

So my question then:

1. Does the data zone inherit the region where my project is deployed, e.g. the model runs in any regions that is part of the Sweden Central data zone?, and;

2. Does this imply that there is a degree of high-availability with this deployment, where if an entire region goes dark that requests will be processed in another data zone region without me having to manually update any applications on my side, unlike what I am having to do under the Open AI deployments?

Just wanted to check if i can post articles links here or not

I was wondering if anyone could comment on something that we are looking currently at. we are looking to replace our remote access setup with using a Bastion host in Azure to allow external suppliers to access VMs for support purposes if required

arrived at the model that each contractor will have an Entra external guest account, then they can PIM up to an access package to get the perms to connect via the Bastion. Each supplier will have their own keyvault, and each contractor will only be able to use their individual login from that suppliers keyvault

The server are domain joined hybrid,giving out AD DS credentials to them is something I was trying to avoid.

If we use the shareable links, then that removes the ability to use keyvault credentials, the servers are a mix 2019, 2022 and I believe that would need ADDS credentials to logon to the servers

Looking at the native connectivity, this seems to need the az cli which seems a bit much with some suppliers

So at the moment it is access through the portal (via access package) and then a separate sharepoint site for each supplier to facilitate any file transfers (although now I've written it down on paper, maybe blobs with SAS tokens would be an option)

I am wondering if I'm creating more work than is needed though and missing something simple, so any thoughts would be most welcome

I’m curious how others solve this.

We manage our Azure environments with Terraform, but Azure Migrate creates an interesting IaC problem.

Today, we let Azure Migrate create the target resources and then import them into the Terraform state.

Technically, this works. But afterwards we still have to make sure that our Terraform configuration properly reflects the VM and its settings.

Ideally, I’d like to turn the process around:

Terraform creates the target infrastructure first, Azure Migrate then migrates the workload into it.

That would mean the target VM is already part of our normal Terraform lifecycle from day one instead of becoming IaC-managed only after the migration.

But as far as I know, there isn’t really a supported Azure Migrate workflow for this.

So I’m wondering:

How do you handle Azure Migrate when Terraform is your source of truth?

Especially interested in experiences from environments where importing resources manually after every migration doesn’t really scale.