Home / Azure
VMs, AKS, networking, identity and monitoring on Microsoft Azure. 152 posts.
How Azure CNI Overlay, flat Azure CNI with a dedicated pod subnet and kubenet differ in IP use, routing and limits; how to size CIDRs for growth; and how to plan egress so clusters do not hit SNAT or IP exhaustion later.
Control where pods land on AKS so a zone or node loss does not take a service down. Topology spread constraints, dedicated node pools with taints, pod anti-affinity, priority and preemption, and how they interact with the cluster autoscaler.
Install AzCopy, sign in with Entra ID instead of keys, copy and sync folders to and from Blob Storage, and read the job logs when a transfer fails part-way.
A first-day guide to the Azure CLI. Sign in safely, make sure you are in the right subscription, set a default resource group and location, and filter output with --query so you read only what matters.
Find out what costs money in a subscription, group spend by resource group and tag, create a budget with email alerts, and export daily cost data so surprises show up in days, not at month end.
Use data collection rule transformations to drop noisy rows, remove or hash sensitive columns, and route data to cheaper tables before it is stored, with a safe test-and-rollout process.
Use Azure Virtual Network Manager network groups and security admin rules to enforce organisation-wide allow/deny rules across many VNets, understand how they combine with NSGs, and deploy them without cutting off production.
What each VM power state means, why "Stopped" can still bill for compute, how to deallocate, start and resize from the CLI and PowerShell, and what changes (IPs, temp disk) when you do.
Use what-if output as a pipeline gate, manage resource lifecycles with deployment stacks so removed resources are actually deleted or detached, and protect stack-managed resources from portal edits with deny settings.
What a managed identity is, when to pick system-assigned or user-assigned, and a worked example that lets a VM read a Key Vault secret and a storage blob with no password or key in the code.
VMs in a newly built VNet can't reach the internet, Windows Update or activation. Check whether the subnet is private, add a NAT gateway or other explicit egress, and stop relying on default outbound access.
Deleting a Recovery Services vault fails with "existing resources within the vault". Find what still depends on it, clear each dependency in order, and understand soft-deleted items and vaults.
Pods are evicted in waves with "The node was low on resource: ephemeral-storage" and nodes show DiskPressure. Free space on the affected nodes, find the workload filling the disk, and set ephemeral-storage limits and log rotation so it cannot recur.
Outbound calls from App Service to databases or APIs start timing out at peak, then recover when load drops. Confirm SNAT port exhaustion, stop the bleeding by scaling out and fixing connection reuse, then move egress to a NAT gateway or private endpoints.
Writes fail with error 40544 (database has reached its size quota) while reads still work. Confirm which limit you hit, raise max size or the tier within minutes, then reclaim space and stop it happening again.
Requests fail or slow down with 429 (TooManyRequests) and retry storms make it worse. Tell a real RU shortage from a hot partition, add headroom fast, and fix the partition key, indexing or query that caused it.
Producers get QuotaExceededException or ServerBusyException and orders stop flowing. Find whether the entity is full or the namespace is throttled, restore sending, drain the backlog safely and right-size the namespace.
Pods in AKS see random 5-second delays or "Temporary failure in name resolution". Prove it's DNS, find whether it's ndots, conntrack races, CoreDNS load or Azure DNS limits, and fix each.
Connections through a pair of third-party firewalls in Azure hang or reset at random. Prove the return path takes a different NVA, then fix UDRs, gateway routes, HA ports and SNAT so each flow stays on one appliance.
Apps fail or slow down with HTTP 429 from Key Vault during peaks or deployments. Identify who is calling, compare with the service limits, then fix with caching, backoff and vault design.
Work out whether an Azure Monitor alert never fired, fired but was suppressed, or fired and the action group failed to deliver, then fix the gap and test it.
High-volume jobs get 503 ServerBusy, 500 OperationTimedOut or slow blobs from Azure Storage. Tell account-level throttling from hot partitions, then fix naming, spreading, client retries and tier.
A VM start, resize or scale-out fails with an allocation, SKU or quota error. Tell the three apart, get the VM running again and reserve capacity for the machines that can't wait.
Log-based alerts miss incidents because records land minutes after they happened. Measure agent and pipeline latency with ingestion_time() and _TimeReceived, find the slow source, and write alert queries that don't skip late data.
Your UDRs send spoke traffic through the hub firewall, but connections to private endpoints never appear in its logs. Understand the /32 InterfaceEndpoint routes, enable route table policies, and keep return traffic symmetric.
Decode AuthorizationFailed and LinkedAuthorizationFailed errors, find which role a user, pipeline or managed identity is missing, and grant the smallest role that fixes it.
When users suddenly can't reach Azure DevOps, first decide whether it's a service incident or something in your tenant - Conditional Access, expired PATs, organisation policies or network. Then fix the right thing and keep pipelines running with the CLI extension patched.
Assigned a deployIfNotExists or modify policy and old resources are still non-compliant? Give the assignment an identity, create a remediation task and read why it fails.
A delete, scale-out, key listing or backup fails with ScopeLocked. Find the lock (it may be inherited), understand ReadOnly side effects and change locks without leaving production unprotected.
Both of Azure's late-September 2026 incident reviews end with the same advice - configure Service Health alerts. Set up one alert per event type and scope, route them to the right people, and include health advisories so model and service retirements don't arrive as surprises.
Find out why a VM extension is stuck in Transitioning or Failed, read the right logs on Windows and Linux, fix the guest agent and redeploy the extension cleanly.
A rolling gateway update overloaded a regional control plane and left some ExpressRoute gateways without connectivity across 33 regions. Customers could not prevent the fault itself, but redundant paths, failover tests and the right alerts decide how much it hurts.
The 13 October 2026 updates include critical remote code execution fixes for DHCP Server, MSMQ, Hyper-V, AD DS, RD Gateway and Exchange, plus an exploited Windows Shell bypass. Sort your Azure VMs by role, patch the exposed roles first, and use Azure Update Manager to track it.
Two critical PHP flaws disclosed on 21 October 2026 allow remote code execution from a single unauthenticated request. Find every PHP workload in your Azure estate, move it to a fixed PHP build, and use Front Door or Application Gateway WAF rules only as a short-term shield.
Workload Identity lets AKS pods use a managed identity without secrets. Enable the OIDC issuer, create a federated credential matching the service account, annotate it and label the pod. Most failures are a subject or issuer mismatch.
Bastion sessions fail because of the AzureBastionSubnet NSG, the subnet size, the SKU, a missing permission or the target VM itself. Check them in that order and test with az network bastion ssh.
Diagnose a Container Apps revision stuck in Provisioning, Degraded or Failed, or that runs but returns errors, and roll traffic back to the last good revision.
Replace DNS forwarder VMs with Azure DNS Private Resolver. An inbound endpoint lets on-premises resolve Private Link zones; an outbound endpoint with a forwarding ruleset lets Azure resolve on-premises domains.
Messages land in the Service Bus dead-letter queue after too many delivery attempts, TTL expiry or explicit dead-lettering. Read the DeadLetterReason, fix the consumer, then resubmit in small batches.
Hybrid users not appearing or not updating in Entra ID usually comes from a stopped scheduler, a connector error or per-object export errors such as AttributeValueMustBeUnique. Check the scheduler, run a delta sync and fix the object errors.
CLI, PowerShell, KQL and Resource Graph queries to find who changed, restarted or deleted an Azure resource, when, from where and what changed.
A design guide for patching Azure and Arc-enabled servers. Define rings and windows that match application HA, use maintenance configurations with dynamic scopes, add pre/post tasks for clusters and services, report compliance in a way owners act on, and plan the exception path.
Azure Policy works best as a product with a lifecycle, not a pile of portal assignments. Choose effects deliberately, roll out in audit-first rings, handle exceptions with expiring exemptions, manage definitions and assignments as code, and measure compliance in a way teams can act on.
A design guide for matching each workload to a disaster recovery pattern on Azure. Classify by business impact, translate RTO and RPO into a pattern, map each tier (compute, data, network, identity) to Azure services, and check the hidden dependencies that break recoveries.
A design guide for picking the database platform per application. Separate the engine decision from the hosting decision, check compatibility blockers, compare what you still operate on each option, and size the HA/DR and network design with the choice instead of afterwards.
A design guide for picking where a workload runs on Azure. Start from the workload's shape and the team's operating capacity, walk a short decision path, compare the options on what you have to run yourself, and avoid the common traps such as AKS for one small API or VMs for a stateless web app.
Region choice is hard to undo once data and networks are built around it. Evaluate candidate regions against data residency, latency to users and on-premises, availability zone support, the services and SKUs you need, capacity and quota, pricing differences and the DR partner region, and record the decision.
A design guide for matching data to the right Azure storage service. Decide by access protocol, sharing model, performance and features like snapshots and replication, then check identity, network and backup support. Includes common workload mappings and traps.
A design guide for how container images get from a Dockerfile to production on Azure. Decide registry layout and SKU, import and curate base images instead of pulling from the internet, scan at build and in the registry, sign images and enforce trusted sources at deploy time, and keep the registry tidy.
Many go-lives and scale-outs fail on quotas and limits, not on code. Distinguish adjustable quotas from hard limits, inventory the ones your design depends on, monitor usage against them, request increases ahead of need, use capacity reservations for critical scale, and shape subscriptions and architecture so you don't hit hard limits.
Azure Arc lets you manage on-premises and other-cloud servers with Azure Policy, Update Manager, Defender, monitoring and RBAC. Decide what you want from it first, then design resource organisation, onboarding at scale, network paths, identity and which extensions to deploy - and know what it doesn't do.
Azure's load-balancing services overlap enough to confuse every design review. Decide by global vs regional scope and HTTP vs non-HTTP traffic, add API management needs separately, and use the common layered patterns - with notes on WAF placement, private origins and failover behaviour.
A design guide for secrets, keys and certificates on Azure. Decide vault granularity, use RBAC with least privilege, choose between Key Vault Standard, Premium and Managed HSM, decide where customer-managed keys are worth the operational cost, and plan rotation, networking and recovery from the start.
Not every PaaS resource needs a private endpoint, and not every one is safe with a public endpoint. Compare the three access models on exposure, on-premises reach, DNS work and cost, choose per data classification, and set guardrails with Azure Policy so the choice sticks.
A practical way for an operations or platform team to review a live workload against the Azure Well-Architected Framework. Scope it, gather evidence before the meeting, walk the five pillars with concrete questions, rate findings by risk, and turn them into a backlog the owning team actually works through.
Azure has four messaging services that look alike on a slide but behave very differently. Decide by whether you're sending commands, discrete events or telemetry streams, then check ordering, delivery guarantees, retention and throughput. Includes patterns that combine them and the failure-handling you need on each.
AKS clusters often run at low real utilisation because pod requests are inflated and nodes never scale down. Measure requests against usage, fix requests with VPA recommendations, tune the cluster autoscaler profile, choose node sizes that pack well, and move tolerant workloads to spot node pools.
App Service estates grow one plan per app, each running a fixed instance count all day. Map apps to plans, measure CPU and memory, consolidate compatible apps, move to current SKUs, and replace fixed instance counts with rule-based or automatic scaling.
Backup storage grows quietly because every VM gets the same long retention, every disk is protected and every vault is GRS. Review what each workload needs, tune retention per policy, move long-term points to the archive tier, exclude disks that don't need backup, and pick vault redundancy per environment - without weakening recovery.
Firewall policies collect years of one-off rules, and every environment runs a Premium firewall around the clock. Use Policy Analytics and logs to find unused and overlapping rules, restructure collections with IP Groups, match the SKU to the features you use, and deallocate non-production firewalls out of hours.
Front Door is often deployed only as a global load balancer with caching off, so every request still hits the origin. Measure cache hit ratio, set cache-control headers at the origin, enable caching and compression on the right routes, normalise query strings, and purge safely.
Slow first requests, VNet needs and unpredictable bills push Function apps between plans. Measure cold starts, reduce start-up work in code, choose between Consumption, Flex Consumption, Premium and Dedicated by latency and networking needs, and tune concurrency and always-ready instances.
Single databases provisioned for their peak sit idle most of the day. Measure each database's usage pattern, put databases with non-overlapping peaks into elastic pools, use serverless for intermittent ones, and right-size the service tier and vCores using resource stats, not guesses.
Many VM performance problems come from platform settings, not the OS. Check the size family and generation, enable accelerated networking, set disk host caching correctly, use proximity placement for latency-sensitive tiers, and act on Advisor right-sizing with real metrics.
Storage accounts keep everything in the Hot tier forever by default. Find what data is old and cold, write lifecycle rules that move blobs through Cool, Cold and Archive and delete what's no longer needed, and avoid the traps of early-deletion fees, rehydration delays and transaction costs.
Log Analytics often becomes one of the biggest lines on an Azure bill. Find which tables and resources ingest the most, filter noise at the data collection rule, move verbose tables to the Basic or Auxiliary plan, set retention per table, and pick a commitment tier when volume is steady.
Networking charges are spread across many small meters, so they grow unnoticed. Break the bill down by meter, find the flows behind the biggest ones with flow logs, and fix the usual causes - hairpinned traffic through hubs, chatty cross-region replication, oversized gateways and private endpoints nobody uses.
On-call teams ignore alerts when most of them aren't actionable. Measure which rules fire most and lead to no action, fix thresholds with dynamic thresholds and longer windows, consolidate per-resource rules, suppress during maintenance with alert processing rules, and route by severity.
Many VMs run on disks sized for capacity guesses or for IOPS that are never used, while others are throttled. Measure real IOPS and throughput, then match each disk to the right type, size, performance tier or Premium SSD v2 settings, without hurting the VM's own limits.
Dev, test and training environments usually run 168 hours a week but are used for about 50. Tag environments with schedules, stop VMs, AKS clusters, Application Gateways and databases automatically out of hours, let people opt out for late work, and report the savings.
Before buying more vCores, find the handful of queries that use most of the resources. Use Query Store to rank queries by CPU, IO and duration, spot plan regressions, review index recommendations, and turn on automatic plan correction so regressions fix themselves.
Copy-paste Resource Graph queries for inventory, orphaned resources, risky NSG rules, unprotected VMs, resource health and who changed what, across every subscription at once.
Find app registration secrets and certificates that expire soon, add the new credential alongside the old one, cut every consumer over, prove the old key is unused, then remove it.
Restore applications, pipelines and Terraform runs that fail because an app registration's client secret or certificate expired. Find every expiring credential, rotate without a second outage and move to managed identities.
Restore kubectl access to an AKS cluster when the API server times out or rejects connections. Covers authorized IP ranges, private cluster DNS, expired cluster certificates and az aks command invoke as a lifeline.
Recover an AKS cluster or node pool left in a Failed provisioning state after an upgrade. Find the blocking PodDisruptionBudget, quota or subnet issue, reconcile the cluster and finish the upgrade safely.
Triage a backup outage where many VM backup jobs fail at once. Group failures by error code, fix the common causes (VM agent, extension, snapshot limits, Key Vault access, policy changes) and confirm you have a restorable point again.
Fix an outage where Azure Load Balancer stops sending traffic because all backends fail the health probe. Read the probe and data path metrics, check NSGs for the AzureLoadBalancer tag, and fix the probe endpoint.
Bring back a dropped Azure SQL database, or recover from a bad UPDATE or DELETE, using deleted-database restore, point-in-time restore and long-term retention backups, then swap the copy in safely.
Recover deleted or overwritten blobs, a deleted container or a deleted storage account using soft delete, versioning and point-in-time restore, in the right order and without making things worse.
Start a VM protected by Azure Disk Encryption (ADE) that fails because its Key Vault, secret, key or access settings changed. Recover the vault objects, re-enable disk encryption access and plan the move to encryption at host.
Work through an ExpressRoute outage layer by layer: circuit and provider state, BGP sessions, ARP and route tables, the virtual network gateway and the connection, with VPN failover as the fallback.
Recover a deleted Azure Key Vault, secret, key or certificate from soft delete, find who deleted it, and turn on purge protection so the next mistake is a five-minute fix.
Restore log ingestion when a Log Analytics workspace hits its daily cap and alerts go silent. Confirm the cap, find the table or resource that spiked, raise the cap safely and stop the noisy source.
Diagnose and fix intermittent outbound failures caused by Azure Firewall running out of SNAT ports. Read the SNAT utilisation metric, find the noisy workload, add capacity with more public IPs or a NAT gateway, and reduce connection churn.
Restore name resolution when apps that use private endpoints start failing with 403s or timeouts because a private DNS zone, VNet link or A record was removed or changed.
Roll back a bad release on Azure App Service by swapping slots back, understand why sticky settings and warm-up cause post-swap failures, and make swaps safe with preview and health checks.
A realistic recovery plan after a resource group deletion. What Azure can bring back per resource type, the order to rebuild in, how to find who did it, and the locks and policies that stop it happening again.
Respond to a leaked storage account key or SAS token. Rotate keys in the right order, revoke user delegation SAS, check what was accessed, and move apps to Entra ID authentication so keys stop mattering.
Turn Azure spend from a monthly surprise into a managed programme. Allocate costs by tag, remove waste, rightsize with Advisor, then commit with reservations and savings plans in the right order, and keep it going with budgets and reviews.
Move an Azure estate built by hand in the portal to Infrastructure as Code without recreating anything. Export and clean templates, import existing resources into Terraform state, detect drift and lock the portal down step by step.
Turn APIs and workers that run on VMs into containers on Azure Container Apps. Write the Dockerfile, push to ACR, deploy with managed identity and secrets, set scale rules, and plan the traffic switch.
When and how to move a customer-managed hub-spoke network to Azure Virtual WAN. Compare the models, design hubs and routing intent, migrate spokes and branches in phases, and avoid the routing surprises that cause outages.
Finish the move from the retired Log Analytics (MMA/OMS) agent to Azure Monitor Agent. Inventory agents, translate workspace settings into data collection rules, roll out with Azure Policy, validate data parity and remove the old agent.
Plan the move from Windows Server 2012/2012 R2 and 2016 to a supported version on Azure. Decide between in-place upgrade and rebuild, run the supported Azure in-place upgrade with an upgrade media disk, and use Extended Security Updates as a bridge.
A practical path from on-premises vSphere to Azure VMware Solution (AVS). Size the private cloud, connect it with ExpressRoute Global Reach, deploy HCX, choose vMotion or bulk migration per wave, and plan what comes after the move.
A phased plan to put Storage, SQL, Key Vault and other PaaS services behind private endpoints. Build DNS first, add endpoints alongside public access, move clients, then disable public network access with policy.
Retire AD FS by moving Microsoft 365 and Azure sign-in to password hash sync or pass-through authentication. Migrate relying-party apps, test with staged rollout, convert the domain and decommission farm servers safely.
Replatform ASP.NET and ASP.NET Core sites from IIS on Windows VMs to Azure App Service. Assess compatibility, handle config, certificates, file system and Windows auth differences, migrate with slots and cut over safely.
Plan and run a lift-and-shift of VMware, Hyper-V or physical servers into Azure with Azure Migrate. Discovery, dependency mapping, assessment, replication, test migration and cutover, with the checks that keep waves on schedule.
Remove stored secrets from apps and pipelines. Inventory secret-based service principals, move Azure workloads to managed identities, move GitHub, Azure DevOps and AKS workloads to federated credentials, then block new secrets.
Move the cron jobs and Windows scheduled tasks that quietly run your operations onto managed Azure services. Inventory the scripts, pick the right service per job, run them with managed identity and add the monitoring the old server never had.
Modernise backup from tape rotations and on-prem backup servers to Azure Backup. Choose the right protection per workload, design vaults with immutability, soft delete and multi-user authorisation, and retire tapes without losing retention.
Move Windows file shares to Azure Files while keeping fast local access with Azure File Sync and cloud tiering. Plan shares and permissions, seed data, cut over users and shrink or retire the on-premises servers.
Use the consumed-percentage metrics to tell whether the disk or the VM size is capping I/O, then fix it with a tier change, caching, bursting or a resize.
Recover when a Conditional Access policy blocks all administrators from the Azure portal and Entra admin center. Uses break-glass accounts, explains what to do if they fail, and how to prevent lockouts with report-only mode and exclusions.
Fix deployments and scale-outs that fail because an Azure subnet ran out of IP addresses. Covers finding the consumer, quick relief options, adding address space without downtime, and moving AKS to an overlay network model.
Commands and queries to find which NSG rule allowed or denied a flow (effective rules, IP flow verify, next hop and VNet flow logs) and to add the narrowest fix.
Recover a production Azure VM stuck at boot using boot diagnostics, the serial console and az vm repair. Covers Windows BCD and pending-update loops, Linux GRUB and fstab errors, and a full OS disk, with a safe rollback path.
Restore service quickly when browsers show certificate errors because an Application Gateway listener certificate expired or Key Vault renewal didn't reach the gateway. Includes the emergency fix, root causes and the controls that stop it happening again.
Respond to a sudden flood of requests that is slowing or breaking a public site. Covers telling attack from legitimate surge, rate limiting, geo and bot rules in Front Door WAF, protecting origins, scaling, and the follow-up hardening.
Create a production AKS cluster with a private API server, separate system and user node pools, Entra ID integration, workload identity, autoscaling, upgrades and monitoring.
Recover AKS workloads after a cluster failure or region outage using GitOps for configuration, AKS Backup for persistent volumes and a warm or cold standby cluster in a second region.
Find out why a node went NotReady (resource pressure, kubelet, network or a VMSS problem) and recover it safely without losing workloads.
Read the pull error, then check image names, the kubelet identity's AcrPull role, ACR networking and private DNS to get images pulling again.
Read backend health, then fix the probe, NSG, certificate and timeout issues that make Application Gateway return 502 to users.
Work out whether a 5xx comes from the front ends, a crashing or slow app, port binding, or exhausted outbound connections, using Diagnose and solve, logs and Kudu.
Fix "System error 53", error 5 and mount timeouts on Windows and Linux by checking port 445, credentials, identity-based auth and SMB encryption settings.
Work through host health, app settings, storage connectivity and trigger-specific gotchas when a function silently stops running.
Build the hub VNet, peered spokes, forced routing through Azure Firewall and central private DNS zones so private endpoints and on-premises connectivity work from day one.
Set up least-privilege RBAC with groups, Privileged Identity Management for admin roles, emergency access accounts and managed identities before workloads go live.
Find out whether the vault uses access policies or RBAC, give the app's managed identity the right data-plane role, and fix firewall and soft-delete errors.
Lay out the management group hierarchy, subscription model and baseline Azure Policy assignments that every later workload, HA and DR design depends on.
Decide on workspace layout, enforce diagnostic settings with policy, deploy Azure Monitor Agent with data collection rules and start from a small set of actionable alerts.
A naming convention, mandatory tags enforced by policy, budgets with alerts and a monthly cost review routine, so every resource has an owner and spend surprises are caught early.
Most private endpoint outages are DNS problems. Here's how to check the zone group, VNet links and on-premises forwarding, in that order.
Design region-to-region DR for Azure VMs with Site Recovery, including network mapping, recovery plans with scripts, failover, re-protect and failback, and the RPO/RTO you can realistically promise.
Fix common replication health errors, then run a non-disruptive test failover into an isolated network and clean up afterwards.
Check connection status and gateway diagnostics, then match IKE/IPsec settings, shared keys, traffic selectors and on-premises device config to bring the tunnel back.
Set up failover groups for Azure SQL Database or Managed Instance, use the listener endpoints in applications, choose the failover policy, and run planned and forced failovers.
Understand the built-in HA architectures of General Purpose, Business Critical and Hyperscale, enable zone redundancy, and make applications handle the short reconfigurations that happen during failovers.
Find out whether the database is hitting its service tier limits or running a few bad queries, using resource stats, Query Store and wait statistics.
Decode the storage error code, then check the network rules, RBAC data-plane roles, SAS token fields and clock skew that cause most 403s.
How geo-redundant storage replicates, how to read from the secondary, how to check Last Sync Time and run a customer-managed failover, and what to do afterwards.
Use Run Command and VM insights to find the process behind high CPU on Windows and Linux VMs, even when RDP or SSH is too slow to use.
Compare availability sets, zones and flexible scale sets, design a two-tier zone-redundant VM deployment with a Standard Load Balancer, and test that it really survives a zone failure.
Grow an Azure managed OS disk, then extend the partition and filesystem on Windows and Linux, with the checks to run before and after.
Identify which policy assignment blocked a deployment, understand what it requires, and either fix the template or request a scoped exemption.
Cluster and workload settings that let an AKS application survive node drains, upgrades and a full zone outage, including topology spread, PodDisruptionBudgets, probes and zone-aware storage.
Make an App Service app survive instance and zone failures with zone redundancy, then add Azure Front Door with health probes, WAF and private origins as the step towards multi-region.
Confirm traffic actually reaches the firewall, find the deny in structured logs, and write the narrowest network or application rule that fixes it.
Ready-to-run Log Analytics queries for missing heartbeats, CPU, memory and disk pressure, Windows and Linux errors, and who changed what.
Classify workloads into DR tiers, pick the matching Azure patterns, then plan, run and document a DR drill end to end, including traffic switching with Front Door and failback.
Pick the right restore type for the customer's request, run it from the portal or CLI, and avoid the IP, extension and domain-join problems that follow.
Plan sizing, deployment slots, health checks, private access, identity and monitoring for an App Service web app that runs in one region without surprises.
Redundancy choice, network isolation, identity-based access, soft delete, versioning, immutability and lifecycle rules for a storage account that holds customer data.
Build a two-node SQL Server AG across availability zones using a multi-subnet design that removes the need for an Azure load balancer, with a cloud witness and tested failover.
When a workload runs on one VM, these settings decide whether it gets the single-instance SLA, survives a disk or host failure, and can be restored. Disks, backup, patching, access and monitoring.
Build a single SQL Server VM that performs well and recovers cleanly, with the SQL IaaS Agent extension, separate data/log/tempdb storage, caching, memory settings and automated backups.
The AADSTS codes behind most sign-in tickets, what each one means, and where to look in the sign-in logs to fix it quickly.
Work out whether a VM is down, firewalled or stuck at boot, using boot diagnostics, the serial console, run-command and the repair extension.
The az aks and kubectl commands for access, node pools, upgrades, scaling and pod triage, grouped by the task you're doing.
No posts in this category yet.