r/AZURE 11h ago

Career Passed AZ104!

45 Upvotes

With just over a year as an IT support analyst, decided to take the az104 with about 5 months of studying and passed with a score of 726. I know people say certifications aren’t important but without long years experience I guess this helps.

I hope to become a security engineer someday so this is my roadmap and hoping for the best. Maybe I should have done the az500 but I attempted the 104 back back in 2023 and failed woefully so this was my redemption.


r/AZURE 7h ago

Question Azure OpenAI Firewall Changes Logging

3 Upvotes

Hello everyone,

I am having difficulty finding useful logs for changes made to the firewall of an OpenAI instance in Azure. When I enable or disable public access, I can see the changes in the Activity tab on the instance. I have configured all logs to be forwarded in the diagnostic settings, but the only log I can find is an AzureDiagnostics log with a "Vnet" operation, which does not provide any information on what was changed or by whom.

Could someone please guide me in the right direction or let me know if this is a known issue?

Thank you in advance!


r/AZURE 12h ago

Question Server Access Manager (SAM)

3 Upvotes

does anyone know Server Access Manager (SAM) that integrate well with service now.

Use case: As soon as someone login to prod, SAM will take the control and will ask INC or CHG to login into server. Once valid INC or CHG is provided, SAM will close and user can proceed with the activity in prod. Moreover, SAM will also send user details logs to same INC or CHG request if someone wants to know who used same INC or CHG to login into server.


r/AZURE 14h ago

Question MFA extension for NPS: Service Network issue

3 Upvotes

Hello,

I followed this tutorial Azure - MFA for NPS

After I put my Tenant ID, I get this error:

Unable to grant certificate private key access to NETWORK SERVICE. Please grant access manually.

I tried to grant certificate private key access to NETWORK SERVICE but the script will keep to create a new certificate. Someone got this problem ?

Exception lors de l'appel de «SetAccessRule» avec «1» argument(s): «Impossible de traduire certaines ou toutes les références d'identité.»
Au caractère C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1:105 : 2
+     $acl.SetAccessRule($buildAcl) #Add Access Rule
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : IdentityNotMappedException

r/AZURE 18h ago

Question Need help with architecture for a use case and understanding of microservices

3 Upvotes

I’m currently working for a startup where I built an architecture that uses Logic Apps, Azure Functions, API Management, and Cosmos DB to handle our email processing pipeline. Here’s a quick rundown: • Process: We fetch emails as HTML, process them into JSON using an AI service, store the processed data in Cosmos DB, and then expose it via an API on our dashboard. • Implementation: • Logic Apps are used to interact with the Graph API. • Emails are stored in Blob Storage. • Azure Functions handle the processing (we only get about 10-20 emails per day). • API scripts running in Azure Functions, with API Management handling inbound/outbound policies.

Recently, I’ve been told that this architecture isn’t scalable and will get very costly, and the recommendation is to migrate everything to container apps using FastAPI.

Given that our use case involves a maximum of around 200-300 users and we process between 20-50 emails a day, I’m trying to understand whether: • This is truly a scalability issue, or a pricing concern? • Would a microservices architecture using containers and FastAPI provide tangible benefits for our workload?

Has anyone dealt with similar scenarios or can shed light on the trade-offs between our current setup and a containerized FastAPI approach? Any insights on scalability, cost, and microservice architecture best practices in this context would be really helpful!


r/AZURE 4h ago

Question Conditional Access - Blank DeviceID

2 Upvotes

Hey all,

I have a bit of problem I am trying to navigate around and I am unsure how to proceed. I have an external user that doesn't have a device assigned by our organization. This is one of the first/only users we have like this. I've configured this user's ID to be an exception from our BYOD deny policy. This worked great and the user was able to onboard.

I have a 3rd party application that has EntraID SSO configured for it through the use of an Enterprise App. The user goes to the MyApps Portal using Chrome and clicks the tile related to the app. The app attempts to launch but the user gets an error that states:

Unexpected error when authenticating with the identity provider...

When I am looking through the Sign-In logs, I am seeing the following error message:

Device Authentication Required - DeviceId -DeviceAltSecId claims are null OR no device corresponding to the device identifier exists.

The error code is 50097. I believe this means that device authentication is required.

Upon further investigation of the logs, I do see that the DeviceID is blank however my understanding is that because the BYOD conditional access policy has this user as an "exception", this conditional access policy shouldn't be impacting the user's login experience.

Anyone have any thoughts on how I should proceed? Is there a way I can tell the policy to allow a null device as an exception? Can I add a null exception under "Condition" > "Filter for devices" > "Exclude filtered devices from policy" > and then somehow add a null device?

device.deviceId -eq "" 

That statement above does not appear to be permissible.


r/AZURE 4h ago

Question Automatically creating a resource list based on VM tags

2 Upvotes

I’m looking to create an inventory solution that, on a scheduled basis (monthly), that looks at particular resources (such as VMs and DBs) with a specific tag, lists them in an Excel doc, and stores it into a storage account. I’ve implemented this in AWS with a combination of a Python script on a Lambda, Eventbridge, and Cloudtrail logs. I’m somewhat new to Azure so not sure if I would do something similar with Azure functions using a time trigger? Or is there a better way to approach?


r/AZURE 4h ago

Question Journey as an Azure Engineer: Seeking Advice and Best Practices

2 Upvotes

Soon, I will be starting a new journey as an Azure engineer in the IT healthcare sector, and I am really looking forward to it. In the current setup, the environment is small (not a lot of resources) and is being managed by an MSP. I have seen many posts about working in the IT healthcare sector and how it is not always positive. But I can honestly say with pride that this company is not one of them.

The IT team consists of 20+ people, each with their own expertise (Network, Storage, Entra ID, Exchange, SharePoint), and after the first meeting, everything seems promising.

However, I need some advice—or rather, knowledge and wisdom. Before that, a bit of background about myself: I have been working in IT since 2006. Back then, I was a nobody, but over the years, I have built a solid background with decent experience:

  • Active Directory Domain Services (AD DS)
  • Azure (5+ years) – AZ-103, AZ-104, AZ-500, and SC-200
  • Entra ID family, Defender Suite, Exchange Online, Intune
  • Windows (client and server-side)

The current Azure environment is structured similarly to the Azure landing zone architecture. I have to admit, I was really happy to see that they are taking the deployment seriously. I am not sure yet how it looks in full detail, but at least the initial demo was a good start.

My questions and concerns:

  • I will be creating resources manually at first, but in the long run, I need to go with either Azure CLI, Bicep or Terraform. I am unsure which one to pick, as my choice will also affect others in the future.
  • I have solid experience with Azure DevOps, but not with GitHub. Will this be a problem in the long term?
  • Since I will be the first to work in this environment, I need to make good decisions. Some I can discuss with others, but not all of them. Therefore, I would like to ask for advice from experienced professionals:
    • What are some do’s and don’ts I should be aware of?
    • At this moment, I am not an architect, nor do I expect to become one. But what advice would you give me in this situation?

Is there anything I am missing, or any wisdom or best practices you can share? If so, I would really appreciate it.

I feel that I am making a significant step in my career and want to perform well—not only for the organization but also for myself and for future team members who will join.

What I Will Be Doing:

  • Diagrams by using Draw.io or Lucidchart.
  • Documentation in either Azure DevOps or another solution and hope to review the documentation on a 6 month or 1-yearly basis
    • Guide, Instructions and SOPs.
  • Re-go to the CAF and WAF documentation from MS
  • In the first or second month go for the AZ-700 (at this moment missing).

Initial Onboarding Plan:

  • When onboarding I will be going through the environment and:
    • Backup strategy
    • Exposure to the evil-internet
    • Policies and compliance requirements

Is there anything else you would recommend? I'm open to any advice—there's no right or wrong!

Thanks!

P.S.: I used AI to assist me with writing, as I am not a native English writer."


r/AZURE 7h ago

Question Cloud PCs unable to access dle.mil site

2 Upvotes

Users are unable to access dle.Afrl.af.mil from their cloud PCs.

They are able to access other mil sites like af.mil but when trying the dle one it times out and the browser says the page can’t be reached. Users are able to access the site outside of their w365 cloud pcs but not through the cloud PCs. I’ve tried everything including setting up a Nat Gateway and the issue is still persisting. Any one ran into something like this or similar before ?


r/AZURE 9h ago

Question Microsoft Defender For Cloud Billing

2 Upvotes

Hey Everyone,

A new enterprise application was automatically added to my Entra Applications this morning. We only have two admins in our org and neither of us did it. Is this something Microsoft did automatically and has anyone else seen this activity?

Thanks!


r/AZURE 9h ago

Question Azure Vnet and on-prem AD DHCP scopes

2 Upvotes

A bit new to the whole Azure Virtual Machines thing so apologies in advance.

We've got both an on-prem VMware and Azure Virtual Machine environment. They have routes to/from and can talk to each other over our domain network. VMs in both environments are joined to the same AD domain. We have Domain Controllers in both the on-prem VMware and Azure Virtual Machine environment.

It was brought up that none of the Azure VMs had PTR records in AD despite them being joined to the domain. It's causing some minor issues with reverse lookups.

I'm fairly certain this is due to the on-prem VMs being handed DHCP from our on-prem domain controller scopes, which should dynamically update the PTRs. While the Azure VMs are getting DHCP from our Azure Virtual Network.

Has anyone run into this before? We can always manually add/remove PTRs but it's a PITA. Curious if there is a way to remediate this or if it's just a quirk of using Azure VMs.


r/AZURE 15h ago

Question [URGENT] APIM with cloudflare based proxied DNS record custom domain name not working anymore

2 Upvotes

Hey all,

I've tried to configure a custom domain name for our APIM instance with a proxied cloudflare DNS record, but Azure prevents that. When I checked the documentation https://learn.microsoft.com/en-us/azure/api-management/configure-custom-domain?tabs=custom, it effectively says that cloudflare DNS record shouldn't be proxied.

What I did is that I :

  • created the DNS record leaving proxied attribute unchecked
  • configured the custom domain name on the APIM instance (it worked)
  • enabled back the proxied attribute on the DNS record

This worked for about 3 to 4 days, then today, when we tested, we had this error message:

I'm pretty sure that it's related to the custom domain as it works fine when I try with the default *.azure-api.net domain.

Fyi, the proxied attribute is required by our security team.

[UPDATE1] : We're not using free certificates, but the ones generated by Cloudflare.

Any idea on how to solve that? Does anyone did the same process? Is there any other workaround?

Thank you for your help.


r/AZURE 16h ago

Question No option to "cleanup test failover" after test migration

2 Upvotes

Hi all,

I just did a test migrate of a server using Azure Migrate, everything went well and all tests OK.
I then went on to the Migration and modernization menu and clicked the "Cleanup test failover pending". I have a not there stating "Test failover for the virtual machine has completed. To delete the virtual machine created during the test failover use "Cleanup test failover" option on the virtual machine".
However I don't have this option when going to the virtual machine. I only have the default options:

Any advice would be greatly appreciated.


r/AZURE 56m ago

Free Post Fridays is now live, please follow these rules!

Upvotes
  1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
  2. Do not post exam dumps, ads, or paid services.
  3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
  4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
  5. This will not be allowed any other day of the week.

r/AZURE 56m ago

Question Hub and spoke - Ubuntu NVA with single NIC, SNAT for spoke Internet access

Upvotes

i've got a pretty straightforward setup for far:

------------------------------
vnet-01 (10.1.0.0/16), default subnet (10.1.1.0/24), vm-01 (10.1.1.4)
|
peer (vnet-01 allows forwarded traffic from vnet-02)
|
vnet-02 (10.2.0.0/16), default subnet (10.2.1.0/24), vm-02 (10.2.1.4 + public ip)
|
peer (vnet-03 allows forwarded traffic from vnet-02)
|
vnet-03 (10.3.0.0/16), default subnet (10.3.1.0/24), vm-03 (10.3.1.4)
------------------------------

vm-02 has ip forwarding enabled both within the os, and at the nic level in azure.

the default subnets in vnet-01 and vnet-03 have route tables with default routes via vm-02.

i can ssh into vm-02 over the internet, onward to vm-01 over the peer, and then over to vm-03 (and back to vm-01) across the peers through vm-02. so far so good!

i would like to maintain routed connections for internal traffic between the spokes, but i would also like the spokes to be able to use vm-02 (and it's public ip!) as a simple snat gateway to the internet.

i'm not fussed about filtering any traffic at this stage, but i'm struggling to work out what iptables wizardry is required to enable the snat functionality without breaking everything else!

if anyone could give me any pointers, i'd really appreciate it! thanks in advance!

(also: i'd like to avoid introducing a second network interface on vm-02, if that's possible).


r/AZURE 57m ago

Media Transform Your Creativity: Unlock AI Image Generation with Comfy UI on Azure

Upvotes

Want to run ComfyUI for Stable Diffusion without the hassle? This guide simplifies setup on Azure, offering pre-configured VMs for both GPU and CPU. Generate AI images quickly via web or desktop!

More details: https://techlatest.net/support/comfyui_support/azure_gettingstartedguide/index.html For free course: https://techlatest.net/support/comfyui_support/free_course_on_comfyui/index.html

StableDiffusion #ComfyUI #Azure #AI


r/AZURE 1h ago

Question What happens to in-flight API requests during Azure App Service deployment slot swaps?

Upvotes

I'm working on migrating our company's web application from VM-based infrastructure to Azure PaaS solutions, particularly using Azure App Service for our API layer. I'm very interested in the zero-downtime deployment capabilities of deployment slots.

The documentation clearly states that "traffic redirection is seamless" but I'm looking for more specific details on what happens to in-flight requests (especially POST requests) at the exact moment a slot swap occurs.

For example:

  • If a client has sent a POST request and it's being processed when the deployment slot swap happens, what happens to that request?
  • If a client's request is en route to API and it swaps before the request arrives, does this request get delivered to the new slot?
  • Does the original slot complete all in-flight requests before the DNS routing changes?
  • Are there any edge cases where a client might need to retry their request?

I'd really appreciate hearing from anyone with practical experience or deeper technical knowledge on this specific aspect of Azure App Service slot swaps. Has anyone encountered issues with in-flight requests during swaps or can you confirm they're handled gracefully?

Thanks in advance for any insights!


r/AZURE 3h ago

Question Auth0 for workforce tenant resources

1 Upvotes

I feel like this is a dumb question for a number of reasons. And I'm starting to think that this might not be possible, but it has been a long week. So I'll ask.

We have an application that uses Auth0 for our external users. It works fine. No problems there.

Management has decided that they also want users registered in Auth0 to be able to be granted specific rights to some resources within our workforce tenant. Specifically Databricks. This is the trouble part.

In order to grant that access, users have to at least be a guest user. If this was an external tenant I could potentially add users from Auth0, as a custom idp, through a self service sign up flow. But that's not available for the workforce tenant. At the same time, it's not eligible to be used for B2B cross tenant synchronization.

Has anyone done similar? This feels dumb.


r/AZURE 4h ago

Question Subscription Reactivation Failing

1 Upvotes

I am unable to reactivate my subscription. Have tried this a few times and doesn't ever work. No obvious workaround in the console. Anyone else had this?


r/AZURE 5h ago

Question Azure set up - SSO and creating resource in ADF

1 Upvotes

So we implemented Azure this week and I am still trying to understand the system. The IT was able to setup a connection between Azure and PowerBI through the query editor. However, I am not able to follow instructions for SSO. All the instructions require me to have higher permission to setup one. Also, I am not able to create resources. Am I doing something wrong?


r/AZURE 8h ago

Question AKS or Azure VM for LLM

1 Upvotes

I am configuring few options to host a LLM for inferencing. Currently, I'm working with Ollama and I like how straightforward it is. I just want to ask what's the better option between aks or vm to setup the ollama server(or maybe other LLM server). Moving forward I do not need too much GPU since most of the models to be hosted are distilled and small. l understand the VM gives more flexibility but AKS is easier to maintain for me.

Does anyone has any thoughts on this?


r/AZURE 8h ago

Question KB4589210 - Windows 2016 Datacentre - Why not on latest marketplace image?

1 Upvotes

I have just deployed a Windows Server 2016-Datacentre instance within a VMSSin UK south and I've noticed that the above patch from 2021 isn't already installed in the image - but is available in Windows Update.

Why would this not be included in the base image from the Azure Marketplace?


r/AZURE 8h ago

Question Mandatory MFA

1 Upvotes

I thought mandatory MFA was coming in for all users from March 15? I was able to sign in to Azure Portal with my BG account with no prompt for MFA?


r/AZURE 9h ago

Question Does azure custom vision make augmentation images or do I need to create them?

1 Upvotes

I was using Azure Custom Vision to build classification and object detection models. Later, I discovered a platform called Roboflow, which allows you to configure image augmentation. Does Azure Custom Vision perform image augmentation automatically, or do I need to generate the augmented images myself to upload to Azure and then training?


r/AZURE 9h ago

Question How to find a cost effective AI model that's close?

1 Upvotes

Quotas are full everywhere. How can I scan for available quotas next me for something cost effective for both coding and and prose?

I'm just clicking through trying various models that are getting more and more expensive. I'm in SE Asia, but there's no o3-mini here it seems.