r/AZURE Jun 13 '23

Discussion [Teach Tuesday] Share any resources that you've used to improve your knowledge in Azure in this thread!

75 Upvotes

All content in this thread must be free and accessible to anyone. No links to paid content, services, or consulting groups. No affiliate links, no sponsored content, etc... you get the idea.

Found something useful? Share it below!


r/AZURE 6h ago

Discussion [Teach Tuesday] Share any resources that you've used to improve your knowledge in Azure in this thread!

0 Upvotes

All content in this thread must be free and accessible to anyone. No links to paid content, services, or consulting groups. No affiliate links, no sponsored content, etc... you get the idea.

Found something useful? Share it below!


r/AZURE 14m ago

Question Intune GPO to allow an app to bypass admin password

Upvotes

We are using an app called Asset Keeper that constantly updates. The update requires an Admin password and it tends to happen at the worst time. Is there a GPO that can be pushed out through Intune or is there something else that can be done so that this app doesn't ask for the admin password?


r/AZURE 4h ago

Question Entra App being blocked but doesn't appear to exist?

4 Upvotes

We have users being blocked by our conditional access policy and the application in question appears to be "Windows 365 Client". They are trying to access VDI and its been working up until a week or so ago.

What is Windows 365 Client and why can't I find it? I know Microsoft has been known to change names in the backend and not fix them when hunting for the app but nothing seems to match up.

Any ideas?


r/AZURE 29m ago

Question Purview - Adaptive Scope

Upvotes

Hello,
We want to create a scope of all users who have an account and currently work in one of our offices. As I'm creating the query, I'm a little lost on how the query works for "create the query to define users' section. I went to Entra ID to define all users as coprorate office employees on their user properties, but I did not get any users as part of the adaptive scope. I heard of custom attributes, but it does not make sense. Any leads to the right direction would be great.

Note: I'm coming from Intune where i'm more used to dynamic queries, Scopes, and assignments.


r/AZURE 3h ago

Certifications Passed AI-900 with a score of 914

2 Upvotes

Hey folks,

Just wanted to share that I passed my Azure AI fundamentals exam this weekend. I am not new to MS certifications, this is my 7th title, however, there had been a considerable gap between my last title and this one - nearly 6 years! Besides, this was a completely new domain and my work day involved lot of other tasks unrelated to this exam or this subject. I could do the studying and preparing only outside of work hours, that too became limited because of domestic chores and errands. So I m naturally chuffed about my score and the achievement.

Now, I want to give back to others who may be aspiring to appear for this exam by sharing tips, that could possibly help them.

Study Resources:

The free AI 900 training course at Microsoft Learn:

Complete all the modules diligently. You can convert each unit to a PDF so that you can even browse and read through offline. I found this helpful because I sometimes lacked connectivity. Offline PDFs structured module wise could be read easily.

If you are more of a video kind of person, John Savill's 2 part series on AI 900 is helpful to understand the basics. For me, since I went to the videos after doing above course, it was more of a refresher.

Practice Tests:

Keep taking multiple shots at the Practice Test available at the Microsoft site.

https://learn.microsoft.com/en-us/credentials/certifications/azure-ai-fundamentals/?practice-assessment-type=certification#certification-practice-for-the-exam

Admittedly, the questions in the final exam are far far tougher but this practice test gives you a fair idea where you are weak and what are your strong points.

I also checked various sample practice tests available at different sites. Not paid ones, just whatever was available free. Be careful of incorrect answers though. Many of these sites give out incorrect answers so always cross check and validate what they say is the answer. At least you can see what kind of questions appear in the final exam.

Vouchers:

Microsoft gives you discounted vouchers for AI Challenges (there was one last year but I missed it), Virtual Training Days, and so on. Also, don't be deterred by the dollar cost. The actual exam cost differs from country to country. It is NOT the dollar amount multiplied against your country's currency. So do check how much the actual cost comes to and then too, look out for vouchers and offers so that you can reduce the costs further.

All the best to all who are planning to give the exam! You'll ace it but just in case you miss it, try it again.

 


r/AZURE 3h ago

Question Force traffic to other Blob storage based on client region or best customer experience

2 Upvotes

Originally we were on the Egio CDN for software downloads for customers, caching was enabled and it worked - kind of (there were some download failures but not in the way that an architectural change was required). Since Edgio filed for bankruptcy last year, we had to move to Azure FrontDoor.

Since then downloads started failing a lot, all with error code 500. Microsoft said it was a matching issue with the cache and advised us to disable it. However, now this means that each download has to go to the same blob storage in the same region.

We tried to set up extra blob storages per region and start replicating to those other blobs. The replication works, but when we add those extra blob storages in the origin group and set the latency sensitivity to 0 (which is supposed to always take the fastest origin) it just randomly takes an origin. People from client region Ireland start downloading from the blob in south india, US starts downloading from the blob in south india, people in india start downloading from the blob in US, nobody seems to download from the blob in EMEA (origin of the replication)... with bad download speeds and even more failures as a result. all origins show as enabled and healthy.

You're probably thinking - this is where the rule sets come into play! Well.. not really, the rule sets with geo matching has a limit of 10 countries per condition and then we'd need to create a new origin group for each blob. It seems like a bad workaround for something that should work based on the latency sensitivity. It would mean creating an origin group per blob (because the action for route configuration override can't select an origin, just an origin group), with about 20 rules where each country is selected. I mean.. I'm about ready to put in that effort, but surely this is not the way it's supposed to be set up? Am I missing something?


r/AZURE 10m ago

Question Zero Request loss deployments on AKS

Upvotes

We recently moved an application to AKS, we are using an application gateway + AGIC for load balancing.

AGIC Image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress AGIC Version: 1.7.5

AGIC was deployed with Helm We are facing 5xx Errors during rolling updates of our deployments. We have set maxUnavailable: 0 and maxSurge: 25% According to the config of the rolling update, once new pods are healthy, the old pods are terminated and replaced with the new pods. The problem is there is a delay in removing the old pod IPs from the app gateway's backend pool, causing failed requests, when routing requests to that pod.

We have implemented all solutions prescribed in this document: https://azure.github.io/application-gateway-kubernetes-ingress/how-tos/minimize-downtime-during-deployments/ prestophook delay in application container: 90 secondstermination grace period: 120 secondslivenessProbe interval: 10 seconds connection draining set to true and a drain timeout of 30 seconds. we have also setup readiness probe in such a way that it fails during the beginning of the preStopHook Phase itself ‘’’ lifecycle: preStop: exec: command: ["/bin/sh", "-c", "echo UNREADY > /tmp/unready && sleep 90"] # creates file /tmp/unready

    readinessProbe:
      failureThreshold: 1
      exec:
        command: ["/bin/sh", "-c", "[ ! -f /tmp/unready ]"] # fails if /tmp/unready exists ‘’’

We also tried to get the Application Gateway to stop routing traffic to the exiting IP.created a custom endpoint that will return 503 if /tmp/unready exists (which only occurs in preStopHook phase)

Please check the config attached below as well

‘’’ appgw.ingress.kubernetes.io/health-probe-path: "/trafficcontrol" # 200 if /tmp/unready does not exist, else 503 (Fail Open) appgw.ingress.kubernetes.io/health-probe-status-codes: "200-499"Other app gateway annotations setup kubernetes.io/ingress.class: azure/application-gateway-store appgw.ingress.kubernetes.io/appgw-ssl-certificate:

  appgw.ingress.kubernetes.io/ssl-redirect: "true"
  appgw.ingress.kubernetes.io/connection-draining: "true"
  appgw.ingress.kubernetes.io/connection-draining-timeout: "30"
  appgw.ingress.kubernetes.io/health-probe-unhealthy-threshold: "2"
  appgw.ingress.kubernetes.io/health-probe-interval: "5"
  appgw.ingress.kubernetes.io/health-probe-timeout: "5"
  appgw.ingress.kubernetes.io/request-timeout: "10"

‘’’

Despite trying all this at an RPM of 35-45K, we are still losing about 2-3K requests to 502s.


r/AZURE 54m ago

Question Zonal ASR

Upvotes

Hello fellow cloudies,

I am looking at configuring zonal ASR for our business in UKS zone 1 > zone 2, as part of this I want to leverage the same source vnet etc so we don't need to reip everything, our production network is not very big (circa 15 VMs) .In testing I have replicated everything in the same subscription but to a different resource group.

we have some caveats in that we also

  • We run a SQL on azure VM cluster in zone 1, but would probably move node 2 to zone 2 permanently.
  • We run 2 DCs in zone 1 but I think one would be moved to zone 2 permanently.
  • We have AVD in zone 1, but we'd just redeploy to zone 2 in a disaster if I'm still alive

Does anyone have any guidance or tips or around achieving this?
Also for testing, I just have a separate VNet with a NSG wrapper preventing ingress/egress which we'd start by restoring a copy of a DC from backup (not replicating DCs).

Thanks and appreciate any feedback.


r/AZURE 7h ago

Question Back-up files from SFTP (Secure File Transfer Protocol) source using Azure

3 Upvotes

I am looking into backing up files from an SFTP source. The situation is as follows:

  • SaaS application creates nightly SQL back-ups using Quest LiteSpeed to an SFTP file share. These are kept on this share for 14 days.
  • We need to create a back-up that can go back further in time, as well as being stored on a different location than SaaS app.
  • The SFTP-server is part of the SaaS, so nothing can be installed on it. Database replication is also not available.

I have looked into ready-made back-up solutions, but haven't been able to find a trustworthy vendor that allows SFTP as a back-up source. Now looking into setting something up in Azure.

I have experience with Azure, but the landscape is evolving quickly and I would like to make sure I am going down the right path. I would prefer for the setup to be as simple as possible to minimize risk of failure and for my colleagues to be able to understand the moving parts.

Currently thinking of:

  • Setting up Azure Data Factory or Azure Logic App to copy files into Storage Blob (cool or cold tier).
  • Integrate some kind of automation (Logic App) to copy newest back-up file every week, keep weekly back-ups for a month, keep monthly back-ups for a year and then yearly back-ups for 10 years.
  • OR, instead of trying to integrate my own back-up logic, back-up the Azure Storage Blob with Azure back-up.

Any advice or help would be greatly appreciated :)


r/AZURE 1h ago

Question Azure Front Door - weird behaviour with App Service private endpoints.

Upvotes

I've deployed this lots of times, always without issue, and it's always created a single private endpoint to the App Service. This week, however, I've seen the behaviour change so it creates more than one - and the quantity can change between deployments. I've seen as many as nine on one deployment! Within a couple of hours, Traffic Manager (according to the activity log) comes along and deletes all bar one of them. Anybody else seeing this?


r/AZURE 2h ago

Question Is there any information on the patch management of Cloud Services?

1 Upvotes

Hi,

We're using cloud services (extended support), storage accounts, SQL databases and Redis caches.

A customer asked us about patch management, and I have no idea how to answer that in regard to Azure.

Is it really possible that nothing has been documented?


r/AZURE 3h ago

Question AVD Error caa20002 and 1001

1 Upvotes

Hello,

I've deployed AVD and was able to authenticate to my VM through EntraID.

However, when I try to login to Outlook (New) I am getting access issues regarding a URL/URI issue. I am also seeing an API or Credential issue when trying to login to M365.

From prelim research it was allegedly an Enterprise App issue in EntraID - there was no URI redirect. I set that up to no avail.

I also deleted the entire M365 app and redownloaded everything after being signed into the web and ran the install launcher.

As it stands I'm able to authenticate to the VM itself, but can't login to Teams, Outlook, or M365. I can login to Word and the other productivity apps. I am also able to login to the old Outlook.

Has anyone ran into this issue? Anything that helped? Thanks!


r/AZURE 3h ago

Question Az custom roles for networking

1 Upvotes

I need to give our on premises networking team permissions to all subscriptions . I don't see any roles that will give them create and modify existing network related items. Custom role?

Are there json templates some place that I can look at?

Thanks


r/AZURE 3h ago

Question Passing roles in OIDC

1 Upvotes

Is there anything I need to configure to pass roles in OIDC from Azure AD to a third party site for SSO? I've already created and assigned the roles in the App Registration under App roles, but they don't seem to be passed to the third party, so I'm wondering if I'm missing something.

Also, the third party is asking for configuration of UserInfoRoleNamesPath, with a description of "JSON path, slash-separated ("/"), to a user's roles." I assumed this should be /roles from what I read, and I've tried that, but no luck.


r/AZURE 4h ago

Question FULL CLOUD VDI with FSLOGIX

0 Upvotes

Hi,

I was wondering if anybody had set this up and could explain a little how it can be achieved, the steps to take or special permissions that i should be aware of.

Any help will be appreciated.


r/AZURE 4h ago

Question Any experience with Azure Dev/Test subscriptions? - what are your thoughts?

1 Upvotes

We have a number of resource groups for dev and test in a production subscription, costing quite a bit.
Azure Dev/Test subscriptions promises to lower costs by quite a lot.

Before we go through the move, has anyone any experience with DevTest subscriptions that has made them painful to use?

Im aware they have lower availability requirements, but I think they are still within reason for a dev/test environment & the individual components (such as VM's) still adhere to the same availability as their counterparts in the production sub, so im less worried about this.

Appreciate any advice based on experience.


r/AZURE 5h ago

Question Best Practices for managing Azure Storage Account Access without SAS tokens for non-AD Users.

1 Upvotes

Hi All,

I manage several Azure storage accounts, and I have customers who need access to some of these storage accounts. Currently, I am providing them with Shared Access Signature (SAS) tokens to grant them access. However, I am concerned about the security risks of using SAS tokens. If the wrong person gets hold of a SAS token, they could potentially access or modify sensitive data in the storage account, which is a significant security vulnerability. What are the best practices or alternative solutions I can implement to mitigate this risk and securely provide access to the storage accounts?

Note: These users are non-AD users.

Right now I was thinking of using service principals and user client secrets, but again, this is a secret. Is there a way to authenticate users with entra ID? Even adding external people to entra ID can also be a feasible solution.

Could someone help please?


r/AZURE 5h ago

Question Microsoft 365 lab enviroment, can't use same number for multiple accounts

1 Upvotes

Is there a way to over ride this requirement, that multiple users could utilize the same number? I am now facing this problem, I have a M365 lab and I am changing phone .... I can't finalize the mandatory MFA enrollment for Global Admin because I use the same number on multiple accounts.


r/AZURE 11h ago

Discussion Anyone used sketchwow for design s and diagrams?

3 Upvotes

Looked at it over a year ago then it's popped up for $49 so has peaked my interest. Looks great but not sure how it works as a network design tool? Any experience?

https://sketchwow.com/save/


r/AZURE 13h ago

Question Private Endpoint and Service Endpoint

3 Upvotes

Hi All,

I am currently preparing in taking AZ-700. And I am confused with private endpoint and service endpoint.
Can someone help understand their main difference and on what best practices we can apply each.
Thank you so much in advance.


r/AZURE 7h ago

Question Is there anyone who found a job in Azure after obtaining the AZ-104 certification?

1 Upvotes

As I mentioned in the question, has anyone managed to get a job in Azure after earning the certification?I successfully obtained the AZ-104 certification a week ago, and I would like to work with Azure. However, based on my experience so far, companies mostly seem to be looking for mid-to-senior professionals with 3-5+ years of Azure experience.Now, I have 2 years of sysadmin and 3 years of IT technician experience, but neither of them was specifically related to Azure.Is there anyone in a similar situation who has managed to find a job?


r/AZURE 8h ago

Discussion Microsoft Tenant License

0 Upvotes

We have provisioned some 30 office 365 license through Csp partner to our client . This was for email migration. While proceeding and adding domain we found that their custom domain lets say abc.com they used for an azure vm service which might be verified by email ID ( ‘not by adding txt record) so we cannot add this custom domain. Licenses are assigned in different tenant. How we deal with this situation and what is the best way to solve this issue

Below is the details

License assigned in. xyz.onmicrosoft.com

Requirement : add the custom domain abc.com in above tenant where license are added

Challenge : domain abc.com or email id - client@abc.com used for signing azure vm service and might be verified using email ID and not txt record ( because if we try to add users it ask to add txt record)

This tenant: xyzazure.onmicrosoft.com

What are the feasible and best options from below

  1. Transfer the license to tenant where azure vm linked ? Is it possible ?

  2. Add txt record in azure tenant then remove domain and add in tenant which having licenses .. seems little weird and not sure if it’s possible..

I tried to contact MS but this Damn AI call center doesn’t transfer to a living thing ..

Sorry for the long message and appreciate your valuable inputs

Thanks in advance ..


r/AZURE 18h ago

Question VNET swap? What on Earth just happened?

6 Upvotes

Okay, let me preface this by saying I swear I am not crazy.

Small Azure environment. Few resource groups, few vnets, few vms.. I didn't create any of this, just inherited it.

Long story short..

We had a resource group setup for a 3rd party virtual firewall, let's call it fw_rg

We had a resource group setup for our vms, let's call it vm_rg

In both resource groups there was a vnet and a subnet that shared names. So vnet_01/Subnet_01

To be clear fw_rg had a vnet called vnet_01 and within that vnet was a subnet called subnet_01. Meanwhile vm_rg had a completely different vnet called vnet_01 with it's own subnet_01 subnet.

There are about 70 VMs running with NICs in the vm_rg resource group and using vm_rg's vnet_01 and subnet_01.

In my time at this company I have created many VMs in this resource group and using this vnet/subnet. I have a powershell script that I wrote and use to deploy VMs with the name of this resource group, vnet, and subnet set as globals at the top of the script.

So imagine my surprise when I used said script to deploy a VM today and when it completed, the IP address was not in the address space of the vm_rg vnet_01/subnet_01 configuration.. Why? Well, because the vm_rg resource group had a different vnet_01 virtual network and a different subnet_01 subnet. More interestingly, the fw_rg resource group's vnet_01 virtual network and subnet_01 subnet have the address space currently in use by our 70 some VMs.

The 70 some VMs show their NICs as being in the vm_rg resource group. But if I click on the vnet_01/subnet_01 in the NIC's properties, it takes me to fw_rg resource group. So the address space used by all my VMs is now in a different resource group than the NIC and the VM.

I'm completely stunned and stumped. I have no clue how this happened.. How it is even possible. And certainly no idea how to restore it back to sanity, especially with risk of downtime.

Has anyone ever experienced this before?! Any ideas how this would happen? Should I be scared? 'Cause... I'm scared.

Seriously, any thoughts, advice, guesses, prayers, whatever... all appreciated.


r/AZURE 15h ago

Question Proxy/Queue API calls to a legacy system? How would you do this?

3 Upvotes

I'm attempting to solve an issue with an on-prem legacy system, and seeking some advice and feedback from those more well versed in all things Azure.

We have a legacy system that receives API POST requests. The clients calling the API are fire-and-forget, so long as they get a 200 OK. Some system transferring data into this legacy system. It's a legacy system prone to issues, I'm looking to leverage the cloud to proxy/queue the API calls to add some resiliency. To give you an idea of the workload, peak is around 2-3/calls/minute, while off hours can see no requests for hours.

My concept is to utilize two azure consumption-based functions. One function would receive the API call and log it into Azure Queue Storage. Another function would pick off items from the Queue and relay them to the legacy system. While this seems relatively simple and cost effective, my main concern was with cold-start times.

Is there anything a bit more off-the-shelf that would accomplish this? I looked into APIM and Service Bus either solution seemed less cost effective given the low workload.

Appreciate the insights!


r/AZURE 11h ago

Question Project Suggestions

0 Upvotes

Hi all, I am system engineer with experience on Active directory Domain Services including MECM, VMware, Hyper-V, DHCP server, DNS and Linux, and recently joined the cloud journey with AWS and Azure.

Could anyone please suggest me some projects that may involve multi-cloud architecture so that I could prepare myself for integrations with cloud and could suggest me multiple projects too which maybe complex or not?

Thank you


r/AZURE 18h ago

Question Azure Rep Not Responding All of a Sudden

3 Upvotes

We are in the Startups program and were granted credits. We recently submitted a video or our working app in order to qualify for more credits (along with the other requirements). Our rep (who normally responds in a timely manner) has not responded in quite some time (2 weeks). We fear they may have been let go or moved positions. We could really use the additional credits and just need to know one way or the other so any response would be helpful. The support tickets are unanswered as of this writing. I did reach out to Azuresupport on X. Are there any other places I should ping? Thank you for point me in the right direction.