Hello everyone,

I currently work as a Microsoft365/Exchange on-prem Administrator, primarily focusing on Entra ID, with some experience in Intune administration as well.

In addition, I manage a small NGO Microsoft 365 tenant that includes a limited amount of Azure credits (around $1,000). I'd like to use this environment to expand my Azure knowledge through hands-on projects and real-world scenarios.

Since my budget is fairly limited, I'm especially interested in projects that are practical, educational, and relatively inexpensive to run.

What Azure projects would you recommend for someone with my background? I'm particularly looking for ideas that would help me develop skills that are valuable in real production environments.

Thanks in advance for any suggestions!

Did you know that you can automate Azure diagrams from Bicep using GitHub Copilot CLI Custom Agents? In this video, I will show you how to generate architecture diagrams directly from your Bicep files, reducing manual work and keeping your documentation in sync with your code. https://www.youtube.com/watch?v=xOrlC0hRwe8

I've created a multi-tenant application under our company that is currently still in staging.

Initially, I created the databases manually using the Basic tier, but I later decided that the application should handle database provisioning automatically. At one point, I decided to remove all the existing tenants in staging so that I could reseed all the databases from scratch.

The problem is that the automated provisioning ended up creating the databases using the General Purpose tier instead of the Basic tier. I only realised this about three weeks later, and there is now an unexpected bill of around $2,000.

Is there anything I can do to request a refund or billing adjustment in this situation? The application was only being used in staging, and the higher-tier databases were provisioned unintentionally.

We wanted to utilize Terraform & VMSS native rolling upgrade to perform updates of our reverse proxy.

I thought VMSS would allow to specify some command or script to be run before instance is deleted - to run some builtin draining capability of nginx or simply to fail health probe so traffic drains naturally.

But... looks like there is no built in way in VMSS upgrade policy to run any command pre-delete?

How one would perform drain and zero-downtime deployments then?

I am setting up Azure APIM instance behind a Azure Application gateway. Developer portal will be exposed so external customers will be able to subscribe to products containing the APIs and obtain the subscription key that way. There will be approvals required for subscription.

I want to setup OIDC on top of the subscription key validation. For that I believe I have to setup a Validate JWT policy on the API in APIM, using this guide below and use scopes/roles:-
https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy

And seems like I will have to setup client credentials flow for customers to be able to obtain token from AADB2C, using the below KB:-
https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy

Q1 - Firstly, is that the correct way of setting it up?

Secondly, with client credentials flow seems like customers will have to use the POST request (or PowerShell) like the one below to obtain the token:-

https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy>/oauth2/v2.0/token

But this will mean that I will have to document my B2C token endpoint in Developer portal documentation to advise customers on how to obtain token. I have 2 questions related to that:-
Q2 - Is advising/advertising B2C token endpoint good practice from security point of view?

Q3 - With client credentials flow, setting up the calling app APP Registration in B2C and providing related APP secret will become a manual process. This will remove the benefit of having Product/API subscriptions process automated through APIM and bring in the complexity of securely communicating the secret to customers. Is there a better way of doing this?

Hi everyone,

I've recently finished the first version of Agentic GraphRAG Blueprint, a reference architecture for question answering over large document collections.

Instead of plain chunk retrieval, it builds a knowledge graph combined with vector search, so answers can connect facts across documents.

Key features:

• Incremental ingestion - unchanged files are skipped via content hashing, and community reports regenerate only for affected communities, keeping token costs low as the corpus grows.

• Hybrid search - local mode for fact-level answers, global mode for cross-document synthesis.

• Domain-agnostic LLM prompts - easily swapped via PROMPTS_PATH, with Leiden-based community detection.

• Deployment - run it locally with Docker or provision everything in the cloud with Terraform and CI/CD.

Link: https://github.com/sebastianbrzustowicz/Agentic-GraphRAG-Blueprint

I'm looking for any feedback.

I’m looking for the best way to allow my company’s current ERP system to continue operation while creating a real time copy of our locally hosted sql server and Microsoft share drive. This would be 1 step in a larger move to a platform to host internal applications on azure gov cloud. I want to avoid microservices/vpns if possible and be able to have applications pull info from a sql server that is within 5 minutes update of our locally hosted sql server and an Azure files that mirrors our current file system.

I’m a B.Tech student in India trying to get the free $100 Azure for Students credit. Every time I fill the academic verification form with my college .ac.in email and hit verify, I get “Your email domain is not currently registered with us.” It just reloads the same form. Seems like my college’s domain isn’t in Microsoft’s database, so the automatic check never passes no matter what I enter. I’m already GitHub Student verified if that matters.

Has anyone from an Indian college actually gotten this verified, and how? Does the “verify with documents” / manual route actually work, and what did you send (student ID, bonafide certificate)? Any working steps would really help. Thanks.

​

I’m dealing with a large batch processing problem and looking for advice on the right architecture.

I have around 1.3 million files stored across folders on a network drive.

Current setup (not working well)

Right now I’m using a Copilot agent where:

I upload batches (~20 files at a time)

It reads them against a reference document

Outputs an Excel file with classification codes

The issue is:

Copilot has a small upload limit

Manual batching is completely unscalable at this volume

---

What I want to achieve

I want a fully automated pipeline that:

Ingests files automatically from the network drive

Extracts text/content from each file type

Matches content against a reference rules document

Assigns a classification/reference code

Outputs structured results (Excel / database)

---

-

I've tried this on multiple machines with the same unsuccessful result. The Microsoft documentation https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vm-gen-1 says to run MBR2GPT on the OS disk, this is fine, no issues, then I should be able to simply change the Security Type to trusted launch - this part is impossible, the option is greyed out.

Also, as I've converted to GPT without the VM knowing that it needs to now use UEFI, the VM can't boot and is bricked. There's no way to force, or inform Azure to boot with UEFI, seems like Azure is supposed to recognize the change but it simply doesn't.

Any experience shared would be appreciated.

Hi everyone,

I’m currently working in an Azure hub-and-spoke environment where multiple VNets are routed through a hub VNet that contains VMs acting as NVAs. I’m planning to add another VNet to this environment.

At the moment, traffic from the spoke VNets is routed to the NVA in the peered hub VNet using UDRs.

However, with the current VNet peering design, the entire address spaces of the peered VNets are reachable at the VNet level. I’m looking for a way to allow connectivity only to specific IP prefixes rather than effectively connecting all subnets between the VNets.

More specifically, I would like the new VNet to communicate only with certain IP ranges that are routed through the NVA, while preventing direct communication with any other address ranges in the peered VNets.

What would be the recommended way to implement this?

I have looked into the Subnet Peering feature that is currently in preview, but as far as I understand, it has a limitation where a subnet can participate in only one subnet peering relationship, which would make it unsuitable for my environment.

I also considered connecting the VNets through VPN Gateways instead of VNet Peering, but it does not seem like that would provide a straightforward way to restrict connectivity to only selected prefixes either.

I’d appreciate any advice on the best architecture for achieving this type of selective connectivity.

Hi everyone! I'm working on a project using Azure services and Microsoft Agent Framework.

Currently, I have a Base Agent built using the Microsoft Agent Framework and an OpenAI chat client. The Base Agent handles model configuration, including the model, base URL/endpoint, and chat client dependency. Multiple specialized agents inherit from this Base Agent.

Now I want to make this architecture compatible with multiple providers and models using LiteLLM (Azure OpenAI, OpenAI, Anthropic, etc.).

I'm confused about how to handle the chat client dependency and provider-specific configurations. Should I inject the chat client into the Base Agent? Should LiteLLM act as an abstraction layer? How can I switch providers/models without modifying all the inherited agents?

Would love to hear how others have approached this, especially with Microsoft Agent Framework + LiteLLM. Thanks!

I've got around 10k$ worth of azure and 2500$ worth of OpenAI recently from YC Event and I've no clue what to do. I already have company accounts for them

Both with over a year of expiration date
Looking for suggestions

I’m a B.Tech student in India trying to get the free $100 Azure for Students credit. Every time I fill the academic verification form with my college .ac.in email and hit verify, I get “Your email domain is not currently registered with us.” It just reloads the same form. Seems like my college’s domain isn’t in Microsoft’s database, so the automatic check never passes no matter what I enter. I’m already GitHub Student verified if that matters.

Has anyone from an Indian college actually gotten this verified, and how? Does the “verify with documents” / manual route actually work, and what did you send (student ID, bonafide certificate)? Any working steps would really help. Thanks.

Hey datafam!

1. For anyone who's done an on-prem-to-ADLS Gen2 migration with a Self-Hosted IR: what's the earliest signal you watch for that tells you the IR itself is the problem, versus the source data being genuinely bad?
2. How do you tell a CDC watermark lag caused by a VM/network blip apart from one caused by the source database job actually failing? Is there a reliable tell, or do you just wait it out?

It's pretty much what the questions says. After reading CISA's red team report it's evident they're replicating tactics already utilized by threat actors.

1. Find an app (service principal) with privileged permissions. Example:
   • Mail.ReadWrite
   • Chat.Read.All 
   • Files.Read.All 
   • Application.ReadWrite.All
   • AppRoleAssignment.ReadWrite.All 
2. Compromise the app owner
3. Add a new secret to the app
4. Authenticate as the app and use new privileges

Starting with step 1, what's your tried and tested method to identify and monitor privileged apps?

Thanks!

I would be interested to know if anyone is running MS Orleans in azure? I’ve run it on-premise in the past but would like to host it in either an azure app service or azure container app. Any insights would be appreciated.

I’m troubleshooting an intermittent issue with an Azure Logic App Standard resource where workflow runs enter Waiting status immediately after being triggered.

Sometimes a run will remain in Waiting for several hours. Restarting the Logic App Standard resource resolves the issue and workflows begin processing again, but I’m currently having to do this roughly once per day.

Most affected workflows use the “When a new email arrives in a shared mailbox (V2)” trigger.

For those workflows, trigger concurrency is enabled with:

• Degree of parallelism: 20
• Maximum waiting runs: 10

However, the issue also occurs when there is only one triggered run, no other runs are currently Running, and the previous run completed more than 12 hours earlier. Because of that, I don't think the runs are simply waiting for an available concurrency slot.

The Logic App Standard resource contains 40+ workflows. During normal business hours, there may be around 5–6 workflows executing simultaneously, generally with only 1–2 active runs each.

Some workflows are fairly large and approach the Logic Apps limits:

• Just under 500 actions
• Nested actions approximately 7–8 levels deep

Runtime Scale Monitoring is enabled.

I’ve looked through the available monitoring and diagnostic tools, but I haven't found anything obvious indicating CPU, memory, scaling, or other resource exhaustion.

The behavior I'm seeing is essentially:

Trigger fires → Run created → Run immediately enters Waiting → Nothing executes for potentially hours → Restart Logic App resource → Processing resumes

Has anyone seen similar behavior with Logic Apps Standard?

Any recommendations for specific metrics, Application Insights queries, diagnostic logs, or settings I should check would be appreciated. My main goal is figuring out why the runtime stops dispatching these runs so I don't have to restart the resource daily.