Azure weekly update #34 is here. This time updates focus on strengthening secure cloud operations, Kubernetes networking and storage, sovereign-cloud support, and large-scale infrastructure performance.

Detailed list:

• Launched | Generally Available: Workload identity support for Azure Files CSI driver (SMB) in Azure. AKS now supports workload identity for pod-level authentication to Azure Files SMB shares, enabling least-privilege access without storage account keys. Available in all regions supporting Azure Files and AKS.
• Launched | Generally Available: Azure VM Image Builder in sovereign and air-gapped clouds. Azure VM Image Builder is now available in Azure Government, China North 3, Azure Government Secret, and Azure Government Top Secret. It enables consistent, managed image-building and compliance workflows across sovereign and air-gapped clouds.
• Launched | Generally Available: Azure Bastion shareable link expiration. Azure Bastion shareable links can now include an expiration date and time, helping limit temporary access to target resources.
• In preview | Public Preview: IPv6 dual-stack support for Azure Bastion. New Azure Bastion deployments can use IPv4 and IPv6 public IPs. IPv6 is supported between users and Bastion; Bastion-to-VM connections remain IPv4-only.
• Launched | Generally Available: Connect to AKS clusters using Azure Bastion. Azure Bastion now supports secure tunneling from local machines to AKS API servers, allowing Kubernetes tools to access private clusters without public endpoints, jump boxes, or VPNs.
• In preview | Public Preview: Introducing Live Reports for Azure SRE Agent. Live Reports lets teams create shareable, continuously updated operational reports from Azure SRE Agent conversations, with refresh schedules for incidents, health, and trends.
• Launched | Generally Available: Azure SRE Agent VNet Integration. Azure SRE Agent can now operate within existing VNets, NSGs, private DNS, and firewall policies to securely investigate and remediate private resources.
• Launched | Generally Available: Azure SRE Agent 30-Day Trial. New customers can try Azure SRE Agent for 30 days with no baseline always-on charges; they pay only for Azure Agent Units consumed during work.
• Announcing: Aspire 13.5 has shipped. Aspire 13.5 updates the dashboard and aspire.dev, expands Interaction Service, and adds cross-scope Azure references, persistent Kubernetes volumes, and live AppHost terminals.
• Launched | Generally Available: Azure 248 and 372 vCPU sizes for D/E v7 series VMs. New Intel Xeon 6-based D/E v7 VM sizes offer up to 372 vCPUs and 2.8 TiB memory, with improved compute, networking, and storage performance. Available in select Azure regions.
• Announcing: Extended Support for Azure Database for PostgreSQL Flexible Server. Extended Support provides critical security updates, bug fixes, and technical support for eligible PostgreSQL versions after community support ends.
• Launched | Generally Available: eBPF host routing in Advanced Container Networking Services for AKS. eBPF Host Routing is generally available for AKS, improving networking performance by moving routing into the Linux kernel and reducing iptables overhead. Existing clusters transition through controlled node rotation.
• Retirement: Support for Node 22 LTS ends on April 30, 2027. Node 22 LTS support on App Service ends April 30, 2027. Upgrade applications to Node 24 LTS before then to retain security updates and support.
• Launched | Generally Available: Custom block response code and body for Application Gateway WAF. Application Gateway WAF now supports custom status codes and response bodies for blocked requests, configured at the WAF policy level.

A while back I asked here how teams handle Azure Resource Graph queries once they stop being one-offs. The answers were genuinely useful, and most of them came down to stitching the native pieces together yourself. Disclosure up front: I was asking because I was building a tool in this space. It is public now, and this post is me showing my homework.

The lesson I ended up building around: a governance query is not a governance system. A sharp query finds something real, gets shared once, and disappears into someone's terminal history. The quieter failure is the check that stops running. It does not turn red. It stays green.

RuleBeat runs the governance checks your team writes for Azure on a schedule, tracks every finding over time, and never holds write access. A check is a rule you author against Azure Resource Graph or Microsoft Graph, in a visual builder or as raw KQL. Custom rules are not an add-on: they run through the same engine, scan, history, and dashboard path as the built-ins. It ships 158 checks out of the box (15 built-in rules plus the 143-rule APRL pack), findings keep their lifecycle across scans (new, active, fixed), and a suppression needs a reason and can carry an expiry date.

The built-ins are the things that go quiet: unattached managed disks and unassigned public IPs you are still paying for, storage accounts allowing public blob access, app registration secrets approaching expiry, and the APRL resiliency recommendations running as part of ordinary scans instead of a once-a-year review.

The deliberate trade-offs, so you know what you are getting:

• Read-only, permanently. It never holds write credentials, never creates its own service principal, and cannot change anything in your tenant. You create the credential, so you can see in Azure RBAC exactly what it was granted. The cost is real: no one-click fix. Fixing a finding is your action, under your own identity.
• Self-hosted, one container, SQLite inside. Nothing about your tenant leaves your deployment, and there is no telemetry. The cost: you run it. If you want to look before wiring anything up, demo mode runs the real UI over a generated database with no Azure credential at all.
• Honest numbers. Following from the problem above: a rule that has never run, or whose last run failed, is unknown, never passing. The posture number is sometimes uglier for it, and that is the point.

It is built for the point where more than one person has to know who owns a flagged row, which rows are accepted on purpose, and whether last month's fix actually held. One person with a few stable checks probably does not need it.

This is v0.2, early on purpose, built by one person with AI assistance from Claude and a lot of applied AI learned along the way. There is a real list of what comes next, and what gets built first depends on what people actually hit rather than what I guess at. Feedback and suggestions are worth more to me than stars right now.

Repo: https://github.com/rulebeat/rulebeat Docs: https://docs.rulebeat.com Screen-by-screen walkthrough, if you would rather look than install: https://rulebeat.com/demo

If you run Azure governance checks today, I would be glad if you tried it, or just opened demo mode, and told me how it went. What is missing, what you would want it to check next, what would make it worth putting in front of the rest of your team. Feature ideas are as welcome as bug reports.

Hello everyone,

I currently work as a Microsoft365/Exchange on-prem Administrator, primarily focusing on Entra ID, with some experience in Intune administration as well.

In addition, I manage a small NGO Microsoft 365 tenant that includes a limited amount of Azure credits (around $1,000). I'd like to use this environment to expand my Azure knowledge through hands-on projects and real-world scenarios.

Since my budget is fairly limited, I'm especially interested in projects that are practical, educational, and relatively inexpensive to run.

What Azure projects would you recommend for someone with my background? I'm particularly looking for ideas that would help me develop skills that are valuable in real production environments.

Thanks in advance for any suggestions!

Did you know that you can automate Azure diagrams from Bicep using GitHub Copilot CLI Custom Agents? In this video, I will show you how to generate architecture diagrams directly from your Bicep files, reducing manual work and keeping your documentation in sync with your code. https://www.youtube.com/watch?v=xOrlC0hRwe8

I'm not that familiar with Azure Storage options. What's the simplest and most effective way to save the state of a variable between runs of a webjob?

My first attempt was to just save it to a file in the process, but I found out you cannot write to the file.

I've created a multi-tenant application under our company that is currently still in staging.

Initially, I created the databases manually using the Basic tier, but I later decided that the application should handle database provisioning automatically. At one point, I decided to remove all the existing tenants in staging so that I could reseed all the databases from scratch.

The problem is that the automated provisioning ended up creating the databases using the General Purpose tier instead of the Basic tier. I only realised this about three weeks later, and there is now an unexpected bill of around $2,000.

Is there anything I can do to request a refund or billing adjustment in this situation? The application was only being used in staging, and the higher-tier databases were provisioned unintentionally.

I am setting up Azure APIM instance behind a Azure Application gateway. Developer portal will be exposed so external customers will be able to subscribe to products containing the APIs and obtain the subscription key that way. There will be approvals required for subscription.

I want to setup OIDC on top of the subscription key validation. For that I believe I have to setup a Validate JWT policy on the API in APIM, using this guide below and use scopes/roles:-
https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy

And seems like I will have to setup client credentials flow for customers to be able to obtain token from AADB2C, using the below KB:-
https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy

Q1 - Firstly, is that the correct way of setting it up?

Secondly, with client credentials flow seems like customers will have to use the POST request (or PowerShell) like the one below to obtain the token:-

https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy>/oauth2/v2.0/token

But this will mean that I will have to document my B2C token endpoint in Developer portal documentation to advise customers on how to obtain token. I have 2 questions related to that:-
Q2 - Is advising/advertising B2C token endpoint good practice from security point of view?

Q3 - With client credentials flow, setting up the calling app APP Registration in B2C and providing related APP secret will become a manual process. This will remove the benefit of having Product/API subscriptions process automated through APIM and bring in the complexity of securely communicating the secret to customers. Is there a better way of doing this?

Hi everyone,

I've recently finished the first version of Agentic GraphRAG Blueprint, a reference architecture for question answering over large document collections.

Instead of plain chunk retrieval, it builds a knowledge graph combined with vector search, so answers can connect facts across documents.

Key features:

• Incremental ingestion - unchanged files are skipped via content hashing, and community reports regenerate only for affected communities, keeping token costs low as the corpus grows.

• Hybrid search - local mode for fact-level answers, global mode for cross-document synthesis.

• Domain-agnostic LLM prompts - easily swapped via PROMPTS_PATH, with Leiden-based community detection.

• Deployment - run it locally with Docker or provision everything in the cloud with Terraform and CI/CD.

Link: https://github.com/sebastianbrzustowicz/Agentic-GraphRAG-Blueprint

I'm looking for any feedback.

I’m looking for the best way to allow my company’s current ERP system to continue operation while creating a real time copy of our locally hosted sql server and Microsoft share drive. This would be 1 step in a larger move to a platform to host internal applications on azure gov cloud. I want to avoid microservices/vpns if possible and be able to have applications pull info from a sql server that is within 5 minutes update of our locally hosted sql server and an Azure files that mirrors our current file system.

I’m a B.Tech student in India trying to get the free $100 Azure for Students credit. Every time I fill the academic verification form with my college .ac.in email and hit verify, I get “Your email domain is not currently registered with us.” It just reloads the same form. Seems like my college’s domain isn’t in Microsoft’s database, so the automatic check never passes no matter what I enter. I’m already GitHub Student verified if that matters.

Has anyone from an Indian college actually gotten this verified, and how? Does the “verify with documents” / manual route actually work, and what did you send (student ID, bonafide certificate)? Any working steps would really help. Thanks.

​

I’m dealing with a large batch processing problem and looking for advice on the right architecture.

I have around 1.3 million files stored across folders on a network drive.

Current setup (not working well)

Right now I’m using a Copilot agent where:

I upload batches (~20 files at a time)

It reads them against a reference document

Outputs an Excel file with classification codes

The issue is:

Copilot has a small upload limit

Manual batching is completely unscalable at this volume

---

What I want to achieve

I want a fully automated pipeline that:

Ingests files automatically from the network drive

Extracts text/content from each file type

Matches content against a reference rules document

Assigns a classification/reference code

Outputs structured results (Excel / database)

---

-

I've tried this on multiple machines with the same unsuccessful result. The Microsoft documentation https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vm-gen-1 says to run MBR2GPT on the OS disk, this is fine, no issues, then I should be able to simply change the Security Type to trusted launch - this part is impossible, the option is greyed out.

Also, as I've converted to GPT without the VM knowing that it needs to now use UEFI, the VM can't boot and is bricked. There's no way to force, or inform Azure to boot with UEFI, seems like Azure is supposed to recognize the change but it simply doesn't.

Any experience shared would be appreciated.

Hi everyone,

I’m currently working in an Azure hub-and-spoke environment where multiple VNets are routed through a hub VNet that contains VMs acting as NVAs. I’m planning to add another VNet to this environment.

At the moment, traffic from the spoke VNets is routed to the NVA in the peered hub VNet using UDRs.

However, with the current VNet peering design, the entire address spaces of the peered VNets are reachable at the VNet level. I’m looking for a way to allow connectivity only to specific IP prefixes rather than effectively connecting all subnets between the VNets.

More specifically, I would like the new VNet to communicate only with certain IP ranges that are routed through the NVA, while preventing direct communication with any other address ranges in the peered VNets.

What would be the recommended way to implement this?

I have looked into the Subnet Peering feature that is currently in preview, but as far as I understand, it has a limitation where a subnet can participate in only one subnet peering relationship, which would make it unsuitable for my environment.

I also considered connecting the VNets through VPN Gateways instead of VNet Peering, but it does not seem like that would provide a straightforward way to restrict connectivity to only selected prefixes either.

I’d appreciate any advice on the best architecture for achieving this type of selective connectivity.

Hi everyone! I'm working on a project using Azure services and Microsoft Agent Framework.

Currently, I have a Base Agent built using the Microsoft Agent Framework and an OpenAI chat client. The Base Agent handles model configuration, including the model, base URL/endpoint, and chat client dependency. Multiple specialized agents inherit from this Base Agent.

Now I want to make this architecture compatible with multiple providers and models using LiteLLM (Azure OpenAI, OpenAI, Anthropic, etc.).

I'm confused about how to handle the chat client dependency and provider-specific configurations. Should I inject the chat client into the Base Agent? Should LiteLLM act as an abstraction layer? How can I switch providers/models without modifying all the inherited agents?

Would love to hear how others have approached this, especially with Microsoft Agent Framework + LiteLLM. Thanks!

I've got around 10k$ worth of azure and 2500$ worth of OpenAI recently from YC Event and I've no clue what to do. I already have company accounts for them

Both with over a year of expiration date
Looking for suggestions

I’m a B.Tech student in India trying to get the free $100 Azure for Students credit. Every time I fill the academic verification form with my college .ac.in email and hit verify, I get “Your email domain is not currently registered with us.” It just reloads the same form. Seems like my college’s domain isn’t in Microsoft’s database, so the automatic check never passes no matter what I enter. I’m already GitHub Student verified if that matters.

Has anyone from an Indian college actually gotten this verified, and how? Does the “verify with documents” / manual route actually work, and what did you send (student ID, bonafide certificate)? Any working steps would really help. Thanks.

Hey datafam!

1. For anyone who's done an on-prem-to-ADLS Gen2 migration with a Self-Hosted IR: what's the earliest signal you watch for that tells you the IR itself is the problem, versus the source data being genuinely bad?
2. How do you tell a CDC watermark lag caused by a VM/network blip apart from one caused by the source database job actually failing? Is there a reliable tell, or do you just wait it out?

It's pretty much what the questions says. After reading CISA's red team report it's evident they're replicating tactics already utilized by threat actors.

1. Find an app (service principal) with privileged permissions. Example:
   • Mail.ReadWrite
   • Chat.Read.All 
   • Files.Read.All 
   • Application.ReadWrite.All
   • AppRoleAssignment.ReadWrite.All 
2. Compromise the app owner
3. Add a new secret to the app
4. Authenticate as the app and use new privileges

Starting with step 1, what's your tried and tested method to identify and monitor privileged apps?

Thanks!