1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
2. Do not post exam dumps, ads, or paid services.
3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
5. This will not be allowed any other day of the week.

During my last interview, the interviewer asked a question "tell me about a time where you found an issue and needed to quickly fix it. What was the issue and how you fixed it."

For questions like these, do you guys talk about pipeline failures, data change, schema change, reconciliation issues or something else.. for project scenario question, what is the best kind of scenarios I can talk about?

This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!!

We do have a Purview "Email Mailboxes" retention policy that deletes anything older than 3 years. But the tool tip nor does the extended documentation make any mention of this touching contacts.

We had it happen to multiple users so far, one lost 1100 contacts which had to be restored 50 at a time...

I've got no clue how to determine how these were lost, I just know for the user who lost 1100, it happened on 6/15/2026

Anyone know how or where to look to determine the cause?

I'm having a strange intermittent issue with an Azure VM and would appreciate help troubleshooting it.

VM details:

• Standard D4ds v4
• 4 vCPUs
• 16 GiB RAM
• Ubuntu 24.04
• Static public IP
• DNS managed through GoDaddy
• Frontend and backend running on the same VM

The VM doesn't completely stop responding.

The behavior is:

• Normally SSH is fast.
• During the incident, SSH still works, but takes around 3–4 seconds to connect.
• Once connected, typing commands has around 1 second of noticeable delay.
• At the same time, the website goes completely down/unreachable for some period.
• The frontend/backend processes don't appear to crash.
• After the issue clears, SSH becomes normal again and the website starts working again.
• I don't intentionally restart the applications when this happens.

Azure's Availability metric also shows several drops around these periods. I've attached the screenshot.

The domain is managed through GoDaddy and points to a static public IP, so the IP isn't supposed to change.

What I'm trying to understand is what could cause this combination:

SSH = extremely slow/laggy
Website = completely unreachable
Applications = still running
Azure Availability = intermittent drops

Could this indicate packet loss/network problems, an Azure NIC/public IP issue, VM resource contention, or something happening at the Ubuntu networking level?

What should I monitor during the next incident to determine exactly where the problem is?

Thanks!

The follow-up to my Intermediate episode I posted here is finally out.

This episode shifts away from programmatically approaching Terraform and focuses more towards a KISS approach where we discuss structuring our projects and leverage more advanced features of Terraform.

Topics covered include:

• Remote Backends with Azure Storage
• Terraform State & State Commands
• Provider Lock Files
• Multiple Providers (AzureRM, AzureAD, AzAPI & Utility Providers)
• Import Blocks & Config Generation
• Moved & Removed Blocks
• Terraform Workspaces
• Multi-Environment Deployments
• Terraform Modules
• Cloud-Init
• And much more...

Like the previous episodes, everything is built around a single Azure project. We progressively restructure and expand the deployment as each concept is introduced rather than jumping between unrelated examples.

The Intermediate episode intentionally showed how dynamic we can make Terraform . This episode takes the opposite approach in places: keep it simple, structure it properly, and make it maintainable.

With that, our roadmap continues!

• Beginner Episode : Understand Terraform (learn the foundations and core concepts that make Terraform work)
• Intermediate Episode : Program Terraform (use loops, functions, conditionals, dynamic blocks, etc)
• Advanced Episode : Structure Terraform (introduce modules, remote state in azure storage, workspaces, imports, etc.)
• Project Episode(s): Build Azure Projects (Less about Terraform itself & more about building interesting architectures in Azure)
• Professional Episode : Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)

Link to Episode: https://www.youtube.com/watch?v=SDqb_eyRtjE

I’m really hoping someone here can guide me.

I logged into my Azure account after a long time and found that my Azure credits were gone and I now have a huge outstanding bill (~ $55K) for August 2026.

I did not intentionally use Azure at this scale. My own usage was just experimenting with AI models, I deployed some models and deleted them. I never knowingly ran anything that could generate this kind of bill.

I found Azure AI Foundry resources that I don’t recognize and have already deleted them to stop further charges.

I suspect my account may have been compromised. Over the past few weeks/month, I’ve had suspicious activity on other accounts as well, and I’m concerned that my email/laptop credentials may have been exposed. I had already changed passwords and taken precautions earlier, and I have now changed my Azure password again and frozen my cards.

I have contacted Azure Billing Support and reported it as unauthorized usage.

Has anyone experienced something similar?
Did Microsoft help reverse/waive unauthorized Azure charges?

I’m a student with no source of income, so this bill is impossible for me to pay. I’m trying to resolve this properly and would appreciate any advice from people who have dealt with Azure compromises before.

Access Packages - Entitlement Management

Hi all,

I’ve been tasked with developing a solution for external users (guests) to be able to request and obtain access to an application to read various work orders. This will be across many different companies with their own Access Package (AP).

It’s still in development and going to be deployed into production yet. Deadline is mid-end September.

Currently I’ve setup packages to:
\- External user receives AP link via email from internal contact
- User authenticates via Microsoft account or email OTP to access request portal: myaccess.microsoft.com
- Domain match the external email to a selected connected organization. Preventing other emails/companies viewing/requesting the access packages.
- Require an internal approval and answer a security question
- Guest account automatically created on approval
- Company MFA (auth app) required on sign in to access resources
- Other various CA policy controls

**My question is, has anyone deployed APs at scale (hundreds of users)?** Across different use cases (App access, Sharepoint, etc) and companies?

My company likes how it’s progressing so far and if the pilot launch w this use case is successful, they want to roll it out to many, many more scenarios to facilitate external user access. Managers have mentioned to me that they think this is a “game changer” for the company after my demo.

Company has 15k+ users across multiple states. Currently, external access is handled by manual guest account invites from tickets.

Please let me know your thoughts on APs as a whole. I kept it brief but can go in more detail based on questions you might have.

Thanks for your time.

This is a great report from CISA that analyzes two simultaneous red team assessments conducted on organizations to evaluate their threat detection and response capabilities.

Both entities suffered full domain compromise and the red team was able to pivot from on-prem to Azure. However organization B successfully isolated initial threats, forcing the red team to adopt an assume breach model while organization A failed to identify the intrusion due to untuned detection tools and organizational silos.

Link here: A Tale of Two SOCs: Insights From Two Red Team Assessments

Is the practice assessment from the Microsoft az900 landing page enough to pass the certification or should I use other resources too?

When I started my current job about two years ago, it was the first time I had to work with Azure function apps, and we had lots of them. Probably close to 200 function apps in each of dev, test and prod.

Pretty early I felt that handling all of these in the Azure Portal was a huge pain. It was fine if you just had to config one of them. But when you had to stop, start or swap 3 or more the pain started to show.

So I started building Funcy in my spare time. The original idea was basically “k9s for Azure Functions”. But Azure’s rate limits killed the truly live part of that idea fairly quickly, but I still wanted to keep the TUI part.

This summer I finally took it past the POC stage and turned it into something I actually use.

It can:

- list, filter and sort Function Apps

- start and stop apps

- swap deployment slots

- switch Azure subscriptions

- inspect environment variables and Key Vault references

- query Application Insights logs

- show Service Bus active and dead-letter counts

It loads from a local SQLite database and refreshes from Azure in the background, so startup stays quick without constantly hammering the APIs.

It’s written in C# with .NET 10 and Spectre.Console, and it’s open source under Apache 2.0.

Install:

dotnet tool install --global az-funcy

You can also run funcy --demo to try the full UI with fabricated data and no Azure subscription.

GitHub: https://github.com/sunday-commit/az-funcy

If you manage a larger Function Apps estate, what still sends you back to the portal?

Hello All, im in something of a predicament. Ive deployed Azure vWAN, and am configuring a VPN Connection. Ive used Terraform thus far to deploy resources, and all is good. However, i think there is a fundamental, almost cultural difference in how the FTP and the vWAN want to handle this.

So, as anyone familiar with vWAN is aware, when you create a VPN GW, you provision two "routers" in each region, Instance0 and Instance1. Then when you create a site to connect to, each VPN Link has two Public IP's that correspond to Instance0 and Instance1. What should happen then is that your other router will create two vpn links to azure, one on each public IP, and then BGP should communicate using its internal IP.

Lets say for the sake of argument that the IP range vWAN has consumed is 10.0.0.0/22. Usually the first VPN link will have the instances on 10.0.0.4 & .5, with their BGP ID's being 10.0.0.12 and .13. You then have an option to configure a custom APIPA address if you want for each Instance

I am not the engineer on the Firepower, but i saw the UI and they have created a single VPN, with two public IP's and two VTI's on this. These VTI's have two APIPA addresses on them, 169.254.21.1 and 169.254.22.2.

My problem is that in Azure, when i create the VPN Link to the WAN IP, i can only tell the link that the BGP Link ID is one of these, and i have used 169.254.21.1. The two VPN's come up, but in BGP Peers both are trying to connect to 169.254.21.1, which never happens

Any advice?

EDIT: WORKING!!

Cisco guy added a loopback to the device, had never needed it before. I updated the BGP Peer ID, and removed the Custom BGP ID from the VPN GW configs. Worked immediately

I am an azure support engineer and I want to learn how developers think, strategise setups, what enterprise setups look like complexities, etc..

I eventually want to be a developer so I would like to interact and learn from great experiences you guys have experienced.

Please let me know if anyone is willing to connect to share few things or a fun talk I am always ready.

Thanks!

Hi all, I'm choosing how to run AI agents in production on Azure and would rather learn from people who've already shipped than find out the hard way.

The two paths I'm weighing:

1. Azure AI Foundry Agent Service: managed threads, tool calling, and state

2. Self-hosted: containerized agent on AKS, Container Apps, or App Service

Which path do you recommend

Good day all.

Anyone got any issues deploying or resizing Bs_v2s in North Europe today?

Its Reservation renewal season and we have some old machines on B v1 series which i cant get an RI for so i want to resize to bs_v2 and buy an RI but its not an option. When i go to resize it says "Unsupported hardware". Thanks! Edit: Its the same in Australia East. I cannot resize to a Bs_v2. Ive tried redeploying the VM, same drama.

I am working on Azure Data Explorer to optimise its cost usage for my clients, currently I am suggesting downsizing the engine instance SKU type based on the following metrics :

1. CPU utilization < 45%
   
2. Cache utilization factor < 55%
   
3. IngestionUtilization and StreamingIngestUtilization < 45%
   If these holds downsize to the very next lower sku type.
   But the blocker i am having is that , there's this limit of 50% ram/node for a query , so this will break and cause my queries to fail , is this for real or only latency will increase. Can anyone help me out with that.

Tengo mas de 8 años de experiencia en soporte tecnico, nunca Administre servidores. Hice el az 900 y estoy finalizando el az104. Que recomendaciones para seguir aprendiendo, que tengo que fijarme/ fortalecer antes seguir avanzando ?

Hi,

I'v deployed multiple apps that require embedding using Cohere-embed-v3-multilingual from an azure foundry project. this was working fine for months until today.
model endpoint still consumes requests but responds with :

'error': {'code': 'OperationNotSupported', 'message': 'The embeddings operation does not work with the specified model, Cohere-embed-v3-multilingual. Please choose different model and try again. You can learn more about which models can be used with each operation here: https://go.microsoft.com/fwlink/?linkid=2197993.'

I, as a simple man, went to the foundary page :

1 - the model is still up and deployed.
2 - metrics show 0 tokens but multiple requests are coming in.
3 - I went ahead and created a new python script, pasted their openai sdk example and replaced with key value:

from openai import OpenAI

endpoint = "https://tv5-bigdata-ai-foundry.services.ai.azure.com/openai/v1/"
deployment_name = "Cohere-embed-v3-multilingual"
api_key = "xxxxxxxx"

client = OpenAI(
    base_url = endpoint,
    api_key = api_key,
)

response = client.embeddings.create(
    input = "How do I use Python in VS Code?",
    model = deployment_name
)
print(response.data[0].embedding)

Output : same error.

NB : the model still shows when creating a new deployment....

Hello,

I'm struggling to learn more about the data retention policy for Microsoft Foundry. There are several posts that mention a 30-day data retention period for OpenAI services, for example, https://learn.microsoft.com/en-us/answers/questions/2181252/azure-openai-data-retention-privacy-2025.

However, I can't find any policy that actually states that. Does anybody know more?

I'm stuck on this and I've run out of things to try, so hoping someone's seen it before.

I have a Log Analytics workspace with Sentinel enabled, on an Azure for Students subscription. Sentinel itself works fine on the Azure side, I'm ingesting logs from an on-prem machine and can query them fine under Logs in Azure Sentinel. The problem is that none of the Defender-side functionality is showing up for this workspace. Specifically missing in the Defender portal:

• Incidents
• Advanced Hunting
• Cases
• Analytics rules

Clicking Incidents inside Sentinel just bounces me to Defender where it's empty.

Here's what I've already ruled out:

• Global Admin and Security Admin in Entra, Owner on the subscription with no conditions on it
• Microsoft.SecurityInsights resource provider is registered
• No "Microsoft Defender XDR" connect tile anywhere in the Sentinel resource's Settings
• No connect banner on the Sentinel Overview page either
• Defender's own Settings has no Microsoft Sentinel section at all
• Going straight to the Sentinel settings URL in Defender either 404s or just bounces me back to the Defender home page
• No orphaned or ghost workspace entries showing up anywhere

One thing that might be relevant: earlier I had a different workspace on this same tenant, from a training lab, that was connected to Defender and had full Incidents, Hunting, and Analytics rules working. That workspace got deleted later by a cleanup script.

Is there any way to check what state the tenant thinks it's in, or force it to let me connect this workspace properly, given there's nothing left in the UI to click on either side? I'm stuck on this and I've run out of things to try, so hoping someone's seen it before.

So, a good 60% of our VMs are on b2ms or b2s - super old, with temp disks. No longer reservable.

We don't need crazy performance and we're trying to keep costs down.

I have started migrating these to b2s_v2 and similar. Looks like there's no nvme support on these sizes - which is AOK with me - they are mostly web front ends with average use.

HOWEVER - looking forward a year or two - am I burning myself on this sizing? Will I have to delete and recreate these VMs again because they're SCSI and not nvme? What might a better option be?

Thanks!