Notes from production – Azure, IaC tips, AI in cloud and cloud security news.
From 1 February 2027, new reservations for savings-plan-eligible services are not exchangeable. The worst trap is auto-renewal, which manufactures a non-exchangeable reservation silently. A decision matrix and a CLI audit.
The Blueprints wind-down is already running and locks in phases. On 31 January 2027 the API disappears, unexported data is permanently deleted, and blueprint locks stop working. Artifact mapping to Deployment Stacks and an export via REST.
From 27 October 2026, Foundational CSPM no longer switches itself on for new Azure subscriptions. This is not a security team problem — it is a landing zone factory problem. Bicep, policy, and an ARG audit query.
The largest MCP revision since the protocol began removes sessions, the handshake, and SSE resumability. For hosting that is good news — a remote MCP server is now an ordinary stateless HTTP workload. Blast radius and what it means in Azure.
Managed NGINX on AKS gets its last security patch in November 2026. The replacement is App Routing with Gateway API and Envoy. Annotation mapping, an audit script, and the three annotations with no equivalent at all.
A practical refactor of a serverless email pipeline from APIM-fronted architecture to a private-endpoint-only end state. Shared PE subnet, Function Apps Premium, Service Bus, and Log Analytics with no public surface.
A practical guide to reducing Azure Cosmos DB costs. Provisioned vs Serverless, autoscale tuning, indexing policy, TTL, and multi-region trade-offs with real numbers from running CostSentry.AI.
Flex Consumption is the third path between the Consumption and Premium plans for Azure Functions. A practical breakdown of the pricing model, VNet integration, and when to switch off the Premium plan.
My Microsoft Build 2026 recap from a cloud architect's perspective. The Foundry rebrand, FOCUS 1.3 GA, Agent Cost Trace for AI workloads, and three practical takeaways for enterprise customers.
Deployment Stacks in Bicep are a way to manage Azure resources as a coherent unit with denyAssignments, auto-cleanup, and controlled deletion. Practical guide with a migration plan from classic deployments.
How to publish Bicep modules to ACR in enterprise environments without risking overwriting existing versions. Skip-if-exists pattern, PR validation, and semver hygiene.
Windows Server 2019, Azure Linux 2.0, and kubelet certificate rotation – three AKS retirements with March 2026 deadlines. Practical migration guide with CLI commands and Bicep templates.
Practical playbook for migrating an AKS cluster from the Calico Network Policy engine to Azure CNI Powered by Cilium. Zero-downtime procedure, eBPF benefits, and typical rollout traps.
Practical Azure FinOps guide – from Cost Management through VM right-sizing to Reserved Instances and auto-scaling. Real savings from enterprise projects.
When to choose Azure Container Apps and when AKS – cost, operations overhead, networking, and typical use cases. Real decision examples from three different projects.
How to mask personal data in Azure Monitor before it is written to Log Analytics. DCR transformations, KQL limitations, and a real lab from a retail environment.
A complete guide to buying Azure Reserved Instances and Savings Plans before fiscal year-end. Coverage analysis, exchange rules, and real-world math from enterprise projects.
Kubernetes AKS production readiness checklist covering Azure CNI networking, Workload Identity RBAC, cluster autoscaling, monitoring, and DR strategy.
Design Zero Trust identity architecture with Entra ID Conditional Access policies. MFA enforcement, device compliance, session controls, and named locations for Azure environments.
NIS2 Azure compliance checklist with concrete steps: Azure Policy governance, Defender for Cloud CSPM, centralized logging, and Zero Trust identity.
Build reusable Terraform modules for Azure with private registry publishing, automated testing with Terratest, and versioned module consumption in production.
Implement Azure Policy governance for Landing Zones at scale. Custom policy definitions, initiative assignments, compliance dashboards, and cost management guardrails.
Terraform Azure best practices for production projects. Covers remote state locking, module structure, drift detection, naming conventions, and testing.
Configure Microsoft Defender for Cloud CSPM for Azure Landing Zones. Secure Score optimization, attack path analysis, regulatory compliance dashboards, and real cost breakdown.
Deploy hub-spoke network topology for Azure Landing Zone with Azure Firewall, Private DNS Zones, and VNet peering automation using Bicep modules.
Deploy an enterprise-ready Azure Landing Zone using Bicep modules. Covers hub-spoke networking, policy governance, and CI/CD pipeline integration.
Build a production Bicep deployment pipeline with GitHub Actions. Covers what-if previews, environment approvals, OIDC authentication, and rollback strategies.