Notes from production – Azure, IaC tips, AI in cloud and cloud security news.
A practical refactor of a serverless email pipeline from APIM-fronted architecture to a private-endpoint-only end state. Shared PE subnet, Function Apps Premium, Service Bus, and Log Analytics with no public surface.
A practical guide to reducing Azure Cosmos DB costs. Provisioned vs Serverless, autoscale tuning, indexing policy, TTL, and multi-region trade-offs with real numbers from running CostSentry.AI.
Flex Consumption is the third path between the Consumption and Premium plans for Azure Functions. A practical breakdown of the pricing model, VNet integration, and when to switch off the Premium plan.
My Microsoft Build 2026 recap from a cloud architect's perspective. The Foundry rebrand, FOCUS 1.3 GA, Agent Cost Trace for AI workloads, and three practical takeaways for enterprise customers.
Deployment Stacks in Bicep are a way to manage Azure resources as a coherent unit with denyAssignments, auto-cleanup, and controlled deletion. Practical guide with a migration plan from classic deployments.
How to publish Bicep modules to ACR in enterprise environments without risking overwriting existing versions. Skip-if-exists pattern, PR validation, and semver hygiene.
Windows Server 2019, Azure Linux 2.0, and kubelet certificate rotation – three AKS retirements with March 2026 deadlines. Practical migration guide with CLI commands and Bicep templates.
Practical playbook for migrating an AKS cluster from the Calico Network Policy engine to Azure CNI Powered by Cilium. Zero-downtime procedure, eBPF benefits, and typical rollout traps.
Practical Azure FinOps guide – from Cost Management through VM right-sizing to Reserved Instances and auto-scaling. Real savings from enterprise projects.
When to choose Azure Container Apps and when AKS – cost, operations overhead, networking, and typical use cases. Real decision examples from three different projects.
How to mask personal data in Azure Monitor before it is written to Log Analytics. DCR transformations, KQL limitations, and a real lab from a retail environment.
A complete guide to buying Azure Reserved Instances and Savings Plans before fiscal year-end. Coverage analysis, exchange rules, and real-world math from enterprise projects.
Kubernetes AKS production readiness checklist covering Azure CNI networking, Workload Identity RBAC, cluster autoscaling, monitoring, and DR strategy.
Design Zero Trust identity architecture with Entra ID Conditional Access policies. MFA enforcement, device compliance, session controls, and named locations for Azure environments.
NIS2 Azure compliance checklist with concrete steps: Azure Policy governance, Defender for Cloud CSPM, centralized logging, and Zero Trust identity.
Build reusable Terraform modules for Azure with private registry publishing, automated testing with Terratest, and versioned module consumption in production.
Implement Azure Policy governance for Landing Zones at scale. Custom policy definitions, initiative assignments, compliance dashboards, and cost management guardrails.
Terraform Azure best practices for production projects. Covers remote state locking, module structure, drift detection, naming conventions, and testing.
Configure Microsoft Defender for Cloud CSPM for Azure Landing Zones. Secure Score optimization, attack path analysis, regulatory compliance dashboards, and real cost breakdown.
Deploy hub-spoke network topology for Azure Landing Zone with Azure Firewall, Private DNS Zones, and VNet peering automation using Bicep modules.
Deploy an enterprise-ready Azure Landing Zone using Bicep modules. Covers hub-spoke networking, policy governance, and CI/CD pipeline integration.
Build a production Bicep deployment pipeline with GitHub Actions. Covers what-if previews, environment approvals, OIDC authentication, and rollback strategies.