Recent Discussions
Find out a server with Azure AD Connect
Hi All, Normally, if someone need to find on which server Azure AD Connect is installed it can be done in Azure portal under Microsoft Entra Connect - Microsoft Entra Connect Health - Sync Services. Is there any way to find out on which server Azure AD Connect is installed if Microsoft Entra Connect Health is not installed or its service stopped? I know in this case no server will be displayed under Microsoft Entra Connect Servers. The reason why I'm asking, someone deployed Azure AD Connect and ran syncing but for unknown reason stopped Azure AD Connect Health service. Because of that I couldn't find on which server Azure AD Connect tool was installed until that person advised. If he didn't tell me I most likely would need to sign in to each production server to check. However, just wondering if it can be done with some PowerShell command. Thanks.
ResourceDeploymentFailure when creating a HostPool for Azure Virtual Desktop
When I try to create a Azure Virtual Desktop I get the following error: { "code": "DeploymentFailed", "target": "/subscriptions/a-b-c-d-e/resourceGroups/rg-avd-wcus/providers/Microsoft.Resources/deployments/HostPool-x-y-z-æ-ø-deployment", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.", "details": [ { "code": "ResourceDeploymentFailure", "target": "/subscriptions/a-b-c-d-e/resourceGroups/rg-avd-wcus/providers/Microsoft.DesktopVirtualization/hostpools/hp-avd-wcus/sessionHostConfigurations/default", "message": "The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'." } ] } Anyone know what it is or how I can fix it? Subscription Subscription Microsoft.DesktopVirtualization = Registered Resource group Resource group Region = (US) West Central US Virtual network Region: (US) West Central US Key vault Region: (US) West Central US Pricing tier: Standard Access control (IAM): Gave myself Key Vault Administrator Key Vault → Objects → Secrets → Generate/Import Name: avd-admin-username Name: avd-admin-password AVD Host Pool Location: (US) West Central US Validation environment: No Preferred app group type: Dektop Host pool type: Pooled Create Session Host Configuration: Yes Load balancing algorithm: Depth-first Max session limit: 5 Session hosts Number of session hosts: 1 Name prefix: vm-avdwcus Location: (US) West Central US Availability options: No infrastructure required Secure type: Trusted launch virtual machine Image: Windows 11 Enterprise mulit-session, Version 25H2 Size: Standard D2as v5 Number of VMs: 1 OS disk type; Standard HDD OS disk size: Default size (128 GB) Virtual network: vn-avd-network-wcus Public inbound port: No Domain to join: Microsoft Entra ID Entroll VM with Intune: YesHow should Azure Resource Groups be structured for enterprise integration workloads?
When designing an enterprise integration platform in Azure, Resource Group structure can have a significant impact on ownership, lifecycle management, RBAC and operations. Consider an integration platform containing: For example, consider an integration platform containing API Management, Azure Functions, Service Bus, Key Vault and networking. A simple approach is to group resources by Azure service type. But in production environments, I have found that a more useful question is: Should Resource Groups primarily reflect technology, workload ownership, resource lifecycle, or operational responsibility? For example, should all integration components belong to one Resource Group? Or should shared infrastructure and workload-specific resources have separate boundaries? My view is that Resource Groups should primarily reflect ownership, lifecycle and operational responsibility rather than simply grouping resources by technology. I recently explored this topic in the first article of a new series on Azure architecture: Are Azure Resource Groups Just Folders? The article discusses workload-based Resource Group design, environment boundaries, shared infrastructure and RBAC considerations. I would be interested to hear how others structure Resource Groups for enterprise integration workloads in Azure. Article: https://www.linkedin.com/pulse/azure-resource-groups-just-folders-chethan-raj-fakacHow do you decide what belongs in an Azure Resource Group?
One of the Azure design decisions that looks simple at first but becomes surprisingly important in production is how we structure Resource Groups. The common approach is to group related Azure resources together. But in enterprise environments, I have found that a more useful question is: Should a Resource Group represent technology, application, workload ownership, or resource lifecycle? For example, consider an integration platform containing API Management, Azure Functions, Service Bus, Key Vault and networking. Would you put everything into one Resource Group? Or would you separate shared infrastructure from workload-specific resources? In my experience, ownership, lifecycle and operational responsibility are often better boundaries than simply grouping resources by Azure service type. I recently explored this topic in more detail in the first article of a new series I am writing on Azure architecture: Are Azure Resource Groups Just Folders? The article covers workload-based Resource Group design, environment boundaries, shared infrastructure, RBAC and some production lessons learned. I would be interested to hear how others approach Resource Group design in production Azure environments. Article: https://www.linkedin.com/pulse/azure-resource-groups-just-folders-chethan-raj-fakac
Leverage Azure PIM with DataBricks with Contributor role privilege
We are trying to leverage Azure PIM. This works great for most things, however; we've run into a snag. We want to limit the contributor role to a group and only at the resource group level, not subscription. We wish to elevate via PIM. This will then allow the user access within DataBricks. #1 issue - We have to enable PIM at the group level as it doesn't show up for group members within PIM and can't assign a contributor level group within the PIM application in Azure. So an admin has to enable PIM for the user to activate at the group level. We've also tried to do this scenario leveraging the Managed Application Contributor role as well. #2 - Delay - We are using the SCIM connector for User Provisioning leveraging Azure AD Groups. This connects to the unity catalog and are able to assign the groups within the Workspace. The issue - after you elevate the users permission in the contributor group at the resource level, you have to wait for 40 minutes for user provisioning to run or stop/start it. Until then, the user remains in an 'inactive' state within DataBricks. We feel we are missing a more fluid way to grant these rights and leverage PIM. Suggestions? Thanks in advance.
Azure Data Explorer Python Sandbox Upgrade Anaconda and Python Version
Hi all, I'm using the Python Sandbox in Azure Data Explorer to do inference on my data tables. However, in some of my python code I'll need to upgrade the python() sandbox, e.g., TF 2 instead of TF 1 provided by Py 3.6 and Anaconda 5.2 inside the sandbox. I was looking online but didn't find any good solution on how to upgrade Azure Data Explorer Python Sandbox Anaconda and Python Version If anyone knows of a solution or any information to run this python sandbox upgrade that'd be really great Or if it's not possible can anyone suggest me what other Azure solution I might use to do inference on my data tables? Thanks and have a great day!Cost increases when selecting Amortised cost in cost analysis
Hi, this seems like a bug. When i select Amortized cost in Cost analysis, our monthly cost jumps from $25,664.54 to $76,315.83. The resource that causes the jump is a Reservation for a D4asv5 virtual machine. It jumps to $3,120.09 per day. Can someone please try it their side.FinOps for AI: Cost Optimization Strategies for High-Volume Azure AI Workloads
AI has moved from experimentation to production surprisingly quickly. Teams are now using Azure AI workloads for everything from customer support and document processing to content generation, data extraction, search, and intelligent automation. But as AI usage grows, so does a problem that many engineering teams discover the hard way: AI costs can scale much faster than expected. Link to the Blog
Azure Admin Login
We have a client who has lost their access information to get into their Azure global admin. This is a non-profit institution that moved the ownership of their Azure account to another entity years ago now can't get in to the global admin for their entire Azure setup. Microsoft requires the global admin login to create a support ticket and in this case, how are they supposed to open up a case when they can't login. The customer is furious and now disputing the CC charges so we open an Azure support ticket 10 days ago for ourselves and since it's not a Critical issue, have gotten no response. This is untenable situation and there is no way to contact some one from MS without the login, how does this get resolved??
Docker Engine v29 on Linux: Why data-root No Longer Prevents OS Disk Growth (and How to Fix It)
Scope Applies to Linux hosts only Does not apply to Windows or Docker Desktop Problem Summary After upgrading to Docker Engine v29 or reimaging Linux nodes with this version, you may observe unexpected growth on the OS disk, even when Docker is configured with a custom data-root pointing to a mounted data disk. This commonly affects cloud environments (VMSS, Azure Batch, self‑managed Linux VMs) where the OS disk is intentionally kept small and container data is expected to reside on a separate data disk. What Changed in Docker Engine v29 (Linux) Starting with Docker Engine 29.0, containerd’s image store becomes the default storage backend on fresh installations. Docker explicitly documents this behavior: “The containerd image store is the default storage backend for Docker Engine 29.0 and later on fresh installations.” Docker containerd image store documentation Key points on Linux: Docker now delegates image and snapshot storage to containerd containerd uses its own content store and snapshotters Docker’s traditional data-root setting no longer controls all container storage Docker Engine v29 was released on 11 November 2025, and this behavior is by design, not a regression. Where Disk Usage Goes on Linux Docker’s daemon documentation clarifies the split: Legacy storage (pre‑v29 or upgraded installs): All data under /var/lib/docker Docker Engine v29 (containerd image store enabled): Images & snapshots → /var/lib/containerd Other Docker data (volumes, configs, metadata) → /var/lib/docker Crucially: “The data-root option does not affect image and container data stored in /var/lib/containerd when using the containerd image store.” Docker daemon data directory documentation This explains why OS disk usage continues to grow even when data-root is set to a data disk. Why the Old Configuration Worked Before On earlier Docker versions, Docker fully managed image and snapshot storage. Configuring: { "data-root": "/mnt/docker-data" } Was sufficient to redirect all container storage off the OS disk. With Docker Engine v29: containerd owns image and snapshot storage data-root only affects Docker‑managed data OS disk growth after upgrades or reimages is expected behavior This aligns fully with Docker’s documented design changes. Linux Workaround: Redirect containerd Storage To restore the intended behavior on Linux, keeping both Docker and containerd storage on the mounted data disk, containerd’s storage path must also be redirected. A practical workaround is to relocate /var/lib/containerd using a symbolic link. Example (Linux) sudo systemctl stop docker.socket docker containerd || true; sudo mkdir -p /mnt/docker-data /mnt/containerd; sudo rm -rf /var/lib/containerd; sudo ln -s /mnt/containerd /var/lib/containerd; echo "{\"data-root\": \"/mnt/docker-data\"}" | sudo tee /etc/docker/daemon.json; sudo systemctl daemon-reload; sudo systemctl start containerd docker' What This Does Stops Docker and containerd Creates container storage directories on the mounted data disk Redirects /var/lib/containerd → /mnt/containerd Keeps Docker’s data-root at /mnt/docker-data Restarts services with a unified storage layout This workaround is effective because it explicitly accounts for containerd‑managed paths introduced in Docker Engine v29, restoring the behavior that existed prior to the change. Key Takeaways Docker Engine v29 introduces a fundamental storage architecture change on Linux data-root alone is no longer sufficient OS disk growth after upgrades or reimages is expected containerd storage must also be redirected The workaround aligns with Docker’s official documentation and design References Docker daemon data directory https://docs.docker.com/engine/daemon/ containerd image store (Docker Engine v29) https://docs.docker.com/engine/storage/containerd/ Docker Engine v29 release notes https://docs.docker.com/engine/release-notes/29/ServiceEndpointProxy activity on ADO Service Connection
I have an ADO Service Connection which I don't think is being used by any pipelines but I still see regular entries in the usage history like: Type: ServiceEndpointProxy Details: ServicePrincipalSignInAudience I've not been able to find any information about what causes this. What is causing this activity and will deleting the service connection adversely affect anything assuming this is the only thing using it?Azure DevOps Test Plans Test retention - What influences setting back test outcome to Active?
Hey there, I just wanted to understand, what has an effect on the retention of the outcome of a test run. http:// https://learn.microsoft.com/en-us/azure/devops/test/how-long-to-keep-test-results?view=azure-devops#set-retention-period-for-test-results is explaining a setting for that. So, if I set the test retention setting „Days to keep..." to "Never delete" I'm expecting that the test outcome isn't touched after a specific time, right? Are there any other use cases which leads into setting the test outcome back to active automatically, like changing a requirement which is linked (tested by) to the test case? thxMicrosoft 365 business tenant blocked – AADSTS5000228 – sole Global Administrator
Please create a service request for a blocked Microsoft Entra tenant and escalate it to the Data Protection / Tenant Recovery Team. Tenant: valtechme.onmicrosoft.com Tenant ID: 80940ba0-e307-45b2-b5fd-05b9759a4594 Error: AADSTS5000228 I am the sole Global Administrator. I am posting this here, since getting microsoft support is almost impossible , via phone, email or web. Can someone please help me with this issue.
Azure VM resize: PowerShell lists Dv5 sizes, but Azure Portal only offers Dv4
Hello, We recently migrated two production Azure virtual machines away from the retiring Bv1 family. Initially, the VMs were running as: Standard_B2ms Standard_B4ms Our goal was to move them to a newer supported VM family. Environment Region: France Central Managed OS disks (one Standard SSD, one Standard HDD/Standard LRS) SCSI disk controller Windows Server virtual machines What we observed After stopping and deallocating the VM, we queried the available resize targets using PowerShell: Get-AzVMSize ` -ResourceGroupName "<ResourceGroup>" ` -VMName "<VMName>" For one VM, PowerShell returned, among others: Standard_D2ads_v5 Standard_D2ds_v5 Standard_D2d_v5 Standard_D2as_v4 Standard_D2ds_v4 For the other VM, it returned: Standard_D4ads_v5 Standard_D4ds_v5 Standard_D4d_v5 Standard_D4as_v4 However, when opening VM → Size in the Azure Portal, the v5 sizes were not available. Only the following sizes appeared: Standard_D2as_v4 Standard_D4as_v4 As a precaution, we resized both VMs using the sizes proposed by the Azure Portal: Standard_B2ms → Standard_D2as_v4 Standard_B4ms → Standard_D4as_v4 The migration completed successfully and both VMs are running correctly. Question Can someone explain why there is a difference between: the sizes returned by Get-AzVMSize, and the sizes displayed by the Azure Portal? More specifically: Does Get-AzVMSize return VM sizes that are not actually valid resize targets? Does the Azure Portal apply additional compatibility or capacity checks that PowerShell does not? Is this related to: regional capacity, VM generation, disk controller, managed disk type, host cluster, or another compatibility requirement? Would you recommend staying on Das_v4, or should we plan another migration to Dads_v5 if possible? I am trying to understand the reason behind the different behavior rather than forcing the resize through PowerShell. Thank you in advance for your insights.
Building Production-Ready Pipelines in Azure DevOps: Beyond the Documentation Examples
Hi everyone, When moving from basic Azure DevOps tutorials to enterprise production environments, we all quickly realize that documentation examples don't always cover real-world complexities. Handling multi-stage dependencies, keeping Terraform state secure, and managing secrets across environments requires a highly strategic approach. To help DevOps engineers bridge this gap, I recently put together a deep-dive architecture breakdown detailing how to build a resilient, multi-stage YAML pipeline from scratch. Here is a quick look at the core enterprise architecture I focus on: - Multi-Stage Lifecycle: Safe progression flows through Build, Dev, QA, UAT, and Production stages. - Infrastructure Automation: Clean integration with Terraform, including state and secrets management using Azure Key Vault. - Security Gates: Implementation of SAST scanning, Workload Identity, and automated approval policies. - Team Alignment: Connecting Azure DevOps with project tools like Asana to streamline cross-platform tracking. I wanted to share this pattern here to get some community feedback on the YAML structure. Before I post the full configuration snippets, I would love to hear how your teams handle environment gates and approvals. What are the biggest bottlenecks you run into with multi-stage YAML pipelines? Let's discuss in the comments below! Best regards, Abdullah ShahidAzure support team not responding to support request
I am posting here because I have not received a response to my support request despite my plan stating that I should hear back within 8 hours. It has now gone a day beyond that limit, and I am still waiting for assistance with this urgent matter. This issue is critical for my operations, and the delay is unacceptable. The ticket/reference number for my original support request was 2410100040000309. And I have created a brand new service request with ID 2412160040010160. I need this addressed immediately.
Recent Blogs
- This is the third post in our series on the Microsoft agent platform. We focus on the Run in Foundry pillar, taking agents from development to production with Hosted Agents, the Agent Optimizer, Rout...Aug 14, 2026
- 12 MIN READIn May, I introduced the open-source Azure Architecture Diagram Builder as a way to move from a natural-language prompt to an Azure architecture diagram, cost estimate, Well-Architected assessment, a...Aug 13, 2026
