Recent Discussions
ACS Teams interop meeting chat suddenly returns 403 Forbidden on all sends since late Aug 2026
Since approximately Aug 24, 2026, every Azure Communication Services (anonymous interop) user joining Microsoft Teams meetings in our tenant gets 403 Forbidden on ALL meeting chat operations, while calling, roster, and screen-share work normally. This broke suddenly with no changes on our side. The error on both ChatThreadClient.sendMessage and sendTypingNotification is "CommunicationError" Code "Forbidden", Message "The initiator doesn't have the permission to perform the requested operation." ACS users also receive no thread messages (Teams-native participants chat with each other fine in the same meeting), and the communication-react composite shows "You are no longer in this chat thread" immediately on join - so the ACS user appears to never be attached to the meeting chat thread, even though the call roster add works. What we have verified and ruled out - Reproduces with the minimal azure/communication-react (1.32.0) CallWithChatComposite quickstart and a freshly minted ACS identity (voip+chat scopes) - not our application. - Reproduces on BOTH Graph-app-created online meetings AND a meeting created by a human organizer in the Teams desktop app with default options. - Fails on chat api-versions 2024-06-05-preview and 2025-03-15. - All CsTeamsMeetingPolicy instances have MeetingChatEnabledType = Enabled (verified via Teams PowerShell as Global Admin). - ACS federation is configured. EnableAcsUsers = True and our ACS resource's immutable ID is in AllowedAcsResources. External access policies have EnableAcsFederationAccess = True. EnableExternalAccessRestrictionsForChatParticipants and EnableMutualFederationForChatParticipants are both False. - Per-meeting allowMeetingChat = enabled. Anonymous join allowed. BlockedAnonymousJoinClientTypes empty. - User is fully admitted and call state is Connected when sends fail (not the known join-timing issue), and the failure persists for the entire meeting. Sample failing request - POST to (resource).canada.communication.azure.com /chat/threads/19%3Ameeting_...%40thread.v2/messages?api-version=2025-03-15 returns 403, Ms-Cv IGMF4wkAI0+MIaxuFQ0kJw.0, 2026-08-31 16:04:38 UTC (Canada region resource). Was there a recent service-side change or rollout to how ACS interop users are added to Teams meeting chat threads, or a new tenant/meeting setting that now gates this? Is anyone else seeing this since late August 2026? We can share tenant ID, resource ID, and additional Ms-Cv values privately with Microsoft engineers. An Azure support case is also being opened in parallel. Also posted on Microsoft Q&A - https://learn.microsoft.com/en-us/answers/questions/5990218/acs-teams-interop-meeting-chat-suddenly-returns-40
Monitor a Hybrid computer shutdown in Azure Arc
Hi, I have created this alert to monitor when a Hybrid computer I have in Azure Arc is down. The computer is running but I am receiving emails. The query is not returning any values. I tried setting the threshold value to 1 but it did not work. Thank you!Who Can Access What? Designing RBAC and Identity in Azure
Who should be allowed to access an Azure resource? Azure makes it easy to create resources. The harder question comes afterwards: who should be allowed to access them? A Function App may need to read secrets from Key Vault. A Logic App may need to call APIs through API Management. A developer may need to deploy to Dev but have no access to Production. A CI/CD pipeline may need to deploy infrastructure without becoming an Owner of the entire subscription. This is where Azure Role-Based Access Control (RBAC) and Managed Identity become critical. In this article, I look at how to design access around people, applications and deployment pipelines, while keeping permissions as narrow as practical. The article covers: Azure RBAC and access scopes Least-privilege access Managed Identities Developer vs Production access boundaries Application identities CI/CD deployment permissions RBAC vs API authentication Privileged access and PIM Common RBAC design mistakes One of the key principles is simple: Give an identity only the permissions it actually needs. For example, if a Function App only needs to read secrets from Key Vault, giving it Contributor access to the entire Resource Group solves the problem with a much broader permission than necessary. Good RBAC design is not about assigning more permissions. It is about understanding: Who needs access? Why do they need it? What exactly do they need to do? At what scope should access be granted? How can that access be managed securely over time? I would be interested to hear how others approach RBAC and identity design in enterprise Azure environments. Full article: https://www.linkedin.com/pulse/who-can-access-what-designing-rbac-identity-azure-chethan-raj-ud6gc/Who Can Access What? Designing RBAC and Identity in Azure
Who should be allowed to access an Azure resource? Azure makes it easy to create resources. The harder question comes afterwards: who should be allowed to access them? A Function App may need to read secrets from Key Vault. A Logic App may need to call APIs through API Management. A developer may need to deploy to Dev but have no access to Production. A CI/CD pipeline may need to deploy infrastructure without becoming an Owner of the entire subscription. This is where Azure Role-Based Access Control (RBAC) and Managed Identity become critical. In this article, I look at how to design access around people, applications and deployment pipelines, while keeping permissions as narrow as practical. The article covers: Azure RBAC and access scopes Least-privilege access Managed Identities Developer vs Production access boundaries Application identities CI/CD deployment permissions RBAC vs API authentication Privileged access and PIM Common RBAC design mistakes One of the key principles is simple: Give an identity only the permissions it actually needs. For example, if a Function App only needs to read secrets from Key Vault, giving it Contributor access to the entire Resource Group solves the problem with a much broader permission than necessary. Good RBAC design is not about assigning more permissions. It is about understanding: Who needs access? Why do they need it? What exactly do they need to do? At what scope should access be granted? How can that access be managed securely over time? I would be interested to hear how others approach RBAC and identity design in enterprise Azure environments. Full article: https://www.linkedin.com/pulse/who-can-access-what-designing-rbac-identity-azure-chethan-raj-ud6gc/How Should You Structure Dev, UAT, Staging and Prod in Azure?
This is one of those decisions that can look simple at the beginning of a project and become increasingly important as the environment grows. Should each environment have its own Resource Group? Should Production have a separate Subscription? Where should shared services live? How should naming, tagging and CI/CD fit into the design? There isn't one universal answer. The right structure depends on factors such as security boundaries, ownership, lifecycle, deployment processes and operational requirements. In this article, I look at: Dev, UAT, Staging and Production environment boundaries Resource Groups vs Azure Subscriptions Production isolation Naming conventions Azure tagging CI/CD considerations Blue/Green deployment considerations Common environment architecture mistakes The main idea is that environment architecture should be designed around clear operational and security boundaries rather than simply creating more Resource Groups. I would be interested to hear how others structure Dev, UAT, Staging and Production in enterprise Azure environments. Full article: https://www.linkedin.com/pulse/how-should-you-structure-dev-uat-staging-prod-azure-chethan-raj-ktfac/How should Dev, UAT, Staging and Production be structured in Azure?
This is one of those decisions that can look simple at the beginning of a project and become increasingly important as the environment grows. Should each environment have its own Resource Group? Should Production have a separate Subscription? Where should shared services live? How should naming, tagging and CI/CD fit into the design? There isn't one universal answer. The right structure depends on factors such as security boundaries, ownership, lifecycle, deployment processes and operational requirements. In this article, I look at: Dev, UAT, Staging and Production environment boundaries Resource Groups vs Azure Subscriptions Production isolation Naming conventions Azure tagging CI/CD considerations Blue/Green deployment considerations Common environment architecture mistakes The main idea is that environment architecture should be designed around clear operational and security boundaries rather than simply creating more Resource Groups. I would be interested to hear how others structure Dev, UAT, Staging and Production in enterprise Azure environments. Full article: https://www.linkedin.com/pulse/how-should-you-structure-dev-uat-staging-prod-azure-chethan-raj-ktfac/
AADSTS5000228 - Locked Out of Trial Tenant
I created a free trial tenant, and was immediately locked out. Upon doing research, I basically discovered that the tenant is locked due to unknown reasons, and I have to contact support. I have tried calling 4 different support numbers a total of 8 times. I have never made it through the laughable automated phone system to a real person, I eventually get hung up on for no reason. I've tried creating chats from personal accounts to basically just be told to log in with my new tenant account and submit a ticket. I can't log in, I would love to be able to log in. I am at a loss for what to do. I can't open a case. I can't call a number. I can't log in. Does anyone have any advice on how to get this taken care of? At this point, I just want to cancel the tenant so when the auto-renew comes up, it doesn't charge my card.
Microsoft 365 business tenant blocked – AADSTS5000228 – sole Global Administrator
Please create a service request for a blocked Microsoft Entra tenant and escalate it to the Data Protection / Tenant Recovery Team. Tenant: valtechme.onmicrosoft.com Tenant ID: 80940ba0-e307-45b2-b5fd-05b9759a4594 Error: AADSTS5000228 I am the sole Global Administrator. I am posting this here, since getting microsoft support is almost impossible , via phone, email or web. Can someone please help me with this issue.Azure Virtual Desktop Regional host pools public preview open to all
Earlier this year we announced a public preview for a new type of host pool, referred to as a "Regional" host pool. This brings enhanced resiliency and increased options for data soverignty. Today we are expanding the public preview to everyone. A new drop down box called "Deployment Scope" will appear on the Basics tab of the Create a host pool deployment, when you choose a region that supports regional host pools in preview. At this point those regions are East US 2 and Central US. Further regions will be shortly added to provide even further choice. Ultimatley every Azure region where Azure Virtual Desktop is supported will be supported. Please deploy and connect to some new Regional host pools to test this functionality. Please refer to this blog post: https://techcommunity.microsoft.com/blog/azurevirtualdesktopblog/now-in-public-preview-azure-virtual-desktop-regional-host-pools/4474598 and the Microsoft Learn documentation: https://learn.microsoft.com/en-us/azure/virtual-desktop/regional-host-pools
Recording call reaching GA and recording audio, video and screen share into separate files
Hello, the recording call option in Azure Communication Services is currently in public preview. When will this feature reach GA? Is there any timeline or a roadmap with that info? Additionally, is there a way to create three separate recording files: one for recording audio only, the second one recording video only, the third one recording screen share only? Is there a way to record a camera feed from just a single participant (and ignoring the rest)? Thanks!Azure Virtual Desktop Application Group limit increase
We have increased the Azure Virtual Desktop limits to allow a higher number of Application Groups per tenant. We have doubled the limit to 1000 Application groups. This enable customers with a requirement for more app groups. Customers wishing for more than 1000 will still need to open a support ticket to get this reviewed All Azure Virtual Desktop limits are documented in the full Azure subscription and service limits, quotas, and constrains document: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limitsHow to setup customer to obtain AADB2C token for an API exposed through APIM
I am setting up Azure APIM instance behind a Azure Application gateway. Developer portal will be exposed so external customers will be able to subscribe to products containing the APIs and obtain the subscription key that way. There will be approvals required for subscription. I want to setup OIDC on top of the subscription key validation. For that I believe I have to setup a Validate JWT policy on the API in APIM, using this guide below and use scopes/roles:- https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy And seems like I will have to setup client credentials flow for customers to be able to obtain token from AADB2C, using the below KB:- https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy Q1 - Firstly, is that the correct way of setting it up? Secondly, with client credentials flow seems like customers will have to use the POST request (or PowerShell) like the one below to obtain the token:- https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy>/oauth2/v2.0/token But this will mean that I will have to document my B2C token endpoint in Developer portal documentation to advise customers on how to obtain token. I have 2 questions related to that:- Q2 - Is advising/advertising B2C token endpoint good practice from security point of view? Q3 - With client credentials flow, setting up the calling app APP Registration in B2C and providing related APP secret will become a manual process. This will remove the benefit of having Product/API subscriptions process automated through APIM and bring in the complexity of securely communicating the secret to customers. Is there a better way of doing this?Business Central: Slow Change Dimension
Hi folks, I need to apply a Slowly Changing Dimension (SCD) using Azure Databricks with data from an on-premise Business Central database. I want to build a medallion architecture. I am bringing the tables to the bronze level by selecting data incrementally using the field _systemModifiedAt. For building the silver level, I want to perform a Merge using the field _systemId. Is this possible? Specifically, is _systemId a unique identifier for every record in all the tables of Business Central, allowing me to apply a Merge for SCD? When a record changes in Business Central, does it produce a new record in the database table with the same _systemId but with updated information? Many thanks! Jorge.Improper AVD Host Decommissioning – A Practical Governance Framework
Hi everyone, After working with multiple production Azure Virtual Desktop environments, I noticed a recurring issue that rarely gets documented properly: Improper host decommissioning. Scaling out AVD is easy. Scaling down safely is where environments silently drift. Common issues I’ve seen in the field: Session hosts deleted before drain completion Orphaned Entra ID device objects Intune-managed device records left behind Stale registration tokens FSLogix containers remaining locked Defender onboarding objects not cleaned Host pool inconsistencies over time The problem is not technical complexity. It’s lifecycle governance. So I built a structured approach to host decommissioning focused on: Drain validation Active session verification Controlled removal from host pool VM deletion sequencing Identity cleanup validation Registration token rotation Logging and execution safety I’ve published a practical framework here: The framework is fully documented and includes validation logic and logging. https://github.com/modernendpoint/AVD-Host-Decommission-Framework The goal is simple: Not just removing a VM — but preserving platform integrity. I’m curious: How are you handling host lifecycle management in your AVD environments? Fully automated? Manual? Integrated with scaling plans? Identity cleanup included? Would love to hear how others approach this. Menahem Suissa AVD | Intune | Identity-Driven ArchitectureI built an open-source tool for running ARG governance checks on a schedule and tracking findings
Most of the Azure governance work I have done over the last ten years ended the same way. Someone writes a sharp Resource Graph query, it finds something real, it gets pasted into a chat, and then it lives in that person's terminal history until they move on. The failure that costs more is quieter. A check that stops running does not turn red. It stays green, and the estate keeps drifting behind a number that nobody has any reason to distrust. Disclosure before I name anything: I built the tool below and I maintain it. RuleBeat runs the governance checks your team writes for Azure on a schedule, tracks every finding over time, and never holds write access. A check is a rule you author against Azure Resource Graph or Microsoft Graph, in a visual builder or as raw KQL. It ships 158 checks out of the box, 15 built-in rules plus the 143-rule APRL pack. Findings keep their lifecycle across scans, so they move through new, active and fixed and reopen on their own, and a suppression needs a reason and can carry an expiry date. The trade-offs, so nobody has to discover them after installing: - Read-only, permanently. It never holds write credentials and never creates its own service principal. You create the credential, so you can see in Azure RBAC exactly what it was granted. The cost is real: there is no one-click fix. Remediation stays your action under your own identity. - Self-hosted, one container, SQLite inside. Nothing about your tenant leaves your deployment and there is no telemetry. The cost is that you run it. Demo mode runs the real UI over a generated database with no Azure credential, if you would rather look before wiring anything up. - Honest numbers. A rule that has never run, or whose last run failed, is reported as unknown rather than passing. The posture number is uglier for it, and that is the point. On where this does and does not belong next to the native stack: Azure Policy is for enforcing a standard, and it does that better than anything I would write. Defender for Cloud covers its own scope well. If your assignments are enforcing, your Workbook answers the question you actually ask, and one person owns the whole loop, you do not need this. Where I kept running out of road was the organization-specific check that no built-in standard covers, and the question of who owns a flagged row once more than one person has to care about it. It is open source under Apache-2.0 and free, and it is v0.2, early on purpose. I build it with AI assistance from Claude, which the public commit history shows in the co-author trailers, and every change is human-reviewed and gated by the test suite in CI before it ships. Repo: https://github.com/rulebeat/rulebeat Docs: https://docs.rulebeat.com The question I would rather ask than answer: for those of you running recurring governance checks today, what do you do with a finding that is accepted on purpose? Every version of this I have seen was a tag, a wiki page, or a spreadsheet, and all three drift away from the query that produced them. I would like to know what has actually held up for you.App using node-fetch as agent
A few days ago, I was looking into a user's sign in logs. I noticed an application called Augmentation Loop with the user agent as node-fetch/1.0 (+https://github.com/bitinn/node-fetch). Looking into the Augmentation Loop, it is part of apps included in Conditional Access Office 365 app suite. (https://learn.microsoft.com/en-us/entra/identity/conditional-access/reference-office-365-application-contents) According to this site (https://petri.com/microsoft-revamps-outlook-one-outlook-vision/), it is a way of coordinating all the various types of data and services consumed by Outlook. From what I can see, Augmentation Loop sign ins are always in between Microsoft Office sign ins: I tried referencing the app ID (4354e225-50c9-4423-9ece-2d5afd904870) to the Azure app ID list (https://learn.microsoft.com/en-us/microsoft-365-app-certification/azure/azure-apps), however, it is not there. I also tried searching through Azure admin all applications and it is also not there. Google search doesn't also return anything. May someone please explain what application or service is using the node-fetch agent?
[Thread X] Problem auto-filling thread stack
Hi, First of all, sorry for my english! I am making a degree project in which I am using Thread X and It is my first time working with Azure RTOS. It took me a long time to understand how Thread X and Trace X worked. If I am not wrong, Thread X has a system thread called System Timer Thread that contains the "_tx_thread_priority_list" list whitin its stack. This list allocates the threads that are ready at a specific priority. Well, there is an option in Thread X which allows to check the stack size in run-time and it gets enabled with the flag "TX_ENABLE_STACK_CHECKING". However, within this option appears another one that specifies if you want to initialize the stack with constants values during a thread creation in order to check how many stack memory has been used. The problem is when the creation process calls "tx_thread_system_resume()" function and this one checks whether there already was an element in the corresponding entry of the "_tx_thread_priority_list". For that, it compares the value of that element with "TX_NULL" - that equals to 0. If we had the filling stack option enabled, we will be comparing a fake element - composed by 0xEF EF EF EF - whit 0, thus the comparison will be false provoking a Hard Fault, since we will be trying to access to an illegal memory position. The solution is simple: define TX_DISABLE_STACK_FILLING flag. Is this problem a bug? Or have I made a previous mistake? Regards, Óscar
Recent Blogs
- 4 MIN READCloud environments can generate large volumes of application, infrastructure, audit, and platform logs. Moving eligible tables to the Basic or Auxiliary table plan can help control costs while keepin...Sep 03, 2026
- Opening scene: a three-minute bug fix that is still unsafe for an enterprise ByteCraft AI is a four-person startup. Maya is the co-founder and AI engineer, Arun leads product, Ethan owns the platfo...Sep 03, 2026
