Forum Widgets
Latest Discussions
Azure User Expresses Concern
A customer opened ticket SR#2407190040010082 as their consumption sku APIM service was stuck updating: Now that the service has exited that "updating" status I am able to resume working with it. The concern I want to share with you is my concern with how the system responds to a certificate error and gets stuck in that "updating" state. We know that network and login activities can fail on occasion. When APIM responds by getting stuck in that state it cannot be updated and it cannot be deleted and recreated. This issue lasted for a day before APIM eventually emerged from that state for reasons I am unaware. I was powerless and had to keep going back to check. Yes, this case is resolved but I hope that this feedback can be shared with the team in the hopes that a fix or enhancement to better handle this situation can be implemented.
How Do You Handle Multiple Server Certificate Thumbprints in Azure Service Fabric Managed Clusters?
Hi everyone, I wanted to share a common challenge we’ve encountered in DevOps pipelines when working with Azure Service Fabric Managed Clusters (SFMC) — and open it up for discussion to hear how others are handling it. 🔍 The Issue When retrieving the cluster certificate thumbprints using PowerShell: (Get-AzResource -ResourceId "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.ServiceFabric/managedclusters/<CLUSTER_NAME>").Properties.clusterCertificateThumbprints …it often returns multiple thumbprints. This typically happens due to certificate renewals or rollovers. Including all of them in your DevOps configuration isn’t practical. ✅ What Worked for Us We’ve had success using the last thumbprint in the list, assuming it’s the most recently active certificate: (Get-AzResource -ResourceId "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.ServiceFabric/managedclusters/<CLUSTER_NAME>").Properties.clusterCertificateThumbprints | Select-Object -Last 1 This approach has helped us maintain stable and secure connections in our pipelines. 🔍 Solution 2: Get current Server Certificate You can also verify the active certificate using OpenSSL: openssl s_client -connect <MyCluster>.<REGION>.cloudapp.azure.com:19080 -servername <MyCluster>.<REGION>.cloudapp.azure.com | openssl x509 -noout -fingerprint -sha1 🛠️ Tip for New Deployments If you're deploying a new SFMC, consider setting the following property in your ARM or Bicep template: "autoGeneratedDomainNameLabelScope": "ResourceGroupReuse" This ensures the domain name is reused within the resource group, which helps reduce certificate churn and keeps the thumbprint list clean and manageable. ⚠️ Note: This setting only applies during initial deployment and cannot be retroactively applied to existing clusters.Guidance for Certificate Use in CI/CD Pipelines for Service Fabric
In non-interactive CI/CD scenarios where certificates are used to authenticate with Azure Service Fabric, consider the following best practices: Use Admin Certificates Instead of Cluster Certificates Cluster certificates are used for node-to-node and cluster-level authentication and are highly privileged. For CI/CD pipelines, prefer using a dedicated Admin client certificate: Grants administrative access only at the client level. Limits the blast radius in case of exposure. Easier to rotate or revoke without impacting cluster internals. Best practices to protect your service fabric certificates: - Provision a dedicated Service Fabric Admin certificate specifically for the CI/CD pipeline instead of cluster certificate. This certificate should not be reused across other services or users. - Restrict access to this certificate strictly to the pipeline environment. It should never be distributed beyond what is necessary. - Secure the pipeline itself, as it is part of the cluster’s supply chain and a high-value target for attackers. - Implement telemetry and monitoring to detect potential exposure—such as unauthorized access to the CI/CD machine or unexpected distribution of the certificate. - Establish a revocation and rotation plan to quickly respond if the certificate is compromised.
Azure Web App Easy Auth using Reverse Proxy
My organization manages one single endpoint which must be used to expose web application; e.g. https://contoso.com/app_one/ We deployed an app in az web apps with Azure AD Easy Auth. (not accesible from the internet and no custom domain). https://app-one.azurewebsites.net Our app registration has this callback: https://contoso.com/app_one/https://uat.p.api.ey.com/eyvirtual/services/api/webhook/wc/v1/login/aad/callback,https://ussxnxt1676913262azf03-webhook.azurewebsites.net/.auth/login/aad/callback When i try to open any the app using https://contoso.com/app_one/, the browser recirects to Azure Login page, but it redirects back to https://app-one.azurewebsites.net instead of going to the public website https://contoso.com/app_one/ Our reverse proxy user Azure APIM. Question is: how can i make Azure Web App to redirect to public endpoint instead of the azurewebsite endpoint? Thanks.
Error "RequestDisallowedByPolicy" received while deploying arm template
I'm trying to deploy an ARM template, but facing error "Resource 'example' was disallowed by policy. (Code: Request Disallowed By Policy)". Can anyone help what changes i can make in my ARM template so that the resource gets deployed successfully.Downtime of API Management during deployment
Which actions will cause a downtime of Azure API Management so APIs will not be able to consume (Premium Tier)? E.g. changing network would be obviously. But what about deployments of APIs, Products, Scaling up and down... How can I find out which actions will make the APIs unavailable? Or is there a mechanism which will keep them available in each scenario (Even if "Service is being updated")? Thanks!
Does Azure provide DDoS protection for its PaaS services?
Hi, I am working on a project wherein we will deploy Storage Account, KeyVault, ServiceBus, CosmosDB, and SQL DB in our subscription. All these services will be deployed with public access enabled, and we will only add private endpoints for local VNet traffic. From a security perspective, should I explicitly add DDoS protection to the above-mentioned services, or do they come with built-in DDoS protection? Example: Would a DDoS attack be able to bring down a Storage Account Blob Service (test.blob.core.windows.net)?Azure Cache for Redis
Hello, I am trying to optimize the cost for Azure Cache for Redis. Right now i have an E100 sku deployed and checking if there is a possibility to right size the instance to a lower tier. I checked the utilization metrics and could find low CPU, memory and low server load. However i am struggling to understand the metrics for the connected clients as this is one of the important criteria for rightsizing. Can someone please tell me if i need to look the MAX or SUM aggregation for connected clients? As per azure pricing E100 include upto 100,000 connection but i would like to understand if it is concurrent connection during a month or summation of all connection during a month. Can someone please help me to understand this?
