Recent Discussions
App using node-fetch as agent
A few days ago, I was looking into a user's sign in logs. I noticed an application called Augmentation Loop with the user agent as node-fetch/1.0 (+https://github.com/bitinn/node-fetch). Looking into the Augmentation Loop, it is part of apps included in Conditional Access Office 365 app suite. (https://learn.microsoft.com/en-us/entra/identity/conditional-access/reference-office-365-application-contents) According to this site (https://petri.com/microsoft-revamps-outlook-one-outlook-vision/), it is a way of coordinating all the various types of data and services consumed by Outlook. From what I can see, Augmentation Loop sign ins are always in between Microsoft Office sign ins: I tried referencing the app ID (4354e225-50c9-4423-9ece-2d5afd904870) to the Azure app ID list (https://learn.microsoft.com/en-us/microsoft-365-app-certification/azure/azure-apps), however, it is not there. I also tried searching through Azure admin all applications and it is also not there. Google search doesn't also return anything. May someone please explain what application or service is using the node-fetch agent?
[Thread X] Problem auto-filling thread stack
Hi, First of all, sorry for my english! I am making a degree project in which I am using Thread X and It is my first time working with Azure RTOS. It took me a long time to understand how Thread X and Trace X worked. If I am not wrong, Thread X has a system thread called System Timer Thread that contains the "_tx_thread_priority_list" list whitin its stack. This list allocates the threads that are ready at a specific priority. Well, there is an option in Thread X which allows to check the stack size in run-time and it gets enabled with the flag "TX_ENABLE_STACK_CHECKING". However, within this option appears another one that specifies if you want to initialize the stack with constants values during a thread creation in order to check how many stack memory has been used. The problem is when the creation process calls "tx_thread_system_resume()" function and this one checks whether there already was an element in the corresponding entry of the "_tx_thread_priority_list". For that, it compares the value of that element with "TX_NULL" - that equals to 0. If we had the filling stack option enabled, we will be comparing a fake element - composed by 0xEF EF EF EF - whit 0, thus the comparison will be false provoking a Hard Fault, since we will be trying to access to an illegal memory position. The solution is simple: define TX_DISABLE_STACK_FILLING flag. Is this problem a bug? Or have I made a previous mistake? Regards, Óscar
EntraID portal UI updates affecting visibility of proxy addresses
I have an open support case (TrackingID#2608010010000071) but the support engineer also recommended I post here. A recent update to the EntraID portal UI has implemented a stylesheet with a really tight rendering box around the list of proxy addresses that can be viewed from the flyout panel on an identity's account. The result is proxy addresses are being truncated after just a few characters making it very difficult to view the list of valid email aliases for an identity. I've confirmed, using DevTools to inspect the source data, that the full addresses are being sent to the client. It is the tight rendering box (120 pixels) that is causing the truncated display. If I override the style sheet to use a larger "width" value I can force the display of the entire proxy address.
Syncing Multiple Azure DevOps Orgs to One ServiceNow Instance Without Forcing a Shared Workflow
If your organization runs more than one Azure DevOps org, whether from an acquisition, a spun-up subsidiary, or business units that never consolidated onto one instance, you already know the visibility gap. Central ServiceNow has no idea what's happening in any of them unless someone checks manually. Your team ends up pulling status updates by hand, chasing changes across orgs, and reconciling what got closed where. That works well for a couple of orgs, but it falls apart past that. Why a Shared Workflow Usually Creates a Bigger Problem Migrating everyone onto a single Azure DevOps org would close the visibility gap on paper. Each org's area paths, iterations, states, and processes took years to get right, and a forced migration undoes all of it. A sync layer between each Azure DevOps org and your central ServiceNow instance closes the same gap without touching how any individual org works day to day. Each org keeps its own configuration. ServiceNow ends up with a rolled-up view across all of them. Common Use Cases Post-Acquisition Org Sprawl Current Setup: A company acquires another company, or runs several business units, each with its own Azure DevOps org and its own way of working. Problem: Central ops has no single view across orgs, and checking each one by hand doesn't scale past a few teams. Solution: Connect each Azure DevOps org to the central ServiceNow instance separately, each with its own sync rules. ServiceNow gets one rolled-up view, and no org has to change how it works. Bi-Directional Status Sync Between Delivery and Support Current Setup: Support logs incidents in ServiceNow. Development tracks the corresponding work in Azure DevOps, sometimes across several orgs. Problem: Support has to ask developers for status or check Azure DevOps boards directly, and developers end up relaying the same update twice. Solution: Sync status, comments, and priority both ways, so an update in either system shows up automatically on the other side. Field-Level Control Per Org Current Setup: Each business unit or subsidiary has its own rules about what data can leave its Azure DevOps org. Problem: A single shared integration with one set of mapping rules risks exposing fields an org never agreed to share outside its own boundary. Solution: Give each org's connection its own outgoing rules, so a subsidiary decides exactly which fields leave its Azure DevOps org, field by field. Handling Closed and Read-Only Work Items Current Setup: ServiceNow blocks writes to closed incidents through ACLs, and Azure DevOps can hit a similar restriction on closed or read-only work items. Problem: A sync that keeps trying to write to a closed item throws the same error repeatedly, and the real problems get buried under the noise. Solution: Filter closed and read-only states out of the sync, or let the errors surface if operations wants visibility into them. What to Evaluate When Choosing an Approach A few criteria matter more than others once you're running this across multiple orgs. Decentralized configuration: does each Azure DevOps org get its own connection and its own rules, or does everything route through one shared setup? Filtering: can you scope the sync with something like WIQL queries on the Azure DevOps side, by area path, iteration, work item type, or tag? Field mapping: does it handle the difference between ServiceNow's field structure and Azure DevOps work item fields without dropping data? Common pairs are ServiceNow State to Azure DevOps State, ServiceNow Priority to Azure DevOps Priority, and ServiceNow Assignment Group to Azure DevOps Area Path. Custom fields usually need explicit mapping rules. Conflict handling: what happens when both sides update the same field at the same time, and what happens with closed or read-only items specifically? Security: Entra ID or OAuth authentication, PAT management per org, role-based access, audit logging, and whatever compliance certifications your security team asks for during review. Direction: bidirectional where both teams update shared fields, one-way where only one side should ever write. Technical Approaches Service Hooks and REST APIs Azure DevOps Service Hooks paired with the ServiceNow REST API give you sync in both directions. A change in Azure DevOps triggers a Service Hook, which calls the ServiceNow API to update the record, and the same flow runs in reverse. This is the most direct route if you're comfortable building and maintaining the webhook logic yourself. Custom Middleware For anything more complex, custom middleware gives you full control over field transformation, routing, and error handling. Azure Functions, Logic Apps, or a small Node.js or Python service usually does the job. The trade-off is maintenance. You own the retry logic, the error handling, and every update when either platform changes its API. Dedicated Integration Platforms Plenty of teams skip building this from scratch and use a dedicated integration platform instead. These typically come with pre-built connectors for both Azure DevOps and ServiceNow, a way to configure field mapping and filters without writing much code, and managed infrastructure so you're not hosting your own sync server. What they usually cover: Pre-configured connectors that already understand both platforms' data structures Visual or scripting configuration for field mapping and filters Managed infrastructure, so nothing runs on your own servers Built-in retry and error handling for API failures Audit logging for tracking what synced and when Support for multi-org routing and conditional logic out of the box The trade-off runs the other way: a subscription cost instead of a one-time build, less control over the exact implementation, and your data passing through a third party's infrastructure. For teams running more than 2 or 3 orgs against one ServiceNow instance, this usually ends up being less overhead than maintaining custom middleware long-term. Every org here has probably solved a version of this differently. Curious what's worked for you, especially with 3 or more Azure DevOps orgs feeding into one ServiceNow instance, and which part of the setup gave you the most trouble.Azure Networking: Request for Granular Control of “Allow Azure Services and Resources”
I would like to get the Azure community’s thoughts on a networking/security improvement that I believe could help organizations implement a stronger least-privilege model. Several Azure resources provide an option similar to: “Allow Azure services and resources to access this resource.” This is useful when an Azure service needs to access another Azure resource, but the current option can be quite broad. Example: Power BI → Azure SQL For example, suppose Power BI Service needs to access an Azure SQL Server. The actual requirement might be: Power BI → Specific Azure SQL Server = Allow However, the available option may require enabling: “Allow Azure services and resources to access this server” This effectively creates a much broader trusted-service exception than the actual requirement. Ideally, I would like to see something like: Azure SQL Server │ ├── Power BI Service → Allow ├── Azure Data Factory → Deny ├── Azure Functions → Deny ├── Azure App Service → Deny └── Other Azure Services → Deny Proposed improvement Could Microsoft provide an additional option such as: “Allow selected Azure services and resources” where customers can explicitly select which Azure service/resource is allowed to bypass the network restriction? Depending on the Azure service, the selection could potentially be based on: Specific Azure service Specific Azure resource Resource ID Subscription Resource group Tenant Managed identity / Entra identity Specific service instance For example: Trusted Azure Services / Resources Power BI → Production Analytics → Allow All other Azure services → Deny Why I think this would be useful This would give customers a middle ground between: Disabling public access and implementing Private Endpoint/private connectivity, or Allowing all Azure services/resources through the broad trusted-service exception. A granular trusted-service model would allow: Only the Azure service/resource that actually requires access is trusted. This would better support least privilege, Zero Trust, security, and compliance requirements. Broader Azure applicability My suggestion is not specifically for Azure SQL. The Power BI → Azure SQL scenario is just an example. I think this could be a common Azure networking capability for all Azure resources that currently support a trusted Azure services / “Allow Azure services and resources” type of bypass. I would be interested to hear from the Azure community and Microsoft: Is there already a way to achieve this level of granularity? Are there architectural/security reasons why this cannot currently be implemented? Is Microsoft considering a more granular trusted-service model? Would a feature like “Allow selected Azure services/resources” be technically feasible? I would appreciate any feedback or guidance from the Azure networking/service teams.
Setup of FinOps Toolkit
OK, so I've deployed the toolkit, setup the exports on an MCA account with 9x billing profiles, created FOCUS + Price Sheet exports for each billing profile followed by reservation details, transactions and recommendations for each billing profile. Where it's failing for me is that I try to run the msexports_ExecuteETL and msexports_ETL_ingestion and it prompting me for msexports_ETL_ingestion: blobPath destinationFile destinationFolder ingestionId schemaFile exportDatasetType exportDatasetVersion msexports_ExecuteETL: folderPath fileName What should these value be? Also we are currently migrating from EA agreement, to MCA, on the Cost Management Exports I can't see the subscription residing in the MCA agreement and therefore can't select the storage account in there to export to, why might that be?From Doubt to Victory: How I Passed Microsoft SC-200
Hey everyone! I wanted to share my journey of how I went from doubting my chances to successfully passing the Microsoft SC-200 exam. At first, the idea of taking the SC-200 seemed overwhelming. With so many topics to cover, especially with the integration of Microsoft security technologies, I wasn’t sure if I could pull it off. But after months of studying and staying consistent, I finally passed! 🎉 Here’s what worked for me: Study Plan: I created a structured study schedule and stuck to it. I broke down each section of the exam objectives and allocated time for each part. Authentic Exam Questions: I used it-examstest for practice exams. Their realistic test format helped me get a good grasp of the exam pattern. Plus, the explanations for the answers were super helpful in understanding the concepts. Practice Exams: I did multiple mock tests. Honestly, they helped me more than I expected! They boosted my confidence, and I could pinpoint areas where I needed to improve. SC-200 Study Materials: I relied on a combination of online courses, books, and video resources. Watching the study videos and taking notes helped me retain the information better. Don’t Cram: I didn’t leave things to the last minute. It took me about 2-3 months of consistent study to get comfortable with the material. I made sure to take breaks and not burn myself out. Passing this exam felt amazing! If you're in the same boat and feeling uncertain, just stick with it! It’s a challenging exam, but with the right tools and preparation, you can do it. Keep pushing forward, and good luck to everyone! 💪 Would be happy to answer any questions if anyone has them!Start Azure V2 VMs Azure Automation Graphical PowerShell runbook - Best solution to replace
Hello! Hope you all are doing great. Currently, we are encountering a challenge in our Azure environment with a need to transition from deprecated RunAs Accounts to Managed Identity for our Automation Account runbooks. We have successfully deployed the "Start Azure V2 VMs Azure Automation Graphical PowerShell" runbook (refer: https://github.com/azureautomation/start-azure-v2-vms) in our environment. It is configured with numerous schedules for various VMs. Although we have adjusted the 'Connect to Azure' graphical interface section, it appears that the runbook continues to utilize the RunAs Account connection in other areas. I'm struggling to find an effective way to modify this. Moreover, the commands executed by the runbook are based on the AzureRM module, which is slated for deprecation soon. I am reaching out to solicit your guidance on the following queries: Is there an efficient and standard method to transition these runbooks from using RunAs Accounts? How can we effectively convert the AzureRM code in the graphical sections to the Az Module? Is there an alternate, perhaps newer, method to schedule VM start and stop in Azure that we should consider migrating to? Thank you in advance for your assistance and insight on this matter. Looking forward to your recommendations. Best regards,Three Cloud Myths I Believed Before Studying Azure Fundamentals
While preparing for AZ-900, I realized that several assumptions I had about cloud computing were incomplete. ☁️ Myth 1: The cloud is always cheaper Cloud services can reduce upfront costs, but unused resources, incorrect sizing, and poor planning can quickly increase the bill. 🖥️ Myth 2: The cloud means there are no servers The physical infrastructure still exists. What changes is how much of it is managed by the cloud provider. ⚙️ Myth 3: More control is always better Additional control also means additional responsibility for patching, monitoring, configuration, security, and maintenance. My biggest takeaway was that cloud computing is not automatically cheaper, simpler, or better. It is about finding the right balance between cost, control, responsibility, and speed. For beginners interested in exploring these concepts, Microsoft Learn provides an official learning path: https://learn.microsoft.com/en-us/training/courses/az-900t00?wt.mc_id=studentamb_615882 Which cloud misconception did you believe when you first started learning?
Azure VMs host (platform) metrics (not guest metrics) to the log analytics workspace ?
Hi Team, Can some one help me how to send Azure VMs host (platform) metrics (not guest metrics) to the log analytics workspace ? Earlier some years ago I used to do it, by clicking on “Diagnostic Settings”, but now if I go to “Diagnostic Settings” tab its asking me to enable guest level monitoring (guest level metrics I don’t want) and pointing to a Storage Account. I don’t see the option to send the these metrics to Log analytics workspace. I have around 500 azure VMs whose host (platform) metrics (not guest metrics) I want to send it to the log analytics workspace.Windows App - you can't get there from here
Hi, Since moving to Windows App (The issue did not occur on the old Remote Desktop client), users when they come to do the 90 day forced SSPR (Company policy), it pops up with a message that you can't get there from here, its been baffling us for a while. However in the non-interactive log, it shows Windows App is instigating Microsoft Graph to do the password reset, and this shows as being blocked, we have excluded Azure Virtual Desktop client etc from the policy but you cannot exclude graph, like I said it seems the old Remote Desktop client didn't use Microsoft Graph to do this, but Windows App does. The only workaround we have is for the user to select sign out and sign in with a different account with the same credentials (Not ideal and it causing tickets to be raised) this method does not seem to use Microsoft Graph then, they have asked if they can go back to the old Remote Desktop Client which did not have the issue. Anyone else come across this or any permeant solution? ThanksFound inconsistencies in the Address Autocomplete API results between Bing Maps and Azure Maps
Hi Team, We are currently in the process of upgrading our application from Bing Maps to Azure Maps. As part of this migration, we are evaluating the Azure Maps Address Autocomplete API to ensure it provides functionality comparable to our existing Bing Maps implementation. During our evaluation, we observed several inconsistencies in the https://samples.azuremaps.com/rest-services/autocomplete API results between Bing Maps and Azure Maps, particularly for addresses in India. and would appreciate your assistance in investigating these issues. As part of our testing, we searched for below address: Everest Nivara Infotech Park Mumbai International Airport IIT Bombay The address is correctly returned in the Bing Maps portal: https://www.bing.com/maps However, when performing the same search using the https://samples.azuremaps.com/rest-services/autocomplete, the expected address is either not returned or is displayed incorrectly. Additionally, we observed that business (POI) addresses are not being returned by the Azure Maps Address Autocomplete service. As part of our testing, we searched famous place name in the Address Autocomplete sample. The business was not returned in the autocomplete suggestions, even though it is searchable in the Bing Maps portal. We would appreciate your guidance on resolving these issues. Thanks!Azure Files Manage Access is missing
Good day, We have fully and correctly configured an Azure File Share and the associated permissions. All required Azure RBAC roles as well as the necessary data plane permissions are assigned. However, we are observing inconsistent behavior in the Azure Portal regarding the “Manage access” buttons: At times, the “Manage access” buttons are visible: - In the top menu bar of the file share - In the context menu (three‑dot menu) of individual directories At other times, these buttons are not displayed at all, even though: - The same user with the same permissions is used - The same storage account and the same file share are accessed The behavior is sporadic and not reproducible in a controlled manner. Already verified: Required Azure RBAC roles are assigned Required permissions for Azure Files are correctly configured Permissions are effective and functional No error messages are shown in the Azure Portal when the buttons are missing A screenshot showing the state when the functionality was working is here. We would appreciate your support in investigating this issue.What would be the expected behavior for an NSP?
I'm using a network security perimeter in Azure. In the perimeter there are two resources assigned: A storage Account and An Azure SQL Databse. I'm using the BULK INSERT dbo.YourTable FROM 'sample_data.csv' getting data from the storage account. The NSP is enforced for both resources, so the public connectivity is denied for resources outside the perimeter I have experienced this behavior: the azure SQL CANNOT access the storage account when I run the command. I resolved using: I need to add an outbound rule in the NSP to reach the storage fqdn I need to add an inbound rule in the NSP to allow the public IP of the SQL Azure When I do 1 and 2, azure SQL is able to pump data from the storage. IMHO this is not the expected behavior for two resources in the NSP. I expect that, as they are in the same NSP, they can communicate to each other. I have experienced a different behavior when using keyvault in the same NSP. I'm using the keyvault to get the keys for encryption for the same storage. For the key vault, i didn't have to create any rule to make it able to communicate to the storage, as they are in the same NSP. I know, Azure SQL is in preview for the NSP and the keyvault in GA, but I want to ask if the experienced behavior (the SQL CANNOT connect to the storage even if in the same NSP) is due to a unstable or unimplemented feature, or I'm missing something? What is the expected behavior? Thank you community!!
Events
in 2 days
Learn how to find, try, and purchase the best solutions for your business. From intelligent discovery to flexible purchasing options, Microsoft Marketplace can help you discover and compare options, ...
Online
Recent Blogs
- 4 MIN READIntroduction Large Azure hub-and-spoke environments can advertise a significant number of routes toward on-premises networks. By default, Azure VPN Gateway and ExpressRoute Gateway advertise the ad...Aug 28, 2026
- This is the August round-up for the Foundry Toolkit for VS Code. Four releases shipped this month: 1.6.7, 1.6.8, 1.6.9, and 1.6.10. August was about turning agent development into a workflow you ca...Aug 28, 2026
