Azure topics

Why is Azure???

Dravidan — Mon, 31 Aug 2026 19:03:44 GMT

Why is Azure the best choice compared with other public cloud platforms such as AWS and Google Cloud?

EntraID portal UI updates affecting visibility of proxy addresses

GMulhern — Thu, 27 Aug 2026 18:17:19 GMT

I have an open support case (TrackingID#2608010010000071) but the support engineer also recommended I post here. A recent update to the EntraID portal UI has implemented a stylesheet with a really tight rendering box around the list of proxy addresses that can be viewed from the flyout panel on an identity's account. The result is proxy addresses are being truncated after just a few characters making it very difficult to view the list of valid email aliases for an identity.

I've confirmed, using DevTools to inspect the source data, that the full addresses are being sent to the client. It is the tight rendering box (120 pixels) that is causing the truncated display. If I override the style sheet to use a larger "width" value I can force the display of the entire proxy address.

Syncing Multiple Azure DevOps Orgs to One ServiceNow Instance Without Forcing a Shared Workflow

tejabhutada — Thu, 27 Aug 2026 03:21:03 GMT

If your organization runs more than one Azure DevOps org, whether from an acquisition, a spun-up subsidiary, or business units that never consolidated onto one instance, you already know the visibility gap. Central ServiceNow has no idea what's happening in any of them unless someone checks manually.

Your team ends up pulling status updates by hand, chasing changes across orgs, and reconciling what got closed where. That works well for a couple of orgs, but it falls apart past that.

Why a Shared Workflow Usually Creates a Bigger Problem

Migrating everyone onto a single Azure DevOps org would close the visibility gap on paper. Each org's area paths, iterations, states, and processes took years to get right, and a forced migration undoes all of it.

A sync layer between each Azure DevOps org and your central ServiceNow instance closes the same gap without touching how any individual org works day to day. Each org keeps its own configuration. ServiceNow ends up with a rolled-up view across all of them.

Common Use Cases

Post-Acquisition Org Sprawl

Current Setup: A company acquires another company, or runs several business units, each with its own Azure DevOps org and its own way of working.

Problem: Central ops has no single view across orgs, and checking each one by hand doesn't scale past a few teams.

Solution: Connect each Azure DevOps org to the central ServiceNow instance separately, each with its own sync rules. ServiceNow gets one rolled-up view, and no org has to change how it works.

Bi-Directional Status Sync Between Delivery and Support

Current Setup: Support logs incidents in ServiceNow. Development tracks the corresponding work in Azure DevOps, sometimes across several orgs.

Problem: Support has to ask developers for status or check Azure DevOps boards directly, and developers end up relaying the same update twice.

Solution: Sync status, comments, and priority both ways, so an update in either system shows up automatically on the other side.

Field-Level Control Per Org

Current Setup: Each business unit or subsidiary has its own rules about what data can leave its Azure DevOps org.

Problem: A single shared integration with one set of mapping rules risks exposing fields an org never agreed to share outside its own boundary.

Solution: Give each org's connection its own outgoing rules, so a subsidiary decides exactly which fields leave its Azure DevOps org, field by field.

Handling Closed and Read-Only Work Items

Current Setup: ServiceNow blocks writes to closed incidents through ACLs, and Azure DevOps can hit a similar restriction on closed or read-only work items. Problem: A sync that keeps trying to write to a closed item throws the same error repeatedly, and the real problems get buried under the noise.

Solution: Filter closed and read-only states out of the sync, or let the errors surface if operations wants visibility into them.

What to Evaluate When Choosing an Approach

A few criteria matter more than others once you're running this across multiple orgs.

Decentralized configuration: does each Azure DevOps org get its own connection and its own rules, or does everything route through one shared setup?
Filtering: can you scope the sync with something like WIQL queries on the Azure DevOps side, by area path, iteration, work item type, or tag?
Field mapping: does it handle the difference between ServiceNow's field structure and Azure DevOps work item fields without dropping data? Common pairs are ServiceNow State to Azure DevOps State, ServiceNow Priority to Azure DevOps Priority, and ServiceNow Assignment Group to Azure DevOps Area Path. Custom fields usually need explicit mapping rules.
Conflict handling: what happens when both sides update the same field at the same time, and what happens with closed or read-only items specifically?
Security: Entra ID or OAuth authentication, PAT management per org, role-based access, audit logging, and whatever compliance certifications your security team asks for during review.
Direction: bidirectional where both teams update shared fields, one-way where only one side should ever write.

Technical Approaches

Service Hooks and REST APIs

Azure DevOps Service Hooks paired with the ServiceNow REST API give you sync in both directions. A change in Azure DevOps triggers a Service Hook, which calls the ServiceNow API to update the record, and the same flow runs in reverse.

This is the most direct route if you're comfortable building and maintaining the webhook logic yourself.

Custom Middleware

For anything more complex, custom middleware gives you full control over field transformation, routing, and error handling. Azure Functions, Logic Apps, or a small Node.js or Python service usually does the job.

The trade-off is maintenance. You own the retry logic, the error handling, and every update when either platform changes its API.

Dedicated Integration Platforms

Plenty of teams skip building this from scratch and use a dedicated integration platform instead. These typically come with pre-built connectors for both Azure DevOps and ServiceNow, a way to configure field mapping and filters without writing much code, and managed infrastructure so you're not hosting your own sync server.

What they usually cover:

Pre-configured connectors that already understand both platforms' data structures
Visual or scripting configuration for field mapping and filters
Managed infrastructure, so nothing runs on your own servers
Built-in retry and error handling for API failures
Audit logging for tracking what synced and when
Support for multi-org routing and conditional logic out of the box

The trade-off runs the other way: a subscription cost instead of a one-time build, less control over the exact implementation, and your data passing through a third party's infrastructure. For teams running more than 2 or 3 orgs against one ServiceNow instance, this usually ends up being less overhead than maintaining custom middleware long-term.

Every org here has probably solved a version of this differently. Curious what's worked for you, especially with 3 or more Azure DevOps orgs feeding into one ServiceNow instance, and which part of the setup gave you the most trouble.

Azure Networking: Request for Granular Control of “Allow Azure Services and Resources”

jayeshkumarpatel — Wed, 26 Aug 2026 09:47:00 GMT

I would like to get the Azure community’s thoughts on a networking/security improvement that I believe could help organizations implement a stronger least-privilege model.

Several Azure resources provide an option similar to:

“Allow Azure services and resources to access this resource.”

This is useful when an Azure service needs to access another Azure resource, but the current option can be quite broad.

Example: Power BI → Azure SQL

For example, suppose Power BI Service needs to access an Azure SQL Server.

The actual requirement might be:

Power BI → Specific Azure SQL Server = Allow

However, the available option may require enabling:

“Allow Azure services and resources to access this server”

This effectively creates a much broader trusted-service exception than the actual requirement.

Ideally, I would like to see something like:

Azure SQL Server │ ├── Power BI Service → Allow ├── Azure Data Factory → Deny ├── Azure Functions → Deny ├── Azure App Service → Deny └── Other Azure Services → Deny

Proposed improvement

Could Microsoft provide an additional option such as:

“Allow selected Azure services and resources”

where customers can explicitly select which Azure service/resource is allowed to bypass the network restriction?

Depending on the Azure service, the selection could potentially be based on:

Specific Azure service
Specific Azure resource
Resource ID
Subscription
Resource group
Tenant
Managed identity / Entra identity
Specific service instance

For example:

Trusted Azure Services / Resources Power BI → Production Analytics → Allow All other Azure services → Deny

Why I think this would be useful

This would give customers a middle ground between:

Disabling public access and implementing Private Endpoint/private connectivity, or
Allowing all Azure services/resources through the broad trusted-service exception.

A granular trusted-service model would allow:

Only the Azure service/resource that actually requires access is trusted.

This would better support least privilege, Zero Trust, security, and compliance requirements.

Broader Azure applicability

My suggestion is not specifically for Azure SQL.

The Power BI → Azure SQL scenario is just an example. I think this could be a common Azure networking capability for all Azure resources that currently support a trusted Azure services / “Allow Azure services and resources” type of bypass.

I would be interested to hear from the Azure community and Microsoft:

Is there already a way to achieve this level of granularity?
Are there architectural/security reasons why this cannot currently be implemented?
Is Microsoft considering a more granular trusted-service model?
Would a feature like “Allow selected Azure services/resources” be technically feasible?

I would appreciate any feedback or guidance from the Azure networking/service teams.

Three Cloud Myths I Believed Before Studying Azure Fundamentals

Mahmoud_amria — Sun, 23 Aug 2026 16:35:46 GMT

While preparing for AZ-900, I realized that several assumptions I had about cloud computing were incomplete.

☁️ Myth 1: The cloud is always cheaper
Cloud services can reduce upfront costs, but unused resources, incorrect sizing, and poor planning can quickly increase the bill.

🖥️ Myth 2: The cloud means there are no servers
The physical infrastructure still exists. What changes is how much of it is managed by the cloud provider.

⚙️ Myth 3: More control is always better
Additional control also means additional responsibility for patching, monitoring, configuration, security, and maintenance.

My biggest takeaway was that cloud computing is not automatically cheaper, simpler, or better. It is about finding the right balance between cost, control, responsibility, and speed.

For beginners interested in exploring these concepts, Microsoft Learn provides an official learning path:

Explore the official AZ-900 course on Microsoft Learn

Which cloud misconception did you believe when you first started learning?

ServiceEndpointProxy activity on ADO Service Connection

LouisT — Thu, 06 Aug 2026 14:00:05 GMT

I have an ADO Service Connection which I don't think is being used by any pipelines but I still see regular entries in the usage history like:

Type: ServiceEndpointProxy

Details: ServicePrincipalSignInAudience

I've not been able to find any information about what causes this. What is causing this activity and will deleting the service connection adversely affect anything assuming this is the only thing using it?

Azure Admin Login

Old-school — Thu, 06 Aug 2026 09:58:10 GMT

We have a client who has lost their access information to get into their Azure global admin. This is a non-profit institution that moved the ownership of their Azure account to another entity years ago now can't get in to the global admin for their entire Azure setup.

Microsoft requires the global admin login to create a support ticket and in this case, how are they supposed to open up a case when they can't login. The customer is furious and now disputing the CC charges so we open an Azure support ticket 10 days ago for ourselves and since it's not a Critical issue, have gotten no response.

This is untenable situation and there is no way to contact some one from MS without the login, how does this get resolved??

Building Production-Ready Pipelines in Azure DevOps: Beyond the Documentation Examples

AbdullahShahid984 — Mon, 03 Aug 2026 15:25:22 GMT

Hi everyone,

When moving from basic Azure DevOps tutorials to enterprise production environments, we all quickly realize that documentation examples don't always cover real-world complexities. Handling multi-stage dependencies, keeping Terraform state secure, and managing secrets across environments requires a highly strategic approach.

To help DevOps engineers bridge this gap, I recently put together a deep-dive architecture breakdown detailing how to build a resilient, multi-stage YAML pipeline from scratch.

Here is a quick look at the core enterprise architecture I focus on:

- Multi-Stage Lifecycle: Safe progression flows through Build, Dev, QA, UAT, and Production stages.

- Infrastructure Automation: Clean integration with Terraform, including state and secrets management using Azure Key Vault.

- Security Gates: Implementation of SAST scanning, Workload Identity, and automated approval policies.

- Team Alignment: Connecting Azure DevOps with project tools like Asana to streamline cross-platform tracking.

I wanted to share this pattern here to get some community feedback on the YAML structure.

Before I post the full configuration snippets, I would love to hear how your teams handle environment gates and approvals. What are the biggest bottlenecks you run into with multi-stage YAML pipelines? Let's discuss in the comments below!

Best regards,

Abdullah Shahid

Azure VM resize: PowerShell lists Dv5 sizes, but Azure Portal only offers Dv4

Seb30470 — Mon, 03 Aug 2026 13:35:59 GMT

Hello,

We recently migrated two production Azure virtual machines away from the retiring Bv1 family.

Initially, the VMs were running as:

Standard_B2ms

Standard_B4ms

Our goal was to move them to a newer supported VM family.

Environment

Region: France Central

Managed OS disks (one Standard SSD, one Standard HDD/Standard LRS)

SCSI disk controller

Windows Server virtual machines

What we observed

After stopping and deallocating the VM, we queried the available resize targets using PowerShell:

Get-AzVMSize ` -ResourceGroupName "<ResourceGroup>" ` -VMName "<VMName>"

For one VM, PowerShell returned, among others:

Standard_D2ads_v5 Standard_D2ds_v5 Standard_D2d_v5 Standard_D2as_v4 Standard_D2ds_v4

For the other VM, it returned:

Standard_D4ads_v5 Standard_D4ds_v5 Standard_D4d_v5 Standard_D4as_v4

However, when opening VM → Size in the Azure Portal, the v5 sizes were not available.

Only the following sizes appeared:

Standard_D2as_v4

Standard_D4as_v4

As a precaution, we resized both VMs using the sizes proposed by the Azure Portal:

Standard_B2ms → Standard_D2as_v4

Standard_B4ms → Standard_D4as_v4

The migration completed successfully and both VMs are running correctly.

Question

Can someone explain why there is a difference between:

the sizes returned by Get-AzVMSize, and

the sizes displayed by the Azure Portal?

More specifically:

Does Get-AzVMSize return VM sizes that are not actually valid resize targets?

Does the Azure Portal apply additional compatibility or capacity checks that PowerShell does not?

Is this related to:

regional capacity,

VM generation,

disk controller,

managed disk type,

host cluster,

or another compatibility requirement?

Would you recommend staying on Das_v4, or should we plan another migration to Dads_v5 if possible?

I am trying to understand the reason behind the different behavior rather than forcing the resize through PowerShell.

Thank you in advance for your insights.

Building Production-Ready Pipelines in Azure DevOps: Beyond the Documentation Examples

AbdullahShahid984 — Sun, 02 Aug 2026 12:16:04 GMT

Hi everyone,

To help DevOps engineers bridge this gap, I recently put together a deep-dive architecture breakdown detailing how to build a resilient, multi-stage YAML pipeline from scratch.

Here is a quick look at the core enterprise architecture I focus on:

- Multi-Stage Lifecycle: Safe progression flows through Build, Dev, QA, UAT, and Production stages.

- Infrastructure Automation: Clean integration with Terraform, including state and secrets management using Azure Key Vault.

- Security Gates: Implementation of SAST scanning, Workload Identity, and automated approval policies.

- Team Alignment: Connecting Azure DevOps with project tools like Asana to streamline cross-platform tracking.

I wanted to share this pattern here to get some community feedback on the YAML structure.

Best regards,

Abdullah Shahid

Microsoft 365 business tenant blocked – AADSTS5000228 – sole Global Administrator

NikolaM1983 — Thu, 30 Jul 2026 14:12:10 GMT

Please create a service request for a blocked Microsoft Entra tenant and escalate it to the Data Protection / Tenant Recovery Team.

Tenant: valtechme.onmicrosoft.com

Tenant ID: 80940ba0-e307-45b2-b5fd-05b9759a4594

Error: AADSTS5000228

I am the sole Global Administrator.

I am posting this here, since getting microsoft support is almost impossible , via phone, email or web.

Can someone please help me with this issue.

Cost increases when selecting Amortised cost in cost analysis

jonveldsman — Thu, 30 Jul 2026 08:26:56 GMT

Hi, this seems like a bug. When i select Amortized cost in Cost analysis, our monthly cost jumps from $25,664.54 to $76,315.83.
The resource that causes the jump is a Reservation for a D4asv5 virtual machine. It jumps to $3,120.09 per day.
Can someone please try it their side.

Agentic AIOps vs Traditional AIOps: What Actually Changes in Practice?

JohnNaguib — Wed, 29 Jul 2026 13:30:43 GMT

Artificial Intelligence for IT Operations (AIOps) has transformed how organizations monitor, manage, and optimize modern IT infrastructure. By combining machine learning, analytics, and automation, Traditional AIOps has helped IT teams reduce alert fatigue, identify anomalies faster, and improve operational efficiency.

https://dellenny.com/agentic-aiops-vs-traditional-aiops-what-actually-changes-in-practice/

How to Build Your First IT Support Agent Using Azure AI

JohnNaguib — Wed, 29 Jul 2026 13:29:53 GMT

Artificial Intelligence is transforming the way businesses provide IT support. Instead of waiting for a technician to answer every question, organizations are increasingly using AI-powered support agents that can troubleshoot common issues, answer employee questions, and automate repetitive tasks. Thanks to Microsoft Azure AI, building an intelligent IT support agent is no longer limited to data scientists or large enterprises. Even beginners can create a functional AI assistant with minimal coding.

https://dellenny.com/how-to-build-your-first-it-support-agent-using-azure-ai/

Dealing with Legacy Systems and Services in Cloud Computing

JohnNaguib — Wed, 29 Jul 2026 13:29:00 GMT

Every organization reaches a point where technology that once powered innovation begins to slow progress. Legacy systems, although reliable and familiar, often become barriers to growth, agility, and digital transformation. As businesses increasingly adopt cloud computing to improve scalability, reduce operational costs, and enhance security, one major challenge remains how to deal with legacy systems and services without disrupting business operations.

https://dellenny.com/dealing-with-legacy-systems-and-services-in-cloud-computing/

Open in VS Code for the web fails ... tunnel 400 error ?

PanosGR191 — Tue, 28 Jul 2026 10:02:00 GMT

Hello everyone,

The last week I have problem connecting to VS Code for the Web,

my cloudshell works correctly, my account is ok, everything works BUT when tryont to open through browser - azure portal the VS Code for the Web, I got errors similar to ....

***************************

https://ccon-prod-northeurope-aci-01.servicebus.windows.net/.../tunnel

Result:

400 Bad Request

Response:

{"error":{"message":"Error creating dev tunnel","details":""}}

Tested from:

- Multiple browsers

- InPrivate

- Different PC

- Azure VM

***************************

I even renamed ~/code , ~/.vscode-server-insiders

and restart cloudshell and VSCode web, same errors (and folders were not recreated)

Any help would be greatly appreciated !!

BR,

Panos

Free Extension: Generate AI Development Prompts from Azure DevOps Work Items — Verity Framework

Idearoost1 — Wed, 22 Jul 2026 18:00:07 GMT

Hi Azure DevOps community,

I wanted to share a free extension we just published to the Visual Studio

Marketplace: the Verity Framework ADO Extension.

**What it does**

It adds a "Verity Prompt" tab to your work items. When you populate five

custom fields on a User Story or Delivery Item, the extension generates a

structured prompt ready to paste into Claude Code, Cursor, or GitHub

Copilot Workspace.

The five fields:

- VF Intent — the problem and who experiences it

- VF Value — the expected outcome

- VF Appetite — time/resource ceiling (not an estimate)

- VF Trust Criteria — Gate 2 hardening requirements

- VF Failure Scope — Narrow / Moderate / Broad / Systemic

**Why it matters**

Most engineers using AI tools start from a blank context or a vague task

description. The extension carries the team's planning judgment — including

production risk level and hardening requirements — directly into the

implementation context.

It also includes field validation that flags vague Trust Criteria,

incorrectly formatted Appetite values, and solution-framed Intent

statements before generating the prompt.

**Setup**

About 20 minutes. You add five custom fields to your existing User Story

work item type (no new work item type required). Full instructions are

in the extension tab.

**Install**

Search "Verity Framework" on the Visual Studio Marketplace or visit

idearoost.com/verity for the full framework context.

Free. No subscription required.

Happy to answer questions about the field definitions or the setup process.

— Jacques Steward, IdeaRoost

Azure Architecture Best Practices for Enterprise Applications

JohnNaguib — Mon, 20 Jul 2026 14:28:26 GMT

As businesses continue to modernize their IT infrastructure, Microsoft Azure has become one of the leading cloud platforms for building enterprise-grade applications. Organizations of all sizes rely on Azure to improve scalability, strengthen security, reduce operational costs, and accelerate digital transformation. However, simply moving an application to the cloud does not guarantee success. A well-designed Azure architecture is the foundation of a secure, reliable, and high-performing enterprise application.

https://dellenny.com/azure-architecture-best-practices-for-enterprise-applications/

Question for OAuth setting for "Try me" function in APIM developer portal

curious7 — Thu, 16 Jul 2026 23:55:53 GMT

I am working on a APIM deployment that will have developer portal available to developers. Login to portal will only allow Azure B2C accounts and thus will have OAuth already performed.

On the APIM instance settings in Azure portal the "OAuth 2.0 + OpenID Connect" section has a option to create OAuth server for B2C, which then can be used for each API. The "try me" function for that API in the developer portal can then use this OAuth server to perform OAuth and use the token.

As we have already performed OAuth for developer portal login itself, so I don't want users to perform OAuth twice for better user experience.

But one thing I am unsure off is if either there is a global jwt token validation policy or a API specify jwt policy requiring OAuth tokens, then if I don't set the OAuth for "Try me" function, will that succeed or fail?

And are there any other security/general concerns if we don't set the OAuth for "Try me" function in developer portal.

Azure Logic Apps Workflow Templates (Preview): Issues with Updates, Expressions, and Designer UI.

Simal00 — Wed, 15 Jul 2026 14:29:02 GMT

Hi Azure Logic Apps team, if someone from the team is monitoring this community, I would like to report a few issues I have encountered with the Logic Apps Workflow Templates (Preview) feature. These issues are impacting the user experience and require attention.

Workflow Template name update issue

I created a workflow template that was working correctly. However, when I try to edit the template and change its name, the update either fails or the new name is not saved. Other changes appear to work, but renaming the template is consistently problematic.

Expression update issue with Base64 output

When using the expression:

base64(body('Create_CSV_table'))

each time the email action is updated, the expression automatically changes back to:

body('Create_CSV_table')

This causes an Internal Server Error and requires manually fixing the expression every time the workflow is updated. This becomes very frustrating when managing multiple workflows.

Logic Apps designer responsiveness issue

The Logic Apps designer page is not fully responsive across different screen sizes. On my laptop screen, the Add Expression option disappears and is only visible when using a larger monitor. The designer should support different screen resolutions and provide a consistent user experience.

Thank you for looking into these issues. Logic Apps Workflow Templates is a very useful feature, and addressing these problems would greatly improve usability for developers and users.