Azure Infrastructure topics

RC4 Deprecating by April

azuser — Fri, 03 Apr 2026 19:08:08 GMT

I’m reviewing our Seamless SSO setup and noticed that the AzureADSSOAcc account is still using RC4 (encryption type 0x17) from Kerberos event logs.

I have a few questions regarding this:

Why does AzureADSSOAcc still default to RC4 instead of AES, even when the domain supports AES?

With Microsoft disabling RC4 (April updates), will AzureADSSOAcc automatically switch to AES?

If it does not switch automatically, what is the recommended way to force it to use AES?

Is running Update-AzureADSSOForest (key rotation) sufficient, and does it cause any downtime or impact to Seamless SSO?

I want to make sure we transition to AES safely without breaking SSO for users.

Any guidance or real-world experience would be appreciated.

Intermittent Access Issue Between Azure Function App and Key Vault (Private Endpoint Enabled)

Manan_Choksi — Tue, 11 Nov 2025 14:08:54 GMT

We have an Azure Function App configured to retrieve secrets from Azure Key Vault using Managed Identity, following the recommended pattern.

Key details of our setup:

The Function App is running on a Premium Plan and VNet-integrated.
The Key Vault has Public Network Access disabled and uses a Private Endpoint.
The Function App accesses Key Vault secrets through Key Vault references in application settings.

We are intermittently observing issues where the Function App fails to access the Key Vault. Under the “Diagnose and Solve Problems” blade, the following error appears:

[ResolveWorkitem] AccessToKeyVaultDenied error while retrieving Key Vault Secret Reference
microsoft.KeyVault(SecretUri=*********************).
Exception: KeyVaultResolver.Common.ReferenceResolverException:
Exception of type 'KeyVaultResolver.Common...'

Has anyone encountered this issue or found a reliable way to resolve intermittent connectivity/authentication failures between a Function App and a Key Vault over a private endpoint?

Unable to Access Internet from Azure DevOps Server 2022 Self-Hosted Agent Behind Proxy

Sohaib555 — Thu, 23 Oct 2025 20:12:48 GMT

I am running Azure DevOps Server 2022 in an environment that uses a proxy to access the internet. Multiple projects depend on various Node packages. While I can successfully download these packages through a browser using the configured proxy, the issue occurs when running pipelines on a self-hosted agent.

The agent installation completes successfully, but the pipeline fails during execution, seemingly due to lack of internet access.

Is there a way to configure the proxy settings specifically for the self-hosted agent so that it can access the internet during pipeline runs?

Top AI & CLI Prompts DevOps Can Use to Manage Azure Efficiently

JohnNaguib — Thu, 24 Jul 2025 09:47:48 GMT

As DevOps engineers juggle multiple responsibilities—from provisioning resources to ensuring system reliability—having quick, effective commands and AI prompts can significantly boost productivity. Whether you’re scripting in Azure CLI, using GitHub Copilot, or leveraging Azure’s AI Copilots, here are some of the best prompts and commands to streamline Azure management.

https://dellenny.com/top-ai-cli-prompts-devops-can-use-to-manage-azure-efficiently/

How to obtain a new partner integration sandbox license

msande69 — Wed, 25 Jun 2025 07:52:03 GMT

Our current Partner intergration Sandbox License has expired, and i'm looking for a way to obtain a new partner intergration sandbox license within the same tenant . Can anybody help me with that. Been trying to get an answer from subscripton and sandbox support for couple of days now. But the keep sending met to different departments and still no answer.

Using Azure Firewall as a Gateway for All Outbound Traffic to the Internet

NicolD — Fri, 09 May 2025 14:05:49 GMT

Hey everyone!

I just uploaded a new guide on GitHub where I walk through setting up Azure Firewall in a classic Hub & Spoke scenario to manage all outbound internet traffic 🌐.

In this guide, you'll find step-by-step instructions on:

Setting up the Hub & Spoke network architecture
Configuring Azure Firewall to control and monitor outbound traffic

This tutorial is part of the hub-and-spoke-playground project, which includes various scenarios and scripts to showcase the benefits of the hub-and-spoke network topology in Azure. You can explore more scenarios and resources in the project’s GitHub repository: https://github.com/nicolgit/hub-and-spoke-playground .

Would love to hear your thoughts and feedback!

Custom Role to Prevent Users making any changes to Azure Web App Network Configuration

terruahmad — Wed, 23 Apr 2025 23:34:53 GMT

Hi,

I have a customer who wants to create a custom role to prevent users from making any changes or updates to Web App network configuration under Networking tab. This includes inbound access, outbound traffic, VNet Integration, site access and rules. We created a customer role, but it is not working. Does anyone have a working custom role that you can share? Thanks.

properties": {

"roleName": "WebAppCustomRBAC",

"description": "Web App Custom Role",

"assignableScopes": [

"/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

"permissions": [

{

"actions": [

"Microsoft.Web/sites/*",

"Microsoft.Web/serverfarms/Read",

"Microsoft.Resources/subscriptions/resourceGroups/read",

"Microsoft.Insights/components/*",

"Microsoft.Insights/alertrules/*"

"notActions": [

"Microsoft.Web/sites/config/write",

"Microsoft.Web/sites/networkConfig/write",

"microsoft.web/sites/networkConfig/delete",

"microsoft.web/sites/slots/networkConfig/write",

"microsoft.web/sites/slots/networkConfig/delete",

"microsoft.web/sites/slots/virtualnetworkconnections/delete",

"microsoft.web/sites/slots/virtualnetworkconnections/write",

"microsoft.web/sites/virtualnetworkconnections/delete",

"microsoft.web/sites/virtualnetworkconnections/write"

"dataActions": [],

"notDataActions": []

}

]

}

Azure Alway-On VPN with SSO

terruahmad — Thu, 06 Mar 2025 19:08:08 GMT

Hi all,

I have a customer who likes to POC Azure always-on VPN. Customer wants to avoid entering credentials to login to VPN. Is there a document that shows the steps to enable SSO? Is Intune required to enable SSO?

Thanks.

Boosting Performance with the Latest Generations of Virtual Machines in Azure

Gabriel_Naranjo — Mon, 17 Feb 2025 11:00:29 GMT

Microsoft Azure recently announced the availability of the new generation of VMs (v6)—including the Dl/Dv6 (general purpose) and El/Ev6 (memory-optimized) series. These VMs are powered by the latest Intel Xeon processors and are engineered to deliver:

Up to 30% higher per-core performance compared to previous generations.
Greater scalability, with options of up to 128 vCPUs (Dv6) and 192 vCPUs (Ev6).
Significant enhancements in CPU cache (up to 5× larger), memory bandwidth, and NVMe-enabled storage.
Improved security with features like Intel® Total Memory Encryption (TME) and enhanced networking via the new Microsoft Azure Network Adaptor (MANA).

By Microsoft

Evaluated Virtual Machines and Geekbench Results

The table below summarizes the configuration and Geekbench results for the two VMs we tested.

VM1 represents a previous-generation machine with more vCPUs and memory, while VM2 is from the new Dld e6 series, showing superior performance despite having fewer vCPUs.

VM1 features

VM1 - D16S V5 (16 Vcpus - 64GB RAM)

VM2 features

VM2 - D16ls v6 (16 Vcpus - 32GB RAM)

Key Observations:

Single-Core Performance: VM2 scores 2013 compared to VM1’s 1570, a 28.2% improvement. This demonstrates that even with half the vCPUs, the new Dld e6 series provides significantly better performance per core.

Multi-Core Performance: Despite having fewer cores, VM2 achieves a multi-core score of 12,566 versus 9,454 for VM1, showing a 32.9% increase in performance.

VM 1

VM 2

Enhanced Throughput in Specific Workloads:

File Compression: 1909 MB/s (VM2) vs. 1654 MB/s (VM1) – a 15.4% improvement.
Object Detection: 2851 images/s (VM2) vs. 1592 images/s (VM1) – a remarkable 79.2% improvement.
Ray Tracing: 1798 Kpixels/s (VM2) vs. 1512 Kpixels/s (VM1) – an 18.9% boost.

These results reflect the significant advancements enabled by the new generation of Intel processors.

Score VM 1

VM 1

Score VM 2

VM 2

Evolution of Hardware in Azure: From Ice Lake-SP to Emerald Rapids

Technical Specifications of the Processors Evaluated

Understanding the dramatic performance improvements begins with a look at the processor specifications:

Intel Xeon Platinum 8370C (Ice Lake-SP)

Architecture: Ice Lake-SP
Base Frequency: 2.79 GHz
Max Frequency: 3.5 GHz
L3 Cache: 48 MB
Supported Instructions: AVX-512, VNNI, DL Boost

VM 1

Intel Xeon Platinum 8573C (Emerald Rapids)

Architecture: Emerald Rapids
Base Frequency: 2.3 GHz
Max Frequency: 4.2 GHz
L3 Cache: 260 MB
Supported Instructions: AVX-512, AMX, VNNI, DL Boost

VM 2

Impact on Performance

Cache Size Increase: The jump from 48 MB to 260 MB of L3 cache is a key factor. A larger cache reduces dependency on RAM accesses, thereby lowering latency and significantly boosting performance in memory-intensive workloads such as AI, big data, and scientific simulations.
Enhanced Frequency Dynamics: While the base frequency of the Emerald Rapids processor is slightly lower, its higher maximum frequency (4.2 GHz vs. 3.5 GHz) means that under load, performance-critical tasks can benefit from this burst capability.
Advanced Instruction Support: The introduction of AMX (Advanced Matrix Extensions) in Emerald Rapids, along with the robust AVX-512 support, optimizes the execution of complex mathematical and AI workloads.
Efficiency Gains: These processors also offer improved energy efficiency, reducing the energy consumed per compute unit. This efficiency translates into lower operational costs and a more sustainable cloud environment.

Beyond Our Tests: Overview of the New v6 Series

While our tests focused on the Dld e6 series, Azure’s new v6 generation includes several families designed for different workloads:

1. Dlsv6 and Dldsv6-series

Segment: General purpose with NVMe local storage (where applicable)
vCPUs Range: 2 – 128
Memory: 4 – 256 GiB
Local Disk: Up to 7,040 GiB (Dldsv6)
Highlights: 5× increased CPU cache (up to 300 MB) and higher network bandwidth (up to 54 Gbps)

2. Dsv6 and Ddsv6-series

Segment: General purpose
vCPUs Range: 2 – 128
Memory: Up to 512 GiB
Local Disk: Up to 7,040 GiB in Ddsv6
Highlights: Up to 30% improved performance over the previous Dv5 generation and Azure Boost for enhanced IOPS and network performance

3. Esv6 and Edsv6-series

Segment: Memory-optimized
vCPUs Range: 2 – 192* (with larger sizes available in Q2)
Memory: Up to 1.8 TiB (1832 GiB)
Local Disk: Up to 10,560 GiB in Edsv6
Highlights: Ideal for in-memory analytics, relational databases, and enterprise applications requiring vast amounts of RAM

Note: Sizes with higher vCPUs and memory (e.g., E128/E192) will be generally available in Q2 of this year.

Key Innovations in the v6 Generation

Increased CPU Cache: Up to 5× more cache (from 60 MB to 300 MB) dramatically improves data access speeds.
NVMe for Storage: Enhanced local and remote storage performance, with up to 3× more IOPS locally and the capability to reach 400k IOPS remotely via Azure Boost.
Azure Boost: Delivers higher throughput (up to 12 GB/s remote disk throughput) and improved network bandwidth (up to 200 Gbps for larger sizes).
Microsoft Azure Network Adaptor (MANA): Provides improved network stability and performance for both Windows and Linux environments.
Intel® Total Memory Encryption (TME): Enhances data security by encrypting the system memory.
Scalability: Options ranging from 128 vCPUs/512 GiB RAM in the Dv6 family to 192 vCPUs/1.8 TiB RAM in the Ev6 family.
Performance Gains: Benchmarks and internal tests (such as SPEC CPU Integer) indicate improvements of 15%–30% across various workloads including web applications, databases, analytics, and generative AI tasks.

My personal perspective and point of view

The new Azure v6 VMs mark a significant advancement in cloud computing performance, scalability, and security. Our Geekbench tests clearly show that the Dld e6 series—powered by the latest Intel Xeon Platinum 8573C (Emerald Rapids)—delivers up to 30% better performance than previous-generation machines with more resources.

Coupled with the hardware evolution from Ice Lake-SP to Emerald Rapids—which brings a dramatic increase in cache size, improved frequency dynamics, and advanced instruction support—the new v6 generation sets a new standard for high-performance workloads. Whether you’re running critical enterprise applications, data-intensive analytics, or next-generation AI models, the enhanced capabilities of these VMs offer significant benefits in performance, efficiency, and cost-effectiveness.

References and Further Reading:

Register now for the Migrate to Innovate Summit

MSdellis — Thu, 13 Feb 2025 21:48:44 GMT

Join the summit on March 11, presented in partnership with Intel.

Stay agile, innovate for the future, and maintain a competitive edge by accelerating your cloud migration and modernization journey. Microsoft thought leaders will discuss the latest news and trends, showcase real-world case studies, and share how Azure can help you fully embrace AI.

Join us to:

Maximize business value and build the foundation for successful innovation by leveraging the latest Azure and Intel capabilities for your workloads.

Dive into case studies and real-world examples showcasing how organizations have successfully transformed their business and how you can be next by migrating and modernizing on Azure.

Make sure your cloud migration and modernization journey is using the best practices and strategies featured in product demonstrations.

Register now >

Migrate to Innovate Summit

Tuesday, March 11, 2025

9:00 AM–11:30 AM Pacific Time (UTC-7)

ARM template and how to test it partially

Petri-X — Sat, 16 Nov 2024 10:47:39 GMT

Hi all,

If you have a long deployment template and performing that takes 10 - 15 minutes, what would be the best option for troubleshooting the process if that e.g fail at the end?

At the moment I'm failing to the Access Denied (I believe so) when the deployment is trying to use ARM Function: Reference to get the Key Vault SecretURI. Of course there is lot of different parameters on it to get that information, but the error message is "AccesstoKeyVaultDenied (code:BadRequest)". So far I have not been able get knowledge where the access denied is coming nor what resource that is trying to get.

It is possible to manually test those ARM functions somehow, like with PS command? Or is the only option to Enable ARM debugging, and hope the best? It is just a bit hard to wait over 10min to see if the actions has been helpful or (as too often now) not :D

Function App Service

DevendraKumar2 — Fri, 25 Oct 2024 06:06:26 GMT

Hi,

I'm having trouble deploying my Python script to an Azure Function App. Can someone help me troubleshoot the deployment process and ensure the function works correctly?

I have followed all the articles available on the internet, I am not able to figure out , where is actual issue?

Azure VMs Not Applying GPOs Correctly

experi18 — Sat, 19 Oct 2024 10:51:32 GMT

Hi everyone,

Quick question… if my Azure VMs are joined to my domain, they should be applying all my configured GPOs, right?

For some reason, my VMs are not applying the GPOs, even after running a GPUPDATE /force. At the moment, I am testing some simple GPOs like:

Creating a folder on the desktop
Setting the time format to Brazilian (dd/mm/yyyy)
Adjusting the timezone to Brasília

When I run gpresult /r, it shows that the GPOs are being applied, but for some reason, the VM just doesn’t reflect them.

Any idea what might be causing this?

AZureADSSOACC and AES

azuser — Mon, 14 Oct 2024 16:25:26 GMT

I have been auditing event IDs 4768 and 4769 and noticed a few accounts with 0x17. I believe that to be related to RC4. One of the accounts is an AzureADSSOacc account that was created before the year 2020. Will this account use AES if we upgrade the DC to 2025 or will we have to force it?

Enabling Azure Automanage or creating a custom configuration profile currently results in an error.

wmatthyssen — Sat, 21 Sep 2024 16:00:47 GMT

At the moment, enabling Azure Automanage for a new Azure VM or Arc-enabled server results in the following error:

An error occurred while assigning the configuration profile named 'Azure best practices: Dev / Test'. Error details: The operation was not allowed because the subscription is not in a state to support it. Subscription state: -1

Additionally, attempting to create a custom configuration profile results in the following error:

An error occurred while creating the configuration profile named 'amcp-prd-arc-infra-01'. Error details: The operation was not allowed because the subscription is not in a state to support it. Subscription state: -1

Has anyone encountered this issue before and found a solution?

Health state monitoring for a service hosted on Azure Virtual Machine

asorrour — Thu, 25 Jul 2024 18:42:06 GMT

I have a virtual machine hosted on Azure cloud, I wanted to add some monitoring on the health state of a service deployed on the VM. I already enabled the health monitoring extension to keep pinging the health URL of the service and return 200 or otherwise when the service is down. It shows green "Healthy" or yellow "Unhealthy" on the VM's overview page, which is great.

I was expecting to get some data in this Insight log table HealthStateEventChange, when the service is down, but the table is always empty. Anyone who worked with this table or can give any support I would appreciate any.

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/HealthStateChangeEvent

Infra as Code vs VMSS

experi18 — Tue, 16 Jul 2024 16:14:39 GMT

Guys, I always wondered... what is the difference between VMSS and create VMs via IAC?

Which one is better?

Does any of one have more advantages than the other?

Copying template.json from Export Template and deploy in bicep

akin_k — Tue, 16 Jul 2024 14:29:39 GMT

I have a question, i want to deploy my resources (already created on Azure Portal) on my Azure Dev Ops Repo. My question is: is it legit to take the template.json from Export Template and then convert it into Bicep and then deploy with some changes on Azure Dev Ops?

Thank you very much!

[Azure CLI] az sf application-type version create authentication

dkurepa — Mon, 15 Jul 2024 16:27:55 GMT

Hello,

We're currently using `az sf application-type version create` to create a new application-type version, and then `az sf application upgrade` in our CI for Service Fabric deployments.

The first comman, `az sf application-type version create` accepts a --package-url parameter. Currently, we're passing a package url with a SAS token. We want to stop doing this and to authenticate using something like a Managed Identity, but we can't get it to work (we keep authentication issues).

Is there any guide on how to do this? Is it even a supported scenario?

User Authentication Method last used date

templintek — Fri, 12 Jul 2024 14:21:07 GMT

We have an issue with our users getting the latest iPhone and never notifying IT that they have turned in the old one. This means that the old device is still registered in our system as a valid MFA method for the user. I would like to run a script that would tell me per user, their MFA methods and the last time they used it, Or even better the last time that device checked in. The goal would be to delete any devices that have not been used or checked in for over a year as a starting point.

Running Get-MgBetaUserAuthenticationMethod -Userld $UserID I Select • -ExpandProperty AdditionalProperties

There is only Create date / Time not usage. Do I need to be looking anywhere else?