Is APIM Standard_V2 tier viable option from security standpoint if you have Developer portal enabled
From my understanding with APIM Standard_v2 tier you can only configure the gateway endpoint with private endpoint and have that behind something like application gateway to allow the ability to have WAF in front of it. But, the developer portal is reachable only over its public address and cannot have private endpoint. Even after adding a custom domain on the Developer portal endpoint, the default <name>.developer.azure-api.net address keeps responding and returns 200. If you set all your APIs to require approval for subscription , then for a production scenario where you would allow "Try this operation" functionality on your APIs through developer portal, is it safe to still use standard_v2 tier. Or are there some security problems associated with that?
URGENT: Microsoft Edge incorrectly flags paytracc.com as typosquatting after multiple reports
Microsoft Edge Website Typo Protection incorrectly flags https://paytracc.com as a possible misspelling of paytrace.com. Paytracc.com is the legitimate official domain of PayTracc, an independent financial technology product. “PayTracc” is the intentional registered brand spelling and is not impersonating or affiliated with PayTrace. The warning has continued despite repeated reports through the “Report that this site URL is not a misspelling” option. Technical verification: • https://paytracc.com returns HTTP 200 OK. • http://paytracc.com returns HTTP 301 and redirects to HTTPS. • A valid TLS certificate and HSTS are enabled. • Chrome and other browsers do not display this warning. • The issue is reproducible only in Microsoft Edge Website Typo Protection. This false positive is discouraging customers from accessing the website. Anyways to resolve this please? Affected domain: https://paytracc.com Incorrect suggested domain: paytrace.comMicrosoft Edge Enterprise — Intermittent Blue Coat Proxy Authentication Prompt
Product: Microsoft Edge for Business / Microsoft Edge Enterprise Component: Proxy authentication, HTTP networking and integrated authentication Operating system: Windows 11 Enterprise Proxy: Blue Coat / Broadcom forward proxy, port 8080 Proxy authentication configuration: Basic Auth/ IWARealm exact authentication method to be confirmed Affected browser: Microsoft Edge for Business Comparison browser: Mozilla Firefox, where the same behaviour has not been observed Impact: Intermittent interruption of browsing and loss of access to existing tabs until the user reauthenticates We are experiencing intermittent, unexpected proxy authentication prompts in Microsoft Edge for Business. The dialog states: Sign in to access this site. The proxy http://[bluecoat-host-url]:8080 requires a username and password. Your connection to this site is not secure. The prompt appears sporadically, sometimes while the browser is idle or while tabs displaying otherwise idle ServiceNow, deepl etc. pages cannot be accessed until user reauthenticates with autofill if proxy password is saved in order to be able to access those sites again. No explicit navigation or user interaction is necessarily taking place when the dialog appears. This behaviour was not observed previously and has become noticeable more recently especially since the migration of a lot of our workloads to the microsoft cloud. Firefox does not appear to exhibit the same symptom under comparable. We suspect that a background request, a new or reused proxy connection, proxy-session reauthentication, or an incomplete integrated-authentication exchange may be triggering the prompt. However, we have not yet identified the exact request or established whether the root cause is Edge, the proxy configuration, PAC routing, or the authentication infrastructure. usage conditions. Edge should silently authenticate to the configured enterprise proxy through the organisation's approved authentication mechanism, without unexpectedly displaying a credential prompt during normal browsing or background activity.
What is the best way to handle networking during a long-running cloud migration?
Hi everyone, I'd like to get some opinions from people who have worked on large-scale cloud migrations. Consider a migration where workloads are gradually moved from AWS to Azure over several weeks or months rather than being migrated in a single cutover. During the migration period, both environments need to remain operational. A simplified architecture could look like: AWS workloads | | Existing connectivity | AWS Network | | Inter-cloud connectivity | Azure Network | | Azure workloads The challenge is that applications may temporarily become distributed across both clouds. For example: • Application servers may still be running in AWS. • New application components may already be deployed in Azure. • Databases or shared services may remain in AWS temporarily. • DNS and routing may need to support both environments. • Migration tools may require connectivity to source and target environments. • Some workloads may be migrated much earlier than their dependent services. For a long-running migration like this, what architecture would you recommend? Some options I have been considering are: 1. Site-to-site VPN between AWS and Azure 2. Dedicated connectivity such as AWS Direct Connect + Azure ExpressRoute 3. A combination of dedicated connectivity and VPN for backup 4. A hub-and-spoke architecture in Azure with controlled connectivity back to AWS 5. Application-level connectivity rather than relying heavily on network-level connectivity Another question is how you would handle routing. Would you prefer to: • Keep AWS and Azure routing domains mostly independent? • Use a centralized hub for cross-cloud traffic? • Advertise routes dynamically using BGP? • Restrict cross-cloud communication to only the application dependencies that require it? For a migration lasting several months, what approach have you found to be the most reliable and easiest to operate? I'm particularly interested in lessons learned around: • Routing • DNS • Security • Latency • Failover • Monitoring • Avoiding unexpected cross-cloud traffic costs Would appreciate experiences from anyone who has handled a production AWS-to-Azure or Azure-to-AWS migration.
Force a specific default lock screen and logon image
Dear, I currently have a DC deployed on Windows Server 2019. i want to configure a specific default image on lock screens on Windows 10 pro clients via group policy. Is this possible or is it only compatible with Enterprise or Education editions? Thanks in advance,
Assign IP Address for Windows Server 2025 VM on Hyper-V
I have built my first Windows Server 2025 VM on HyperV and trying to assign an IP address. I want the VM's to be like an actual server so I Created an external vswitch. The HyperV server IP is 172.16.1.41 with a physical gateway of 172.16.1.5. I have tried to assign the new VM with 172.16.1.42/255.255.255.0 and the Gateway is 172.16.1.5 also. However, I cannot get a positive ping. Do I need another VSWITCH configured or what am I missing?
Hyper-v Ubuntu 26.04LTS Multiple DHCP entries
Good evening, am running windows server 2022 datacenter edition, which is running multiple hyper-v machines. I have been installing a new instance of ubuntu 26.04.1LTS but have noticed something weird. Maybe you could assist. Issue: When fresh install Ubuntu 26.04.1 into a VM using hyper-v, I notice 2 IP addresses appear in windows DHCP (192.168.40.20, 192.168.40.21). When I shut down the instance only one disappears (192.168.40.21). If I delete 192.168.40.20 and restart the VM instance both Ip addresses reappear in DHCP. Points to note: Image was downloaded direct off the website with no changes (have redownloaded to make sure image is not broken) Have tried using a different name for the server Have noticed the ubuntu instance only picks up one address (192.168.40.21) for the adaptor. Am unable to ping 192.168.40.20 or connect to that address via ssh. Would anyone have any idea, where the second IP address would be coming from in DHCP?Central pki
Has anyone implemented a centralised PKI where the Root CA is stored in Azure Key Vault and workloads can automatically obtain the Root CA when they are deployed, as well as receive updated versions when the Root CA needs to be rotated or renewed? I’m looking to implement a centralised PKI for an Azure hub-and-spoke architecture, where workloads across the spokes can automatically obtain and trust the Root CA. The workloads could include VMs, AKS, containers, App Services and Azure Functions. I’m aware that Azure Machine Configuration can be used to deploy certificates to VMs, but this is specific to VMs. What is the recommended approach for distributing the Root CA to the other Azure workload types using a consistent and automated mechanism? Ideally, I’d like the solution to be fully automated, so that new workloads receive the current Root CA during deployment and existing workloads automatically receive updated versions whenever the Root CA is rotated or renewed. I will be deploying the root ca in a key vault via terraform a project for the root ca only to update whenever is needed and then each resources to be able to get the latest root ca. Has anyone implemented something similar, or could you provide guidance on the recommended architecture and distribution mechanism?
