URGENT: Microsoft Edge incorrectly flags paytracc.com as typosquatting after multiple reports
Microsoft Edge Website Typo Protection incorrectly flags https://paytracc.com as a possible misspelling of paytrace.com. Paytracc.com is the legitimate official domain of PayTracc, an independent financial technology product. “PayTracc” is the intentional registered brand spelling and is not impersonating or affiliated with PayTrace. The warning has continued despite repeated reports through the “Report that this site URL is not a misspelling” option. Technical verification: • https://paytracc.com returns HTTP 200 OK. • http://paytracc.com returns HTTP 301 and redirects to HTTPS. • A valid TLS certificate and HSTS are enabled. • Chrome and other browsers do not display this warning. • The issue is reproducible only in Microsoft Edge Website Typo Protection. This false positive is discouraging customers from accessing the website. Anyways to resolve this please? Affected domain: https://paytracc.com Incorrect suggested domain: paytrace.comMicrosoft Edge Enterprise — Intermittent Blue Coat Proxy Authentication Prompt
Product: Microsoft Edge for Business / Microsoft Edge Enterprise Component: Proxy authentication, HTTP networking and integrated authentication Operating system: Windows 11 Enterprise Proxy: Blue Coat / Broadcom forward proxy, port 8080 Proxy authentication configuration: Basic Auth/ IWARealm exact authentication method to be confirmed Affected browser: Microsoft Edge for Business Comparison browser: Mozilla Firefox, where the same behaviour has not been observed Impact: Intermittent interruption of browsing and loss of access to existing tabs until the user reauthenticates We are experiencing intermittent, unexpected proxy authentication prompts in Microsoft Edge for Business. The dialog states: Sign in to access this site. The proxy http://[bluecoat-host-url]:8080 requires a username and password. Your connection to this site is not secure. The prompt appears sporadically, sometimes while the browser is idle or while tabs displaying otherwise idle ServiceNow, deepl etc. pages cannot be accessed until user reauthenticates with autofill if proxy password is saved in order to be able to access those sites again. No explicit navigation or user interaction is necessarily taking place when the dialog appears. This behaviour was not observed previously and has become noticeable more recently especially since the migration of a lot of our workloads to the microsoft cloud. Firefox does not appear to exhibit the same symptom under comparable. We suspect that a background request, a new or reused proxy connection, proxy-session reauthentication, or an incomplete integrated-authentication exchange may be triggering the prompt. However, we have not yet identified the exact request or established whether the root cause is Edge, the proxy configuration, PAC routing, or the authentication infrastructure. usage conditions. Edge should silently authenticate to the configured enterprise proxy through the organisation's approved authentication mechanism, without unexpectedly displaying a credential prompt during normal browsing or background activity.
What is the best way to handle networking during a long-running cloud migration?
Hi everyone, I'd like to get some opinions from people who have worked on large-scale cloud migrations. Consider a migration where workloads are gradually moved from AWS to Azure over several weeks or months rather than being migrated in a single cutover. During the migration period, both environments need to remain operational. A simplified architecture could look like: AWS workloads | | Existing connectivity | AWS Network | | Inter-cloud connectivity | Azure Network | | Azure workloads The challenge is that applications may temporarily become distributed across both clouds. For example: • Application servers may still be running in AWS. • New application components may already be deployed in Azure. • Databases or shared services may remain in AWS temporarily. • DNS and routing may need to support both environments. • Migration tools may require connectivity to source and target environments. • Some workloads may be migrated much earlier than their dependent services. For a long-running migration like this, what architecture would you recommend? Some options I have been considering are: 1. Site-to-site VPN between AWS and Azure 2. Dedicated connectivity such as AWS Direct Connect + Azure ExpressRoute 3. A combination of dedicated connectivity and VPN for backup 4. A hub-and-spoke architecture in Azure with controlled connectivity back to AWS 5. Application-level connectivity rather than relying heavily on network-level connectivity Another question is how you would handle routing. Would you prefer to: • Keep AWS and Azure routing domains mostly independent? • Use a centralized hub for cross-cloud traffic? • Advertise routes dynamically using BGP? • Restrict cross-cloud communication to only the application dependencies that require it? For a migration lasting several months, what approach have you found to be the most reliable and easiest to operate? I'm particularly interested in lessons learned around: • Routing • DNS • Security • Latency • Failover • Monitoring • Avoiding unexpected cross-cloud traffic costs Would appreciate experiences from anyone who has handled a production AWS-to-Azure or Azure-to-AWS migration.
Central pki
Has anyone implemented a centralised PKI where the Root CA is stored in Azure Key Vault and workloads can automatically obtain the Root CA when they are deployed, as well as receive updated versions when the Root CA needs to be rotated or renewed? I’m looking to implement a centralised PKI for an Azure hub-and-spoke architecture, where workloads across the spokes can automatically obtain and trust the Root CA. The workloads could include VMs, AKS, containers, App Services and Azure Functions. I’m aware that Azure Machine Configuration can be used to deploy certificates to VMs, but this is specific to VMs. What is the recommended approach for distributing the Root CA to the other Azure workload types using a consistent and automated mechanism? Ideally, I’d like the solution to be fully automated, so that new workloads receive the current Root CA during deployment and existing workloads automatically receive updated versions whenever the Root CA is rotated or renewed. I will be deploying the root ca in a key vault via terraform a project for the root ca only to update whenever is needed and then each resources to be able to get the latest root ca. Has anyone implemented something similar, or could you provide guidance on the recommended architecture and distribution mechanism?
Hyper-v Ubuntu 26.04LTS Multiple DHCP entries
Good evening, am running windows server 2022 datacenter edition, which is running multiple hyper-v machines. I have been installing a new instance of ubuntu 26.04.1LTS but have noticed something weird. Maybe you could assist. Issue: When fresh install Ubuntu 26.04.1 into a VM using hyper-v, I notice 2 IP addresses appear in windows DHCP (192.168.40.20, 192.168.40.21). When I shut down the instance only one disappears (192.168.40.21). If I delete 192.168.40.20 and restart the VM instance both Ip addresses reappear in DHCP. Points to note: Image was downloaded direct off the website with no changes (have redownloaded to make sure image is not broken) Have tried using a different name for the server Have noticed the ubuntu instance only picks up one address (192.168.40.21) for the adaptor. Am unable to ping 192.168.40.20 or connect to that address via ssh. Would anyone have any idea, where the second IP address would be coming from in DHCP?
Assign IP Address for Windows Server 2025 VM on Hyper-V
I have built my first Windows Server 2025 VM on HyperV and trying to assign an IP address. I want the VM's to be like an actual server so I Created an external vswitch. The HyperV server IP is 172.16.1.41 with a physical gateway of 172.16.1.5. I have tried to assign the new VM with 172.16.1.42/255.255.255.0 and the Gateway is 172.16.1.5 also. However, I cannot get a positive ping. Do I need another VSWITCH configured or what am I missing?Azure Networking: Request for Granular Control of “Allow Azure Services and Resources”
I would like to get the Azure community’s thoughts on a networking/security improvement that I believe could help organizations implement a stronger least-privilege model. Several Azure resources provide an option similar to: “Allow Azure services and resources to access this resource.” This is useful when an Azure service needs to access another Azure resource, but the current option can be quite broad. Example: Power BI → Azure SQL For example, suppose Power BI Service needs to access an Azure SQL Server. The actual requirement might be: Power BI → Specific Azure SQL Server = Allow However, the available option may require enabling: “Allow Azure services and resources to access this server” This effectively creates a much broader trusted-service exception than the actual requirement. Ideally, I would like to see something like: Azure SQL Server │ ├── Power BI Service → Allow ├── Azure Data Factory → Deny ├── Azure Functions → Deny ├── Azure App Service → Deny └── Other Azure Services → Deny Proposed improvement Could Microsoft provide an additional option such as: “Allow selected Azure services and resources” where customers can explicitly select which Azure service/resource is allowed to bypass the network restriction? Depending on the Azure service, the selection could potentially be based on: Specific Azure service Specific Azure resource Resource ID Subscription Resource group Tenant Managed identity / Entra identity Specific service instance For example: Trusted Azure Services / Resources Power BI → Production Analytics → Allow All other Azure services → Deny Why I think this would be useful This would give customers a middle ground between: Disabling public access and implementing Private Endpoint/private connectivity, or Allowing all Azure services/resources through the broad trusted-service exception. A granular trusted-service model would allow: Only the Azure service/resource that actually requires access is trusted. This would better support least privilege, Zero Trust, security, and compliance requirements. Broader Azure applicability My suggestion is not specifically for Azure SQL. The Power BI → Azure SQL scenario is just an example. I think this could be a common Azure networking capability for all Azure resources that currently support a trusted Azure services / “Allow Azure services and resources” type of bypass. I would be interested to hear from the Azure community and Microsoft: Is there already a way to achieve this level of granularity? Are there architectural/security reasons why this cannot currently be implemented? Is Microsoft considering a more granular trusted-service model? Would a feature like “Allow selected Azure services/resources” be technically feasible? I would appreciate any feedback or guidance from the Azure networking/service teams.
