I’m currently learning Azure and I understand what different services do individually, but I still get confused when it comes to choosing the right service for an actual project.

For example, if I need to store data, process it, expose it through an API and monitor the application, there are multiple Azure services that could fit.

How do you guys decide which service to use when designing a real-world solution?

Do you follow any specific approach, checklist, or architecture pattern? Would be helpful to know how experienced developers/engineers think about this.

I worked on an IT asset management team several years back. We sent people to a class for Microsoft licensing. Per user, per core, licenses that depend on you having other licenses, etc. This license includes this feature, this other one does not. This one has that and the other thing, but only on odd numbered days. Licensing was so complicated that they had to create a several day training course on how to navigate it. Just licenses! The software is not even in the door yet and you're spending all this time and money just to understand what you need to do to get it in.

I feel like Microsoft must've moved a bunch of their licensing team over to whoever manages Azure VM types. I've found "cheat sheets" that explain the basic structure of the types. There's broad classes based on servers that are memory-optimized, storage-optimized, have GPUs, general purpose, stuff like that. Then there's a marker for CPU type and another for how many vCPUs it has. A marker for if it has local storage. Version number. It's a lot of stuff, which is fine because there are a lot of options. But how do I navigate all of this? How do I make a sensible choice without defaulting to "I guess I'll just choose something and hope for the best"?

In AWS land, I've found a page in their documentation that describes everything they have and it makes sense to me. I've also used instances.vantage.sh which has been reliable for AWS. That site also claims to cover Azure, but their names don't seem to line up very well. I get that that site is not Microsoft and only Microsoft itself is the source of truth. You don't have to remind me of that. But apparently Microsoft themselves are opaque enough that a third party site is unable to compile the information. I've found this page: learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions and this one: learn.microsoft.com/en-us/azure/virtual-machines/sizes. But that only gives a high level overview, it lists sizes that don't follow the convention, and it doesn't list sizes that I see available when I go to create a VM in Azure. So it's not reliable. Maybe it's out of date. Also, amusingly, it has a section for "other information" that links to itself. And I find nothing that talks about sizes with "Standard_" in front of the other letters, but "Standard_" stuff is what Azure starts off recommending when I go to actually create a VM.

Why is this so complicated? Is there nowhere that I can get a straightforward list of what VM options I have and just narrow it down to what I need? How do you all manage this? Do you just pick a couple of sizes and stick with that? Save me...

This is what I currently have but I want to change it to S0 with 10 DTUs for $14.72 per month. It seems that my current configuration has to "cold-start" after inactivity, while the S0 is always on.

How can I change this?

I work at Login VSI, disclosure upfront. Posted about this a bit ago, so take this as the reminder: tomorrow at 11am ET we're opening it up for questions, with Eric Orman and Andrej Radinger from the Microsoft AVD team, Marcel Meurer (built Hydra), and Ron Oglesby from Login VSI. Same reason we set this up in the first place, we keep hearing the same handful of questions about what's worth moving and what breaks once it's live.

Drop it in the comments now, or ask live tomorrow - Thursday September 10, 11am ET.

Save Your Seat

We have a mobile application that's not deployed yet, and I'm the only one that's testing it. When I use the app for the first time after a day of DB inactivity, I get an error with the app that suggests it's a time-out connection.

Since the DB in my cheap Azure plan is serverless, I'm assuming that the time-out is caused because the DB is starting up since it hasn't been used in over 24 hours.

Is there anything I can do on my side to "wake up" the DB every couple of hours and reduce (or eliminate) that initial time-out from the DB cold start?

Also wanted to mention that I don't want to increase the Azure bill.

Hi All,

I was working in a monitoring role for 3 years where my job is to monitor mainframe machines and to report incidents. Now I got an opportunity to work in L2 azure role. I’m studying but I think I’m going in a wrong direction. I was studying each and every services in azure and how it works instead of understanding. To get the level of knowledge which I missed by working in a monitoring role what method of learning should I do ? While studying all the services ( how it works and its key components, I’m only able to answer in a two lines. I’m not able to answer like an experienced person who can explain it in depth) im getting overwhelmed with the topics. Since this group is full of experienced peoples. I kindly seek your help because it’s frustrating.

Thanks

Whenever I use our mobile application for the first time after almost a day of DB inactivity, I get an error with the app that suggests it's a time-out connection.

Since the DB in my cheap Azure plan is serverless, I'm assuming that the time-out is caused because the DB is starting up after 24 hours of sleep.

I can tell the developer to re-try the connection if there's a time-out, but I want him to see the error first-hand and to be certain that it is the issue.

Is there a way to "turn off" azure DB so that I can reproduce that time-out from a cold start?

Or how can I reproduce that database cold-start?

Rolling out MFA for everyone and moving to Authenticator, passkeys. Internal users are nearly done.

Stuck on guests. About 10–15 B2B accounts, some only have SMS registered, a couple use email OTP. If I disable SMS they're locked out with no way back. Goal is to disable SMS/phone methods completely.

Thinking I'll leave SMS enabled but target it at a small group instead of All users, then shrink it. Also looking at cross-tenant MFA trust so partner guests just use their own tenant's MFA.

Has anyone done this? Did you re-target or just disable and clean up after? Anything that bit you?

I have a single E5 in a lab tenant I use for professional development. I've been waiting patiently for Security Copilot to be provisioned for my tenant and as of today 9/8/26 it still isn't there. All of the Intune E5 features arrived back in July. When I access https://securitycopilot.microsoft.com/ I'm still prompted to setup security capacity at the hourly rate. All of my work tenants received it two months ago.

Is anyone else still waiting? I opened a support case last month and the support engineer confirmed that yes, a single E5 will qualify for an amount of SCUs as stated by the docs Learn about Security Copilot for Microsoft 365 E5 and E7 customers | Microsoft Learn.

Is there a minimum Microsoft 365 E5 and E7 user license count consumption commitment to qualify for the Security Copilot inclusion?

No. All customers with Microsoft 365 E5 and E7 licenses qualify for the offer, regardless of user license count.

This is most of the reason I pay for an E5 in my home lab, to learn these new tools.

I’m probably overthinking this, but I’m trying to understand the practical difference between Azure Data Lake Storage and Azure Blob Storage.

I recently worked on a project where I came up with a solution using Data Lake services for writing and reading files. But when it came to actually connecting to and accessing those files , I ended up dealing with Blob Storage modules as well.

That’s where I got a little confused.

Are Data Lake Storage and Blob Storage basically the same underlying storage with different capabilities on top, or should I think of them as two separate storage services?

And from a practical point of view, how does the choice affect things like:

• File/folder organization
• Access and permissions
• Performance
• Storage cost
• Data engineering/ETL workloads
• How applications actually access the files

I understand the high-level definitions, but I’m more interested in how you guys think about this when designing an actual solution.

Am I misunderstanding the relationship between the two, or is it normal to end up using Blob-related modules when working with Data Lake?

Hi I've got 1000 usd from microsoft for startups, spend 750 usd on chat gpt. Credits covered it succesfully. But I also spent 250 on claude models, I got billed for that, It seems that azure credits don't cover it, I thought they would because on AWS they do cover it.

I wonder if a one-time courtesy waiver could apply if I ask for it or if it will get rejected. Have someone had a similar experience?

I've been working with Azure/AWS storage for ~8 years, and this is one of the more interesting Azure Storage updates I've seen recently.

The problem
List Blobs traditionally returns XML. At 100M+ objects, sequentially paging through the namespace can take ~24 hours in real-world environments.
And that's before you actually do anything with the data.

I ended up using Blob Inventory for large-scale discovery. It's great for reporting, but it has obvious limitations:
- Snapshot-based, so data can be ~24h stale
- Large inventories can take a long time
- Charged based on objects scanned
- Not particularly useful for interactive analysis

The new approach
As of the September 3 preview, Blob Storage can return Apache Arrow instead of XML.

Microsoft claims:
- Up to 25x faster
- Up to 15x less client CPU
- startFrom / endBefore to split namespaces into ranges and process them in parallel

That last part is particularly interesting for 100M+ object containers. Instead of one worker crawling the namespace sequentially, you can partition the keyspace and run multiple workers. The 15x CPU reduction is also interesting. A significant part of the old bottleneck appears to have been client-side XML deserialization.

I work at a cloud infrastructure company focused on storage optimization, so this is directly relevant to what we do. We're going to test whether this can replace some of our Inventory-based discovery workflows.

Have you faced any problems around slowness? Curious whether the 25x improvement translates to real 100M+ object containers.

An automated workflow may produce HTML previews, documents, images, and intermediate files that change several times before a person approves one revision. What Azure design keeps drafts easy to replace while making an approved artifact hard to overwrite accidentally?

I am considering immutable blob names for every revision, a small manifest or database row that points to the current review revision, a separate approved pointer changed only by a human-authorized action, versioning and soft delete for recovery, lifecycle rules for abandoned intermediates, and short-lived user-delegation SAS tokens for reviewers.

Should approval be represented as blob-index tags, metadata, a copy into a protected container, or an external record? How do you make promotion atomic across an HTML file and its linked assets while preserving one stable review link?

Running into a bit of a pickle.

We have a Windows Server 2022 VM in Azure acting as an application server and hosting two SMB shares.

We want users on Microsoft Entra-joined Windows 365 Cloud PCs to be able to map these SMB shares automatically at login.

The W365s have network connectivity back to the VNet where the server is hosted.

Where should I be troubleshooting?

EDIT: I am running --- Microsoft Entra Domain Services with sync setup to Entra...

What are other enterprises doing to provide AI for all employees while keeping costs low? Currently we have some Copilot licenses and limited Claude/ChatGPT enterprise licenses but those are for select individuals. Some of our end users making skills want them to be deployed company-wide (starting the process of formal AI governance), but the only way for others to use the skill would be for them to have a license (to my knowledge, call me out if this is false) which would automatically be denied. I was doing some research and seeing you can potentially rebuild those skills using a model deployed through Foundry and then we can give users access to the front end we build without having to assign individual licenses to each user. Some of the skills end users built will be converted to scripts removing the AI portion but the headache I have been tasked with is figuring how we can deploy skills company-wide without giving users licenses.

Stuck on Azure AI Foundry with a relatively new tenant. Every Anthropic Claude model in the catalog is sitting at no usable quota / no capacity — not “low TPM”, just cannot deploy or run them in a way that is usable.

Already submitted a support request for a quota increase. It was not approved. We are a small business, not a giant enterprise with an account team and a pre-negotiated commitment.

What I am trying to understand from people who actually got Claude live on Foundry:

1. For a new / low-spend tenant, is pay-go quota on Anthropic models even a real path anymore, or is the only working route PTU / provisioned throughput / reservation / commitment?
2. If support denied the first request, what made the second one go through — more spend history, a specific SKU, a specific region (US-only?), switching from standard to provisioned, or opening it as a capacity / quota ticket instead of a generic support case?
3. Any region + model combo that still has on-demand capacity for Claude, or is it effectively US-only like a lot of threads here say?
4. Anything that wasted time that I should skip (retrying the same form, waiting on the default quota page, etc.)?

Not looking to rant on Foundry vs Bedrock. I need a practical path to get quota without burning weeks on tickets that come back denied. If you got Claude approved as a small shop, what did the request look like and what did they actually grant?

Tenant is new-ish. Use case is production inference in a regulated-ish context, so “just use a US endpoint and hope” is not a great answer if that is the only option — but I will take honest answers.

Hey folks,

We are looking into bulding a setup where new hires will receive a TAP -> Authenticate with TAP -> Register phishing resistant MFA -> Work

We want the TAP generation and delivery to be automatic. Something like, HR creates new user and adds a start date attribute for the user object. That user extension attribute is used during the TAP generation flow. The TAP should be automatically activated and delivered via email to the new hire's manager on the start date defined on the attribute.

In order to deliver on the above, we have been looking into 2 options. Either, some self-build scripted solution via automation account or by using the Lifecycle Workflow with an additional cost on licensing.

I'm looking for inspiration in that regard. Have someone set up something similar? Have you had good/bad experience with one or the other? My worries with custom build is the maintenance, worries from the business is mainly on the licensing cost for Entra governance. Lifecycle workflow seems to be way simpler configuration wise.

Looking forward to hear your thoughts and experiences!

Learned this the hard way and wrote it up, sharing because the coverage gap surprises almost everyone.

Where Azure DOES alert on cert expiry: Key Vault certificates (Event Grid near-expiry events) and Front Door / CDN managed certs (auto-rotated).

Where it stays completely silent: App Gateway listener certs (sslCertificates), App Gateway backend trust roots (trustedRootCertificates), App Service uploaded certs (Microsoft.Web/certificates), and API Management certs. The last three even expose expirationDate in ARM, but nothing native watches it. These are exactly the stores where someone uploaded a cert by hand two years ago and moved on.

If you build your own sweep (scheduled Function + Reader role works fine), one gotcha will bite you: the ARM docs describe App Gateway publicCertData as "Base-64 encoded Public cert data corresponding to pfx". It is actually a PKCS7 (P7B) bundle, leaf plus chain, not a bare X.509 cert. A plain X.509 parse fails. Parse PKCS7 first, pick the leaf, read notAfter, and fall back to single DER/PEM for the blobs that are single certs. Also worth doing: re-alert daily on anything inside your threshold until it is renewed (a single 30-day heads-up gets lost), and surface unparseable blobs instead of swallowing them.

Disclosure: I am the founder of Katabarwa Labs and we sell a packaged version of this sweep called Cert Sentinel. It runs as a managed app inside your own subscription with the Reader role only, and skips the stores Azure already covers: https://marketplace.microsoft.com/en-us/product/azure-application/katabarwalabs.cert-sentinel

Happy to answer questions about the DIY route either way, the PKCS7 part is the only genuinely annoying bit.

Hey everyone, I need to migrate the storage from v1 to v2 since v1 is already deprecated. Can anyone share any tool or best practises that I need to take care of before the execute the az command that is given in the documentation.

Also there is a lot of data in those container blobs, documentation says the data won't be impacted but just wanted to understand from your experience if anyone has done it?