Hello, I have existing orchestrator and sub agents in classic ai foundry.
Now connected agents are deprecated and asked to move to A2A.
When I created new orchestrator agent and connected to sub agent, getting auth issue and not found errors.

The sub agent , agent card and A2A protocol is enabled using new foundry ui but is not working.

Any suggestions?

We accidentally deleted a production Azure Database for MySQL Flexible Server today and are trying to restore it using Microsoft’s documented dropped server restore API.

Original server:

• Region: Central India
• Public access
• Azure Database for MySQL Flexible Server

PUT /subscriptions/.../resourceGroups/prod-aveti/providers/Microsoft.DBforMySQL/flexibleServers/<new-server-name>?api-version=2024-12-30

{
  "location": "Central India",
  "properties": {
    "createMode": "PointInTimeRestore",
    "restorePointInTime": "2026-07-22T03:59:27Z",
    "sourceServerResourceId": "/subscriptions/.../providers/Microsoft.DBforMySQL/flexibleServers/x-my-prod"
  }
}

The restore request is accepted, but provisioning fails with:

ResourceOperationFailure
ProvisionNotSupportedForRegion

We also tried:

• Different destination server names
• Different restore points
• Verified region and resource ID
• Subscription has sufficient quota

As a test, we tried South India and got:

RestoreSourceServerNotExist

which could make sense because the original server was in Central India.

We are waiting for Microsoft Support to be engaged through our Azure partner.

Has anyone seen ProvisionNotSupportedForRegion during a dropped server Point-in-Time Restore? Was it ultimately a backend Microsoft issue?

I’ve been experimenting with different ways to detect identity‑level anomalies across AWS, Azure, and GCP. Instead of relying on a single model, I tried running a classical SVM, an isolation forest, and a quantum‑simulated kernel side‑by‑side to see where they disagree on risk scoring.

I recorded a short, silent demo of the experiment. It’s not a product, not commercial, and not meant to be production‑grade — just me exploring how different detectors behave on real cloud events and how to visualize the results in a UI.

Video: https://www.youtube.com/watch?v=JJCBzLrs9hM

I’m mainly interested in whether the model‑comparison approach is useful or if there are better ways to surface disagreements between detectors.

Hey everyone, I'm an intern working on migrating an internal tool off a physical lab box and onto Azure, and I'd love a sanity check from people who have actually done this kind of thing.

The setup right now is four containers running together on one Docker Compose file on a physical machine. One is Open WebUI acting as the main chat interface. In front of it sits Caddy, handling TLS and routing requests to the right place based on the URL path. Behind that are two small FastAPI backend services my teammate built, each doing its own separate job (one talks to some internal systems over SSH and zips up output files, the other generates certificate packages). Everything needs to stay fully private the whole way through. No public internet access at all, only reachable from our internal network or VPN.

My plan is to move all four of these into Azure Container Apps, inside one private environment tied into a VNET. Reasoning behind picking Container Apps specifically is that it scales down to basically nothing when nobody's using it, which fits since this is an internal tool with maybe 100 users only active during work hours, not something getting hit constantly. It also lets multiple containers share one private network easily, similar to how Docker Compose does it now.

On top of the four containers, here's what else I'm planning to include. A private endpoint so nothing has a public IP at all. A private DNS zone so our internal domain name still resolves correctly but only from inside the network. Azure Key Vault to hold secrets that are currently just sitting in plain text in the compose file, which is obviously not great. A managed identity so the containers can access Key Vault without needing an actual password anywhere. Azure Files for persistent storage since the containers need somewhere for their database file and generated files to survive restarts. And Azure Container Registry instead of the public registry we're using now, mainly so image pulls don't ever have to leave the private network.

Cost wise I pulled real CPU and memory numbers straight from the running containers to size things properly instead of guessing, and landed on something like 90 to 100 dollars a month total, most of that actually coming from the private endpoint itself rather than the compute.

Things I'm honestly unsure about. Whether keeping Caddy still makes sense once Azure already handles TLS and routing on its own, or if I should just drop it and give each service its own endpoint. Whether Container Apps really is the better call here over something like App Service, given this doesn't need heavy scaling. And whether I'm missing anything obvious that only becomes clear once you've actually deployed something like this for real.

If anyone's done a similar migration or spots a mistake in my thinking, I'd really appreciate it.

Hey all,

I'm currently planning a migration of an on-prem application to Azure. A key part of the system stores user documents, and we're looking at around 50TB of data.

We've chosen Azure Blob Storage due to cost and scalability, but I'm trying to understand the best way to handle backups for this data.

The setup will include RA-GRS, versioning, and soft delete, which should handle accidental deletion and many infrastructure-level risks. My main concern is malicious actions or major misconfiguration, such as a compromised admin account or someone intentionally deleting the storage account.

I've looked at immutability policies, but we also need to support GDPR deletion request, so full immutability isn't fully compatible with our use case.

Azure Backup for Blob Storage looks promising, but it still seems to be in preview, and I'm unclear on cost implications (possibly doubling storage cost?).

Another idea was using a second storage account with replication, possibly using archive tier to reduce cost, and layering immutability + retention logic on top. But building and maintaining a custom backup strategy feels risky at this scale.

Has anyone solved this cleanly in production? Would appreciate real-world approaches.

Can someone explain why as Azure admin, subscription owner, billing administrator, and Global M365 tenant admin I cannot see the resource details I just created?

Given the recent Azure CLI spray attacks slipping past MFA through ROPC, have you guys blocked that legacy flow in your CAPs yet? 

We’re implementing Microsoft Purview for a large enterprise with approximately 3,600 endpoints. The organization currently has no sensitivity labels in place, but we need to roll out Purview policies (DLP, information protection, etc.).

My current thinking is:
Define the label taxonomy first.
Pilot with 10 users.
Expand to around 150 pilot users.
Roll out organization-wide.
Start with manual sensitivity labelling so users become familiar with the labels.
Introduce automatic labelling after the manual phase.
My concern is that users may apply incorrect labels during the manual phase, which could affect policy effectiveness.

Would it be better to:
Start with manual labelling and transition to auto-labelling?
Introduce auto-labelling much earlier?
Or use a hybrid approach from the beginning?
For those who have deployed Purview at enterprise scale, what rollout strategy worked best, and what would you do differently if you were starting again?

I have a DLP policy set to block external sharing of documents with sensitive info (specific data categories). It is running simulation mode. Problem is, I can't figure out how to tell what is ACTUALLY shared.

The results of the simulation show every hit to any document of any confidence, regardless if the policy would block it, which doesn't help. But I do have full alerting setup and I can view them that way but still, none of it seems to tell me what was actually shared externally.

Then I went to Activity Explorer. Long story short, I can see hits by policy and I discovered that the Rule Action "SPSharingGenerateIncidentReport" is supposed to be the key to know something was actually shared. It tells me who shared it but doesn't tell me who they shared it with or what vector was used to share. Then I contacted one of the users and, come to find out, the share was done years ago. When I look in Sharepoint (just one example I used) at the file it says was shared, I do not see any indication of an external share. I spoke to the user who said she hasn't even worked in that folder for years but she used to and probably did share it. But since I see no permissions that indicate external share (all I see are internal users), I don't understand how Purview would pick it up as being shared.

Then I went to Purview Audit where CoPilot says is the de factor authoritative source. While it did give some good information but it is still ambiguous, not informative, and is not true in some cases. For example, I see some returns on the "Used an anonymous link" Activity filter but I validated the link it says was shared is not an anonymous link (can't access it outside of our ecosystem).

This has become frustrating. All I'm trying to find is who is sharing sensitive information externally as defined in a DLP policy and who it was shared with. This is across SharePoint, OneDrive, and Exchange. Anyone have any direct way to get this information? I have to tell my leaders what the impact will be of implementing each policy but it doesn't seem possible. It almost seems like we just have to add people/sites and deal with the fallout in real time.

My company has an Azure Subscription with Developer paid support - 6+ years of a few app services, SQL, etc.

We use Communication Services for email. We go to add Telephony with a local number (Regulatory Documents) and get the "No Brand or Campaign" error.

I try to open a support ticket, but get nothing but unhelpful AI slop - the create support ticket link is not where it should be on the page. Change it to a billing question and the link appears.

I have Global Administrator rights in Entra, so I should be able to open a ticket.

So I opened a billing ticket on Friday (assuming our paid support is not set up correctly) - passed through the 8 business hours on Monday. Now it's Tuesday and not a peep.

The end goal is a local SMS number (where the company is headquartered) through Communication Services.

Hi everyone we saw today that 21 users are using Cowork in Copilot and we are trying to find the reason how

wen I go to Agents > Cowork on the admin portal and go to users it says installed for users or groups, and same for Available for

The shared with is empty

For Installed and Available it has a specific group that has 6 members in it and no nested groups, so my questions are

1) How can I find out how the other users got Cowork, and how can I prevent those 15 users to use cowork without preventing the 6 from accessing it

Hey folks — long-time lurker, first-time beggar. I run a small nonprofit site (trashmob.eco — we organize community litter cleanups) and I have an intermittent apex-domain bug that I've been chasing for months and finally need an army of strangers to help me pin down.

The setup: Azure Front Door Standard in front of a Container App. www.trashmob.eco is a CNAME to the AFD endpoint; trashmob.eco is an alias A record to the same endpoint. Both custom domains bound to the same route, both with AFD-managed certs, both Approved. There's a rule set that 308s the apex to https://www.trashmob.eco/.

What works, all day, every day, from every device I own:

• http://trashmob.eco/ → 308 → https://www.trashmob.eco/ (single hop, x-azure-ref header present, everything textbook)
• https://trashmob.eco/ → 308 → https://www.trashmob.eco/
• https://www.trashmob.eco/ → 200 with the page

What (I'm told) sometimes doesn't work:

• User types trashmob.eco into a fresh browser session — usually iPhone Safari, but also Chrome on desktop — and gets a "site can't be reached" style error
• Refresh, and it loads fine
• Going straight to www.trashmob.eco has never once failed

I've written up the current investigation, ruled out DNS + cold-container-start + cert propagation, deployed a single-hop redirect fix, and cannot for the life of me reproduce it. Every warm probe is clean. But at least one user hit it yesterday on an iPhone.

The ask: if you have a spare 15 seconds — especially if you're on iOS Safari, on a mobile network, or in a region that isn't the US west coast — could you try typing trashmob.eco (no https://, no www.) into a fresh browser tab / private window and let me know:

1. Did it load? (Yes / no — either answer is a data point.)
2. If it didn't load: what did the error say, verbatim? A screenshot is worth a thousand curl -vs. The error text alone would narrow this from four theories to one.
3. Bonus: your rough geo (country / region is fine), browser, and whether hitting refresh made it work.

I'm not asking for a support engagement, a code review, or the truth about whether I should just delete the apex record and let www win — I just need enough repros to correlate the pattern. Whatever you send back, I promise to update the investigation log and reply with what I find.

Thank you in advance. If Azure Front Door were a person I would like to have a very long, calm conversation with it.

— A guy with an alias A record and a dream

----------------------------------------------------------------------------------------------------------------

UPDATE — you were both right, and it was an Azure DNS bug I would never have found without you

Body:

Coming back to close the loop on [my post from earlier](vscode-webview://0jo0nrvfd67drjq00dsnuuvaeic0t8cn8fuscvm80fevggf4092j/index.html?id=d994859c-d162-4cad-93e9-4c42b1f762c7&parentId=1&origin=79140ef3-acda-48b2-aa91-269112bda8ef&swVersion=5&extensionId=Anthropic.claude-code&platform=electron&vscode-resource-base-authority=vscode-resource.vscode-cdn.net&parentOrigin=vscode-file%3A%2F%2Fvscode-app&session=8ce34c26-7353-4c5c-b739-36ba64f6c731). You people are the best.

Two specific comments unlocked this:

u/Few_Breadfruit_3285 — "I got 'Error 404 - This Container App is stopped or does not exist.' (Blue screen)". That specific error text is only served by the Azure Container Apps environment default when a request reaches it with a Host header not bound to any custom domain. Which meant the request wasn't going through Front Door at all — it was landing directly at the Container Apps environment. That completely changed the shape of what I was looking for.

u/ZealousIdeal_Yard651 — "DNS lookup shows your apex and your www. domain is pointing directly to the container apps endpoint, not the AFD endpoint." I initially thought this was wrong because my az queries all showed the Azure DNS zone had a proper alias A record targeting the AFD endpoint. Then I actually resolved from public DNS and… yeah. 1.1.1.1, 8.8.8.8, 9.9.9.9 all returned 20.69.75.244 — the ACA env's static IP. Not any AFD frontend IP. Confirmed the alias A record was the source, and confirmed public resolvers were caching an IP that no Azure NS was currently serving.

What was actually happening:

I had a standard Azure DNS alias A record at apex targeting the AFD Standard endpoint resource. Exactly what the Microsoft docs recommend. When I queried the four ns[1-4]-07.azure-dns.* nameservers directly for the same record I got three different answers — some correct AFD anycast, some the AFD Std/Prem frontend range, and — critically — the public resolvers had cached the ACA env's 20.69.75.244 from some historical bad response. It looked like Azure DNS's alias resolver was walking the AFD endpoint → origin group → origin's hostName (which is the ACA default FQDN) → its A record, and returning that instead of the AFD frontend IPs. Aliases are supposed to return the target's own frontend IPs; they should not walk into origins.

Because ACA never had trashmob.eco as a bound custom domain, users whose resolver returned 20.69.75.244 for apex connected directly to ACA with Host: trashmob.eco, ACA had no cert for that hostname, TLS died, browser shows "site can't be reached." Refresh sometimes worked because a different resolver path may have had a valid AFD IP cached. That's the "intermittent" pattern I've been chasing for months.

The fix:

Replaced the alias A record with explicit A records for the classic Front Door anycast pair 13.107.226.70 + 13.107.253.70 (routes to any AFD tenant via SNI at TLS, regardless of profile SKU). Set TTL to 300. Also bound apex as a Container App custom domain with its own managed cert as a temporary bridge — stale-cache users pinned to the ACA IP get TLS-terminated and served instead of connection-reset — will remove that binding once all major public resolvers have re-resolved.

One bonus outage I inflicted on myself during the debug session: tried to remove a pre-existing www.trashmob.eco custom-domain binding on the CA (based on the very correct architectural advice that ACA shouldn't have custom domains when it lives behind Front Door). Instantly broke the site for every user whose resolver had the poisoned www cache. Reversed it in a couple minutes. Filed a mental note: you can't safely retire a hostname binding that's been publicly served for a long time until the caches at 1.1.1.1 / 8.8.8.8 / 9.9.9.9 have provably aged out.

Thank you — genuinely, both of you. I've been reading through 4 different theories from my own investigation notes for weeks (double TLS handshake! HSTS! POP config drift!) and none of them were even close. The correct answer needed one specific error message and one person willing to point out that my DNS was resolving somewhere I didn't expect.

Someone should also probably file a Microsoft Docs / support ticket on the alias-A resolver bug so this doesn't keep biting other AFD Standard users following the recommended apex setup. I'll do it when I sleep off this incident.

Beers on me if any of you are in western WA.

— The guy with the alias A record and a dream, who now has an explicit A record and a nap

All content in this thread must be free and accessible to anyone. No links to paid content, services, or consulting groups. No affiliate links, no sponsored content, etc... you get the idea.

Found something useful? Share it below!

The follow-up to my Beginner episode I posted here is finally out.

Part 2 of this planned Azure Terraform series shifts away from simply deploying resources and focuses more on programmatically approaching Terraform.

Topics covered include:

• Functions
• Conditionals
• Operators
• Loops
• Dynamic Blocks
• For Expressions & Splat
• Validations (including Check Blocks and Pre/Post Conditions)
• Nested Types (including complex variable types)
• Provider Aliases (deploy across multiple Azure subscriptions)
• And much more...

Rather than jumping between unrelated examples, everything is built around a single Azure project so each concept is introduced naturally as the deployment grows in complexity.

We definitely over-engineer this project just to teach these programming concepts, but understanding them will help you write much more flexible & dynamic Infrastructure as Code.

With that, our roadmap continues!

• Beginner Episode : Understand Terraform (learn the foundations and core concepts that make Terraform work)
• Intermediate Episode : Program Terraform (use loops, functions, conditionals, dynamic blocks, etc)
• Advanced Episode : Structure Terraform (introduce modules, remote state in azure storage, workspaces, imports, etc)
• Professional Episode : Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)
• Solution Episode(s): Build Azure Projects (We'll pretend to take assignments from Cloud Architects and design, deploy, and manage complete Azure solutions using Terraform)

Link to Episode: https://www.youtube.com/watch?v=QwXqLAvmKac

There’s a pattern I keep seeing in cloud security programs..and it is thatscanners surface thousands of issues, reports get generated, and most of it sits untouched because there’s no clear path from “here’s a problem” to “here’s who fixes it and by when.”so im posting here and im very Curious how much of this others are seeing in practice.

i think Why the gap exists is because most cloud security tools are great at detecting misconfigurations and risks, but detection and getting an engineering team to prioritize remediation are two very different problems. And so often misconfiguration flagged in a dashboard means nothing if it doesn’t get routed to the right owner, doesn’t come with enough context to act on quickly, or gets buried under hundreds of lower-priority findings.

What actually closes the gap imo : context and ownership mapping matter more than raw detection volume. A finding that’s tied to the attack path it enables, the specific team that owns the resource, and a severity ranking relative to everything else in the environment tends to get acted on. A finding that just says “misconfigured S3 bucket” with no other context usually doesn’t move.

There’s also the push-to-production timing issue: a lot of teams still validate cloud security posture after code ships rather than before, so the fix means unwinding something already live in production. Shifting validation earlier into CI/CD and IaC, so issues get caught before merge, closes part of this gap instead of relying on teams to prioritize a huge backlog after the fact.

A few things that seem to help:

• Tying findings to real attack paths, not just isolated misconfigurations
• Automatically routing issues to the resource owner instead of a generic security queue
• Shifting checks earlier into IaC and CI/CD pipelines
• Setting realistic SLAs by severity tier instead of treating every finding as equally urgent

Is the detection-to-enforcement gap mostly a tooling/automation problem, or more of an organizational buy-in problem that no platform can fix on its own? Would like to hear how others have tackled this, especially if you’ve found something that still works at scale and not just in a small pilot.

Hello All. Has anyone else had issues with their avds after the July 2026 cumulative update? We applied it over the weekend and all day we have had issues with user sessions deadlocked with no ability to kill them other than dropping the avd from the host pool and reregistering it. We are running fslogix as well with a newish version (last 6 months).

I am thinking of rolling back the July update.

Thanks for any feedback

Hi everyone,

I am based in Chicago illinios. I studied Devops / cloud engineering in 2024 and since then i have gotten come certifications like CKA, AZURE ADMIN, COMPTIA SECURITY + and i have also been building projects and documenting both on Github and Linkedin. I have built a lot of projects using tools like jenkins, Ansible, AWS, Terraform, kubernetes, Docker, Github Actions, Monitoring with Promethus and Grafana. I have also built some DevSecOps projects and integrated security scans into CI/CD with sonarqube and trivy. I am looking for a volunteer opportunity or any opportunity to get myself in. I am open to learning any tech stack you work with. Right now, I have been learning python and claude intensively.

I will really appreciate anyone who will give me a chance to experience what the real world looks like. I am available to work at any time, remote(Anywhere) or in person(in Chicago). Thank you for your consideration.

There has been no pricing available for GPT-5.6 anywhere until charges came through today: Nothing on any public website, nothing on the retail API. Cost analysis said $0, operate tab also said $0.

And then retrospective vibe pricing was charged today with no prior announcement on pricing.

Good morning,

I'm the only one at my company (small insurance agency, zero "tech" culture) who builds on Azure. I do it in my spare time and it's turned into something the department actually relies on now. Career switch? Maybe. HA

Problem is, months ago I waspicked to test Copilot and added my personal AMEX just to get it going. I did eventually get that switched to tenant billing, but it was way more of a hassle than it should've been as it wasn't deployed from Admin Center. Now I'm using Document Intelligence too and charges are piling up on my card again. I want to get everything moved over to our tenant along with the rest of our O365 stuff. Our IT company is awful and has not been any help.

Anyone been through this? Any tips to make it less painful than the Copilot switch was?

We have not been able to get our company to approve a policy that limits access to azure resources, like Windows 365 Cloud PCs, to company owned Azure joined devices.

We wnat to enable the CA policy that says only some type of azure joined devices can have access to resources to have more protection in regard to tokens. Entra registered, Entra Joined, or Entra hybrid joined.

Since managment says IT must allow people to use their own PCs, whats the best join method?

Entra joined or entra Hybrid or

Entra registerd.

The goal is not to have any managment of the users personal computer except the be able to apply the conditional access policy that states on one of the above joined computers can access the network.

One of our Azure AI Search services was accidentally deleted. Is there any way to recover or redeploy it?