Microsoft Azure guides from the perspective of someone who has deployed it in anger across public sector, consultancy, and MSP environments. Covers the infrastructure certification path (AZ-104, AZ-305), Entra ID and Conditional Access, networking with VNets and NSGs, Bicep and Terraform for IaC, cost management, and the security baselines that keep auditors happy. No vendor marketing, no course slides reheated. These are notes from real deployments, common failure modes, and the gaps the official documentation skips over. If you are taking certifications or running production Azure workloads, the guidance here is built to survive the Monday morning support call.
Entra Cloud Sync is Microsoft’s direction for syncing on-prem AD to Entra ID, but devices, scale, sync rules and AD FS can still pin you to Connect. Five questions that decide it, the 7 April 2027 Connect deadline and its auto-upgrade trap, and the migration gotchas.
Entra Connect Sync vs Entra Cloud Sync in 2026: which one, and the April 2027 deadline Read More »
AI agents don’t need to borrow your credentials. Entra Agent ID, SPIFFE and five open-source Microsoft projects give agents their own identity. Here’s the toolbox.
The Agent Identity Toolbox: Stop Your AI Agents Signing In as You Read More »
We spent a decade teaching users never to approve a prompt they didn’t start. AI agents make unprompted prompts routine. Here’s the attack vector nobody sees coming.
The Approval Reflex: When Your Agent Triggers Your MFA Read More »
MFA was built on something you have, know and are. AI agents have, know and are none of it, yet they act with your identity. Here’s why that breaks authentication.
You Can’t MFA an AI Agent Read More »
Everybody in IT can define least privilege. Give every identity the minimum access needed to do its job, and no more. It appears in every security policy, every framework, and every interview answer. Almost nobody implements it properly. That is not because the principle is hard to understand. It is because the principle is free
Least Privilege in Practice: Standing Access, Scope and Just-in-Time Read More »
This is the practical page. If you want the argument about why this work is never finished, that is a separate piece. This one is just the list, ordered by risk rather than by product area, so you can work through it. It is deliberately short. There are longer guides than this and most of
The Permissions Work to Do Before You Deploy Microsoft 365 Copilot Read More »
Updated 1 October 2026: the growth restrictions are now in force, and the series list and retirement dates below follow Microsoft Learn’s current retirement and capacity restrictions page. In July 2026 Azure emailed subscription owners about older VM series. The email waves a comfortable 2028 retirement date at you, so most people archived it and
Azure Has Put Your Old VMs on the Clock: How to Find Out If You’re Affected Read More »
When should you create a new Azure subscription versus a new resource group – and why “more subscriptions” stopped being a bad idea. A cloud architect’s decision guide, with the history of what changed.
Azure Subscription vs Resource Group: A Decision Guide (2026) Read More »
“Landing zone” means four different things in Azure – from a single subscription to a full enterprise platform. A cloud architect explains the spectrum and how to scope the one you actually need.
Which Azure Landing Zone Do You Need? A Scoping Guide (2026) Read More »
The network perimeter dissolved and identity replaced it. Why machine identity now outnumbers humans, what the Cloud Adoption Framework says about who governs it, and how to learn every principle in a homelab for free.
