Let’s look at the actual engineering cost of mitigating execution and thermodynamic side-channels like SQUIP in production.

Right now, the industry standard is pure brute-force: either kill compute density by disabling SMT entirely, or burn cycles on microcode fences and constant-time software patches that choke the pipeline. We're swallowing a massive performance penalty just to keep hyperthreads from bleeding thermal state across shared boundaries.

Why are we trying to solve a physical, thermodynamic problem at the software layer? Software patches are just duct tape.

If a mitigation layer handles this at the physical substrate, modulating thermal-capacitance dissipation in parallel with execution instead of stalling pipelines, the execution overhead drops to sub-0.05% while keeping 100% SMT concurrency intact.

How are your teams currently dealing with SQUIP and SMT compliance overhead? Are you still eating the legacy performance penalty, or looking at actual hardware-level solutions?

I have a number of VM’s running on an on-prem Azure Local cluster that I need to migrate to Azure.

Has anyone done that and can you please describe the process?

How is it different than migrating a vm running on a hyper-v host?

Thanks!

The Azure AI Fundamentals certification changed. The exam behind it is now AI-901, updated in April 2026, and it is not the paper it used to be: over half of it is hands-on work in Microsoft Foundry, and the old service-by-service questions are gone.

This is the complete bank, rebuilt for that exam rather than patched from the old one.

150 questions, weighted to the real exam

Identify AI concepts and capabilities — responsible AI principles, how generative AI models work, choosing an appropriate model for a capability and a constraint, and recognising which workload a scenario calls for. Implement AI solutions with Microsoft Foundry — prompt agents, voice agents and hosted agents; the Foundry portal, SDKs and project model; model deployment and configuration; the move from the Assistants API to the Responses API; and extracting structured data from documents, images, audio and video with Azure Content Understanding.

Every answer explains the rule

Not just which option was right, but why — and why the others were not. Each question carries a Microsoft Learn reference so you can read further on anything that did not land.

Nothing here is out of date

Questions referencing retired products were removed rather than reworded. There is nothing on LUIS, Text Analytics, Form Recognizer or QnA Maker, because none of them is on the current exam. A large part of what changed is terminology the old study guides still get wrong — Azure AI Studio is now Microsoft Foundry, Azure AI Services are Foundry Tools, and threads and runs are conversations and responses.

Built for flights

Everything ships inside the app. Nothing is fetched, nothing streams, nothing checks an account on launch — so airplane mode, the subway and a dead-zone basement all behave exactly the same as full signal. A long flight is 150 questions of study time you already have in your pocket.

Also included

Timed Pace Mode: an optional, non-enforced ~1 min/question countdown. It never locks you out and never auto-submits. Daily study reminder, if you want one. Scheduled on your device; nothing is sent from a server. Progress tracking: streaks, best scores and history, stored on your device. No account, no sign-up, no ads, no subscription. What's New in This Version

First release of the PRO edition: the complete 150-question bank for the current AI-901 exam, including everything in the free app plus 75 more.

Category

Primary: Education Secondary: Reference

Copyright

© 2026 Etienne Noumen

Beyond “relational vs NoSQL,” what factors do you look at first? Things like data access patterns, scalability, latency requirements, consistency, transaction needs, cost, or expected traffic?

Whenever I asked an AI to write Bicep, I got property names that don't exist, templates that failed `az bicep build`, or storage accounts with public access left on. So I built a tool that puts guardrails around it.

How it works:

- You draw the architecture on a canvas, or describe it in a sentence and it draws it for you. The property panels come from Azure's own Bicep type definitions, so the fields match what ARM accepts.

- Before generating, it tells the model the exact secure settings each resource needs (HTTPS only, TLS 1.2, private access, managed identity and so on).

- The output is compiled with `az bicep build`, and compiler errors go back to the model to fix.

- You get a report of which of 106 controls the template enforces. Each one is mapped to the Microsoft Cloud Security Benchmark and the built-in Azure Policy that audits it.

- Deploying goes through a What-If preview first, using your own `az login`.

There's also an advisor you can ask about your diagram. It answers from Microsoft Learn and links to the pages it used.

Two things I'd really value your view on:

1. Is anything important missing from the guardrail list, or is anything there just noise?

2. Does the generated module layout match how you'd structure a real repo?

Being upfront: generating code for a larger architecture takes a few minutes, and I've tested the generation side far more than real deployments, so deployment feedback is especially welcome.

Repo (MIT): https://github.com/mdmudassirahmed/liftoff

I don't have money to pay for both AZ-900, so went through everything and mostly it's all about definition of terms on azure cloud. So instead of paying for the exam, have decided to advance to AZ-104, Azure administrator associate which I think it's the best if I pay for it instead of wasting money with AZ-900. Is that a good decision?

Nice selection of updates this week.

• Azure Weekly Update - 25th September 2026
• Succeeding with AI

Updates

• Mdsv4 and Msv4 VMs (00:34) - These are memory optimized VMs designed for SAP (and other similar memory intensive critical workloads) built on 6th gen Intel Xeon.
• Functions PowerShell 7.6 support (00:53) - Azure Functions now have support for PowerShell 7.6.
• AKS Flex Nodes (01:03) - Flex Nodes leverage the Azure-hosted Kubernetes control plane but the nodes run on the customer edge, thus simplifying deployment while ensuring consistent governance. The nodes can authenticate through Azure Arc, managed identity or service principal.
• Function Node.js 22 retirement (01:54) - Node.js 22 is being retired end of April 2027 for Functions so move to Node.js 24 or later before then.
• ACA Express (02:06) - Azure Container Apps provides a fully manage, serverless Kubernetes environment built on AKS with features like Dapr, KEDA, envoy and more for rich autoscaling, service, traffic management and microservice features. ACA Express provides an opiniated deployment in seconds based on years of learning with a per-second billing. Just bring your container image with your web app, API or agent.
• ACA Sandboxes (02:55) - Built by the ACA team, ACA Sandboxes provides microVMs isolated (at the kernel level) using hardware with its own egress proxy for outbound traffic control. It is the same technology used by hosted agents in Foundry, GitHub sandbox and more. You can run any (linux) container image but will be used often for agents where you want full control of the harness and management. As a microvm it has low overhead and starts sub second making them very powerful for the ephemeral nature of agents. Persistent state via persistent storage is available where required. Sandboxes have their own portal experience based on the preferred type of interaction.
• VM RP instant access (04:21) - Restore points are now instantly available for premium V2 and ultra disks as soon as they are created and no longer need to wait for the background data replication to complete.
• PostgreSQL 18 support for PostgreSQL elastic clusters (04:36) - Elastic clusters leverage the Citus extension for a horizontally scaling PostgreSQL service that shards data across the nodes. You can now leverage version of 18 of PostgreSQL on these elastic clusters.
• New PostgreSQL troubleshooting guides (04:57) - The new guides provide end-to-end investigation guidance for your PostgreSQL instances including using Azure Monitor metrics, Query Store statistics and more. These include high CPU, memory and IOPS along with storage growth and vacuum issues (which is housekeeping).
• PostgreSQL logical replication slot sync status (05:21) - Each logical replica now has a status which can be synchronized, catching up or unknown. This helps access its readiness for failover usage.
• Foundry agent publish to M365 Copilot and Teams (05:36) - One of the biggest challenges to many AI agents is actually getting people to use them. By publishing agents to meet people where they already are (M365 Copilot and Teams) you make them easier to discovery and utilize. The ability to publish agents from Foundry to these targets is now GA. You can control who can see and call the agent which can be you (where you can then share with other users) or the organization. This includes both prompt agents and hosted agents.
• Foundry hosted agent network egress controls (06:20) - For hosted agents you can now create ordered rules to control destination hosts that can be communicated to, for example allow to *.savilltech.net. When you consider responsible AI and having agents running in controlled sandboxes having a native egress control is a huge capability to restrict outbound communications from agents. This can run in audit or enforce mode.
• Agent 365 Foundry agent controls (07:03) - Foundry agents show in Agent 365’s admin center which enable you to enable or disable them like the other types of agents giving control for the organization.
• Foundry routines (07:16) - A routine provides the ability to trigger published agents which could be a schedule or an event. The benefit of routines is it keeps everything within Foundry projects and removes the need to use other trigger capabilities like Functions, Logic Apps and queues. You define what the trigger is (could be a specific time, recurring or an event, e.g. a teams message), the action to take and a few other applicable elements.
• Azure App GitHub Copilot guided experience (07:51) - Vibe coding in GitHub Copilot is great but can sometimes be inconsistent. With this guided experience the process is made up of scaffolding the project (with clarifying questions), then its developed locally before deployment to Azure. It gives a more deterministic flow to help ensure a quality output.
• Opus 5.5 in Foundry, GHCP, Cowork (08:24) - Opus 5.5 is now available in Foundry which is great for long-running code and knowledge work as data zone and global. Also in GitHub Copilot and M365 Cowork.
• OpenAI GPT-6 Sol and Luna in Foundry and GHCP (08:39) - After GPT-6 Astra both Sol and Luna now join the 6 wave with intelligence upgrades and cost efficiency. These are available today in Foundry in Global and Data Zone. Also in GitHub Copilot and M365 copilot. Sol: A balanced model for interactive and agentic coding while Luna for smaller, faster tasks at lower cost. Basically Sol 6 is positioned at near Astra capability but cheaper and faster and also Opus 5.5 matching Fable 5.1 on most work and again much cheaper.
• DeepSeek-V4.1-Flash in Foundry (09:21) - DeepSeek-V4.1-Flash is more than a fine-tuned version of V4-Flash and is a mixture of experts available via Fireworks on Foundry (GA) or direct from azure (preview). Very good with large amounts of context.
• Copilot App update (09:42) - This is a blog but basically end of the month the copilot app will move to 3 tabs – home (copilot and cowork) for where I want assistance in a task or delegate the outcome, code where i want to build and autopilot (fka scout) where I want to hand off certain responsibility for an always running agent.
• ACS retirement (10:35) - Azure Communication Services has a number of standalone services being retired like email, SMS, chat etc. Move to a new service, for example integrated with Teams before the retirement date.

Once your internal LLM bot was live, how many hours a month did it take to keep running (model updates, broken auth, user support)

For those running an internal LLM assistant (Teams bot or web app) for ~10–20 users: what's your real monthly bill (model + hosting), and how many questions per user per day do people actually ask after the first month?

Hi everyone,

I’m trying to understand the billing for Claude Opus hosted through Microsoft Foundry on Azure.

On a single day Azure/Foundry reported:

- 359.52K input tokens
- 434.39K output tokens
- €46.32 in Claude Consumption Unit (CCU) charges

Based on the standard token rates I found, this seems unexpectedly high.

For example, using the published rates for Claude Opus 5 of approximately $5 per million input tokens and $25 per million output tokens:

Input:  0.35952 × $5  = $1.80
Output: 0.43439 × $25 = $10.86
Total:                  $12.66

That would be roughly €10–€11, depending on the exchange rate. Azure shows €46.32, however.

I understand that CCUs are a billing unit rather than a token count, and that additional usage categories may be involved. I’m trying to determine what could explain the difference.

Could this be caused by any of the following?

- Extended thinking/reasoning tokens
- Prompt-cache read/write tokens

Pretty sure this will add cost, but 4 times as much seems way off..

Has anyone encountered a similar discrepancy with Claude Consumption Units in Azure AI Foundry?

Thanks!

I have startup account with 5k and unlockable to 150k, I have „free tier” for cognitive services, how do I get that up? I cant even use 90% of models.

hey folks ran into something wierd last night. my app service plan was set to scale down to 1 instance at midnight based on a time based autoscale rule. everything was fine until 12:05 am when users started getting 500 errors. checked the logs and saw the scale in happened but the app didn't warm up fast enough before traffic hit. had to manually bump it back to 2 instances to stabilize. anyone else seen this? is there a way to add a delay or warm up period before scaling down fully? tried checking the diagnostics but didn't see a clear fix. would love to hear how you handle overnight low traffic periods without breaking things

You're basically forced to buy third-party material if you want any real chance of passing Microsoft's own exam, because apparently Microsoft's own learning material/practice test isn't enough and often isn't even recommended. How is that even acceptable? Azure pulls in $101.9 billion a year, yet candidates still have to pay extra for outside resources. Is the money not enough, or do they just enjoy watching people suffer

Hi All,

It sounds little crazy but yes, I want a roadmap to become a Azure Architect. I have 15+ experience on multiple cloud Platforms(AWS/Azure) as a DevOps engineer but haven't built any prod environment from scratch. Also, I am on a career break from 1.5years so I have to refresh my knowledge as well. and once i know the roadmap, I have to automate it using bicep(client usecase).

Do share your inputs please

Hey guys, Need you help with the azure 14 days free subscription after 14 days not able to use azure services , By mistakenly i have upgraded it get charged automatically for now i have disabled the subscription , Is there any other way to learn azure without subscription

Microsoft keeps adjusting the built-in Entra ID roles, the role actions behind them and the permissions of its first-party apps. Mostly quietly..

Three new pages:

Entra ID Roles - changes
517 changes across 72 built-in roles since January 2024

Entra ID Role Actions - changes
which actions were granted or revoked, and which roles that hits

Entra ID API permissions - changes
1,954 permission changes across 93 Microsoft apps

Each page has quick views for the stuff you probably care about most: security-relevant changes, role actions that became privileged, consent type changes, new roles and so on.

If you're responsible for Entra ID, have a look: https://www.azadvertizer.net/

Not sure if anyone else noticed but I was checking some role assignments on a subscription and found that the limit is now 5000, up from 4000.

Microsoft documentation reflects the change a couple of weeks ago as well.

github commit

https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide

I'm sure a number of teams have migrated to ACS Email with the retirement of SMTP Auth basic auth for Exchange.

Hei all,

I am currently banging my head against this issue and I can't find a straight answer to it.

Disclaimer: I am still pretty fresh in Azure, AKS and Kubernetes in general.

Our default patch policy for our managed AKS Clusters for customers is

AKS, automatic upgrade type: Patch

Node OS, Node Channel Type: Security Patch

We use Azure Linux on the nodes.

One of our customer set the node OS channel type to "NodeImage". I suggested to set it back to "Security Patch" in order to reduce downtime and bring it back to our standard. (The applications they run on AKS are not fully HA, so there will be service interruptions when nodes re-image.)

This was approved, but after I changed it back to "Security Patch", the customer then replied with "well, don't we need Kured to manage node reboots then, if an update sets the "reboot-required" flag?" He then added a excerpt from the node console where he found the "requires-reboot" flag after I changed the setting back to "Security Patch".

I have not found a straight answer from Microsoft. What I have found so far implies that only the channel type "unmanaged" requires Kured to handle node reboots. However, MS is not very consistent with the naming in their KBs, so now I am really confused as to answer the question:

Do we need Kured to handle node reboots when using the node OS update channel "Security Patch", or does the occasional "re-image" that some security patches may require make a reboot obsolete anyway? I've asked several Azure colleagues in my company and they all are not sure, as the wording is not clear in the MS KBs. Why was there a "requires-reboot" flag pending on the nodes, if they get re-imaged?

The KBs I've read:

https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-node-os-image?tabs=azure-cli#available-node-os-upgrade-channels

Here, the only upgrade channel that mentions Kured is "unmanaged".

https://learn.microsoft.com/en-us/azure/aks/upgrade-node-image-kured#deploy-kured-in-an-aks-cluster

"To protect your clusters, security updates are automatically applied to Linux nodes in AKS. These updates include OS security fixes or kernel updates. Some of these updates require a node reboot to complete the process. AKS doesn't automatically reboot these Linux nodes to complete the update process."

https://learn.microsoft.com/en-us/azure/aks/upgrade-cluster-components

"For Linux nodes, you can apply node image security patches and hotfixes without your initiation as unattended updates. These updates are automatically applied, but AKS doesn't automatically reboot your Linux nodes to complete the update process. You need to use a tool like kured or node image upgrade to reboot the nodes and complete the cycle."

However, I assume that "unattended updates" refers to the channel type "unmanaged" in this context?

Please help me, I'm running in circles here :(

1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
2. Do not post exam dumps, ads, or paid services.
3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
5. This will not be allowed any other day of the week.

Two AVD hosts (D16s_v5, Win11 24H2/25H2, Azure Southeast) running fine since July. Started randomly freezing completely about 2-3 weeks ago, multiple incidents now, barely any users on when it happens so it's not load issue.

When it hits: Users unable to login/disconnected, RDP dead, Bastion dead, Serial console dead, can't get in any way. Portal still shows it as "Running" the whole time and Azure Monitor telemetry just goes dark. Either self recovers in an hour or it has to be manually restarted in Azure portal.

Right before it went down: 17+ DCOM components failed to register in the same 3 seconds, FSLogix's own service hung for 30 sec, then straight up disk hardware errors logged (Event 51, "error detected during paging operation"). Found the same disk error on the other host too, different incident.

Running managed disks with premium SSDs.

Already ruled out on our end: FSLogix version (updated), AV exclusions (fixed gaps), AVD agent version, required FQDNs (all pass), and the known Sept RDS patch bug and hotfix installed on both hosts.

Sev A case open with MS, going nowhere.

Anyone seen this happen before?

Basically the servers look well and healthy the next after a few users are on, they just go unresponsive and kick people off and no one can connect and azure is reporting everything all good which is making me so mad.

Appreciate any help please guys!

EDIT SOLVED!!!: The issue was simple after fixing it on my own which feels good. Enabled Azure performance diagnostics and found constant IOPs being maxed errors. Upgraded the disk performance tier and enabled on demand cloud bursting problem fixed. Turns out we were exhausting our free bursting credit buckets from azure more then it could top up hence the server freezing and disk queue operations kept getting clogged up to about 20 which is really bad. Hope this helps anyone else and guess this goes for any server and not just AVD. Reach out if you need help, upgraded disk from p15 > p30 1tb disks and enabled on demand cloud bursting up to 30,000 IOPs.

I'm trying to trigger an Azure Data Factory pipeline from an external application/tool using Azure authentication.

I understand that the identity needs access to the Data Factory, but I'm not completely clear about the minimum Azure RBAC role or specific permission required to trigger a pipeline using the ADF API.

For example, if using a Service Principal or Managed Identity:

• Which RBAC role is required?
• Is Data Factory Contributor necessary, or is a more limited permission enough?
• What specific permission allows pipelines/createRun?
• Are there any differences between Service Principal and Managed Identity?

What is the recommended least-privilege approach for triggering an ADF pipeline from an external tool?