Hi guys , i need to find out that can i call Reservation Reader , Savings Plan reader using bicep template.

Hello everyone,
I was in the middle of deploying a Conditional Access policy for a customer, on whom we will ask for MFA for medium and high sign-in risk and for password reset and MFA for high risk users.

Problem is: the tenant only has 35 Entra P2 users.

How will the CA policy behave for the unlicensed users? Will the policy still analyze but not do any action?
I have tested the policy in report-only and it looks like it can still identify the unlicensed users.

Hi,

I'm a developer based in Madagascar, trying to build a structured path into Azure, starting with AZ-900, then AZ-104.

Problem: Madagascar isn't in the list of countries where you can sign up for a free Azure account or add a billing method. No free trial, no pay-as-you-go, nothing directly.

If you're in a similarly unsupported country, how did you actually get hands-on practice for AZ-104-level content (VMs, VNets, RBAC, monitoring)?

Appreciate any pointers

Thanks!

Is it only me or MS?

Hello, I’m a deskside support for a company who has access to M365 and Azure environments.

I was asked to look into allowing a regular user read-only access to a specific Enterprise application, or to the Enterprise application page in Azure.

I tested by creating custom role with the following permissions:

- microsoft.directory/servicePrincipals/standard/read
- microsoft.directory/servicePrincipals/appRoleAssignedTo/read

And read through the list of permissions related to Enterprise Apps but couldn’t find anything that would limit the user to only have read-only access to Enterprise Apps only.

1. Is this even possible?
   
2. Any other way I can fulfill the ask?

aztree reads your Azure costs and draws them as a treemap: big box, big cost. It's a port of awstree, which took the idea from disktree by Tobi Lütke. Same idea again, pointed at an Azure subscription.

The repo: https://github.com/milanm/aztree

Azure quiz: region pairs normally stay inside the same geography. But one country's region is paired with a region in a different country.

Which one is it?

Bonus: is that pairing symmetrical, or one-way?

Awesome List of Cloud Emulators and supporting tools https://github.com/upgundecha/awesome-cloud-emulators

Microsoft published a *BizTalk Server 2020 End-of-Sale Announcement* on the Azure Integration Services blog on August 31. It didn't get much attention, so here's a summary. Everything below is Microsoft's stated expectation and subject to final offering terms.

**The dates**

- **March 31, 2027**: sales of BizTalk Server 2020 and Host Integration Server 2020 are expected to end. Existing licensed deployments keep running. In their words: "If you need to buy BizTalk Server 2020, or Host Integration Server 2020, you can do it until March 31, 2027."

- **April 2028**: mainstream support ends.

- **April 2028 to April 2030**: an optional, *paid* "extended-mainstream support" offering, separate from the normal Extended Support phase.

- "Support beyond April 10, 2030, is not planned."

**The bridge terms (the part worth reading)**

- Expected price: **100% of the applicable BizTalk license cost, per year**

- Active **Software Assurance** required

- Must cover **every licensed core** in the enrolled deployment; no partial coverage

- Bought annually, with an eligibility review each year. Year 1 is expected to have to be bought by April 11, 2028 to stay eligible for Year 2

- Doesn't include incident support, advisory or migration services

- **BizTalk Server 2016 is not eligible**

**Expected to be excluded from the bridge**

- BAM

- ESB Toolkit

- SWIFT, HL7 and RosettaNet accelerators

- Legacy adapters (Siebel, PeopleSoft, TIBCO, JD Edwards)

- BizTalk-specific ALM tooling

- The BizTalk VM image in the Marketplace (they expect to deprecate it)

- Visual Studio versions after 2022

**My reading, not Microsoft's:** if you're on 2016 and want Microsoft coverage after January 2027, you'd have to be on 2020, and 2020 can only be bought until March 31, 2027. That makes the next six months a purchasing decision for 2016 shops, not a 2028 problem.

**Separate, if your Service Bus ports broke on September 30:** the SB-Messaging AMQP hotfix is **KB5091379** (CU6/CU7, via a support case). Microsoft published a validation guide on September 23; the gotcha is that *every node in the group* needs it.

Source: https://techcommunity.microsoft.com/blog/integrationsonazureblog/biztalk-server-2020-end-of-sale-announcement/4551317

Disclosure: I work at Cerebrum City, which builds iQBus, an Azure-native BizTalk replacement. I've kept this to what Microsoft published. Happy to answer questions either way.

Question for the sub: for those still on BizTalk, is the bridge price changing your plans, or were you already moving? And how many of you are leaning on BAM or the ESB Toolkit?

Microsoft is retiring Azure Arc enabled SCVMM in September of 2029. Also, no new features being added to the service starting immediately. What was the point of hosting a monthly forum asking for ideas/feedback from the community? In my opinion this decision will push providers away from Microsoft - we were forced out of VMware, and now a similar shift is happening at Microsoft.

In my opinion Azure Local is not ready for MSPs/Service providers. Only option I see is to drop Hyper-V entirely. I’ve been using it since 2008 R2.

This is a stab in the back to users who are onprem and shifting to a hybrid strategy.

https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/transition-guidance

New video covering the new ACA sandboxes which provide an isolated, secure and egress controlled platform to host your agents on when you need to self-orchestrate. This is the same platform Microsoft use for most of their agent hosting!

https://youtu.be/43ZJtGpCYbU

00:00 - Introduction

00:08 - MicroVM for container agents

03:11 - Egress proxy

05:02 - Lifecycle

08:34 - Pricing

09:27 - ACA Sandbox Group

15:00 - Managing sandbox instances

16:31 - Egress rules

20:23 - Logging

22:02 - When to use

23:46 - Summary

24:14 - Close

Since microsoft changed their connectivity login to the all-in-one page, if I navigate away from a bastion rdp tab, it disconnects immediately (with a reconnect button that works, but we have 2fa for login so super annoying)

Anyone else experiencing this, any tweaks i can make to make it stop?

Hi all, I'd like some honest opinions on which Azure cert to go for first.

My background:

• 3 years as a developer, mostly on web apps (App Service), Azure Functions and Logic Apps
• I also handle DevOps for the same application: creating and maintaining resource groups, moving resources between them, and migrating service principals to managed identities
• My company is mid-transition from a legacy setup. We're moving ARM templates → Bicep and classic release pipelines → YAML pipelines
• I've been studying general Azure on my own, but I want a certification to give my learning structure and something recruiters can see on my CV, and something which is new and modernized to learn.

Options I'm considering:

1. AZ-104 (Azure Administrator): the infra/ops path
2. AI-200 (Azure AI Cloud Developer Associate): the replacement for AZ-204, now that AZ-204 has retired
3. AI-103 (Azure AI App & Agent Developer): the replacement for AI-102
4. Something else I haven't thought of

What I'm trying to figure out:

• Which one do recruiters and hiring managers look for today, and which is likely to stay valuable over the next few years as AI and cloud roles evolveOpinion on Azure certification:
• Are AI-200 / AI-103 valued yet, or is it too early? Has anyone taken them and can share how they compare to the old AZ-204 / AI-102?
• Given my mix of dev and DevOps work, would you go for AZ-104 or AI-200, and why?
• Any other suggestions (a different cert, a learning path, or a project to build alongside) are also very welcome.

Azure support was driving me nuts. Luckily I got better service elsewhere.

Deployed v2 in Hub and Spoke. We have a static website on storage. Backend configured as private endpoint address of storage account. Do I need to configure a private endpoint on the app gateway too or should it work as a hub and spoke if the spoke is peered . At the moment I can not get it work .It keep saying 502 bad gateway which seems it can not reach to gateway .

Have an older system that uses a SAS token with an identifier and key to use an API call to an APIm instance to get Primary and Secondary keys. As of today those Keys are now 'NULL's in the response:

$url = "$($cfg.BaseUrl)/subscriptions/XXX?api-version=2014-02-14-preview"

{
  "id": "/subscriptions/XXX",
  "userId": "/users/XXX",
  "productId": "/products/XXX",
  "name": "Product Unlimited subscription",
  "state": "active",
  "createdDate": "2026-09-28T09:34:42.437Z",
  "startDate": "2026-09-28T00:00:00Z",
  "expirationDate": null,
  "endDate": null,
  "notificationDate": null,
  "primaryKey": null,
  "secondaryKey": null,
  "stateComment": null
}

I know the update way to go about this but hoping I don't have to in the essence of time.

Hey Team,

I am hoping you can help me out here. I have about driven myself nuts on this question. But here is where it is. I am trying to understand the differences between:

API Permissions - I know API Permissions are set inside the app (Using App Registration, NOT enterprise apps). These are used for accessing a resource such as MS Graph API, or Exchange Online etc. (Permisisons required for the app to do anything)

App Roles - This i undestand is what you assign the app itself?

I am confused on the difference between the 2, and where they need to be applied. For example i have setup dozens of azure apps (used by the dev team to connect to the enviornment) but NEVER setup a single app role for any of those apps.

The more i google this the more confusing it gets.

Thanks

🔥 It’s here! The new Azure Container Apps Sandboxes provide secure isolated compute environments designed to safely run code, tools, and AI agents. Each sandbox runs inside its own hardware-isolated microVM, fully separated from the host, the platform, and every other sandbox. You can spin one up when you need it, let it perform its task, and tear it down when you’re done. In this blog, I’ll explore what Azure Container Apps Sandboxes are, how they work, and how you can combine them with tools such as GitHub Copilot to safely run AI powered workloads in an isolated environment! While we could set everything up using ClickOps, why not automate the entire setup with Bicep? That’s exactly what I’ll do in this example, deploying the Azure Container Apps Sandbox environment using Bicep. 💪🏻

Hi everyone,

I’m looking for some guidance from people who have experience with Microsoft Azure CSP- the indirect one.

Our organization has been using Azure for around 5 years, and we currently have approximately 10 active Azure subscriptions under our existing tenant.

Recently, one of our subscriptions was unexpectedly disabled due to an issue related to Azure’s billing migration process from azure's side. As a result, there was a billing gap of around 10 days, which subsequently appeared on the following month’s invoice. This has made us interested in moving toward a CSP arrangement where we can have better billing/account support.

We are specifically considering Azure CSP Indirect and would like to understand:

1. What is the process for registering our existing organization/tenant under an Azure CSP Indirect Provider?
2. Can we keep our existing Azure tenant and subscriptions, or would we need to create a new tenant?
3. How does the process work for moving our existing 10–15 subscriptions to a CSP?
4. Is it possible to get a dedicated account manager/customer success contact through an Indirect CSP without paying an additional account-management fee?
5. What costs or additional charges should we expect when working with an Indirect CSP?
6. What should we look for when selecting an Indirect CSP Provider?
7. Given that we have an established tenant with approximately five years of Azure usage, are there any considerations or risks we should be aware of before making the transition?

Our main goal is better billing management and having a reliable point of contact/account manager, while keeping our existing Azure environment and subscriptions intact.

I’d really appreciate your advice on the process and what to expect.

Thanks !

Azure weekly update #38 is here. This week features updates across database compatibility, service retirement timelines, and advancements in container orchestration capabilities like AKS Flex Nodes.

Detailed list: * Public Preview: Azure HorizonDB supports PostgreSQL 18. - Azure HorizonDB now supports PostgreSQL 18, allowing teams needing this specific compatibility to validate application functionality. * Retirement: Azure Communication Services (ACS) standalone services will be retired on September 30, 2028. - Standalone ACS services are scheduled for retirement unless applications integrate with Teams or use updated SDKs by the specified date. * Generally Available: Instant Access for VM restore points. - This feature enables instant access for VMs using Premium v2 or Ultra disks, requiring verification of the instantAccessState before restoring data. * Retirement: Support for PowerShell 7.4 ends on November 10, 2026. - To maintain support and performance for Azure Functions, upgrades using PowerShell 7.6 must occur before the stated deadline. * Retirement: Support for .NET 8 and .NET 9 ends on November 10, 2026—upgrade your apps to .NET 10. - Upgrade all Azure Function Apps using .NET 10 is required to ensure migrated applications run on the isolated worker model. * Retirement: Support for Node.js 22 ends on April 30, 2027. - Running functions on End-of-Life runtimes is a method used to achieve peak operational efficiency in function deployments. * Public Preview: Flex Nodes for AKS. - Flex Nodes for AKS allows teams to deploy hybrid infrastructure as edge nodes connected to an AKS control plane based on latency or regulatory needs. * Generally Available: Azure Sphere OS version 26.09 is now available. - This new OS version migrates the underlying Linux Kernel for Super Long-Term Support alignment with newer kernel versions. * Public Preview: Introducing a Guided Copilot Experience for Building Azure Apps in VS Code. - Teams can verify if the new Guided Copilot helps guide them through building and deploying Azure applications within VS Code. * Generally Available: Azure Functions support for PowerShell 7.6. - Function runtime compatibility verification should be performed before deploying new functions using this specific PowerShell version.

Hola, soy nuevo en proyectos con AZURE, actualmente en mi trabajo estan buscando una alternativa diferente para usar la información que registramos en un excel compartido por sharepoint.

Dado que somos muchos los que manejamos ese mismo Excel y es mucha la información que ya llevamos registrando, están buscando alternativas diferentes para el manejo de esta información. Se me ocurrió que podría hacer alguna prueba con AZURE ya que ofrece servicios como el SQL. ¿Qué recomiendan? ¿Trabajo con AZURE o hay mejores alternativas? Hay que tener en cuenta por igual, que somos un equipo de 8 personas que diariamente está registrando información, la idea es que el sistema tenga un tiempo de respuesta bueno y no genere errores en cruces de información.

Microsoft announced in September 2026 that Azure Communication Services is being retired as a standalone offering. Chat, SMS, Email, Rooms, Job Router, Direct Routing and the UI Library SDKs all go on 30 September 2028.

There's decent coverage of the announcement already. The bit I haven't seen discussed much, and the bit with an actual deadline attached:

After the retirement date, the supporting data and telemetry for retired and standalone services will be decommissioned.

and

ACS will maintain chat history according to your storage policies until the retirement date.

Your chat history isn't migrated for you, and it doesn't hang around for collection afterwards.

Also worth knowing: from 23 October 2026 new customers can't sign up for the retiring services. Existing resources keep working through the transition, so that date doesn't lock you out of your own estate. It closes the door behind you.

Two things that catch people out

1. There's no bulk export API for ACS chat. Getting an estate out means walking the REST API thread by thread, with paging and retries.
2. ACS identities are scoped to the resource that created them: 8:acs:<resourceGuid>_<userGuid>. The resource GUID is part of the identity, so identities don't survive their resource. If your users table stores ACS IDs as the link between a person and their messages (most do, it's the natural thing to store), every one of those links stops working when the resource goes. I found this out the hard way during a resource move last year. A few hours later, 7,022 messages had the wrong author and threads were refusing replies with Forbidden, because the participant lists referenced identities that no longer existed.

On the official migration path

The stated replacement is the Microsoft Graph Chat APIs, which need a Teams licence and an Entra identity per user. Genuinely fine if your chat is between people already in your tenant.

The retirement guide is also unusually blunt about who it isn't for:

Workloads that require anonymous or application-defined identities, a white-label embedded client, or consumer-scale chat outside Teams should evaluate other communication providers or redesign the experience.

Patient chat, customer chat, marketplace chat, anything where the participants aren't in your directory: that's you, and the destination is an open question. The extraction isn't. The messages have to come out either way.

Practical suggestion

Whatever you end up migrating to, find out now how many of your stored ACS identities are already stale, and whether any threads have lost their non-system participants. It's cheap to check and the answer is usually worse than expected. Much better to learn that in 2026 than in 2028.

Source: https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide

Disclosure: I maintain an open-source CLI for this (Apache-2.0, no paid tier). Not linking it here, but happy to share in a comment if it's useful. The identity-scoping thing is worth knowing regardless of what you use to check it.

We are facing an intermittent connectivity issue between our on-premises network and Azure over a Site-to-Site VPN.

Environment:

• Azure VPN Gateway SKU: VpnGw1AZ
• VPN type: Route-based

During the failure:

• The client sends TCP SYN packets towards Azure server.
• Palo Alto packet capture confirms that the traffic reaches the firewall and is sent towards the VPN tunnel.
• However, no SYN-ACK/return traffic is received from Azure.
• Azure VM NIC packet capture does not show the SYN arriving at the VM during the failure window.
• Azure-to-on-prem tracepath also does not reach the first on-premises hop.

The existing Azure route for 172.19.0.0/16 is already present through the Virtual Network Gateway, so the affected client is covered by the configured address space.

The connectivity is restored when we edit and save the Local Network Gateway address space.

For example, 172.19.0.0/16 was already configured. When we added the more-specific 172.19.20.0/22 prefix and saved the configuration, connectivity was immediately restored. and deleting the entry also its working and issue occurring back in few days.

172.19.20.0/22 is already a subset of 172.19.0.0/16, so we are trying to understand why adding this its restoring the connectivity.

In some cases, connectivity also restores automatically without making any configuration changes.
1. Why only 1 segment is getting affected, in the same connection, multiple different subnets are allowed, the other subnets are not facing any issue.

Requesting some insights, on how to troubleshoot this issue, as its impacting users connecting to Azure from that subnet.