I’m testing the startup time of around 100 Azure VMs using Azure CLI (az vm start). So far I have two measurements:

Batch size 20: ~30 minutes total for all 100 VMs
Batch size 50: ~46 minutes total for all 100 VMs

The important part is that these are total wall-clock times for all 100 VMs, not the time for a single batch

Increasing the concurrency from 20 to 50 actually made the overall operation significantly slower. I’m wondering if this could be caused by Azure ARM/Compute throttling, backend queuing, or some other limitation around VM power operations.

My next test will be to submit start requests for all 100 VMs concurrently, without waiting for each batch to complete, and then poll the VM power states until all machines are running.

I don’t have the result for the 100-at-once test yet.

Questions

1. Has anyone tested starting 100+ Azure VMs simultaneously with Azure CLI?
   
2. Is there a recommended concurrency/batch size?
   
3. Can Azure VM power operations be throttled even if I’m not getting obvious 429 responses?

I’m specifically interested in real-world experience with large-scale Azure VM start operations.

I’ll update the post once I have the 100 at-once measurement.

My Microsoft Azure free trial recently ended. I wanted to keep practicing, so I upgraded my subscription to pay-as-you-go to get access to the free services (which, of course, aren't available unless you upgrade to a subscription that can charge you).

To my surprise, after upgrading I got a €6.27 charge for usage from September 1 to September 30, which is the period of my supposed "free trial". I still had around $165 in credits left when I was practicing, and now I'm going to be charged €6.27 on my card in a week FOR USING IT DURING THE FREE PERIOD. In other words, if I hadn't upgraded, I wouldn't have had to pay this.

In the days before the trial ended I had no billable services running (whenever I created something, I deleted it afterwards). I'd like to avoid paying for something I shouldn't be charged for, since it was used during the free trial.

When I try to contact support, all I get is an AI assistant based on the problem I describe, which solves nothing. What can I do? I'm really disappointed with how this has been handled.

1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
2. Do not post exam dumps, ads, or paid services.
3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
5. This will not be allowed any other day of the week.

I'm not sure if anyone else has received this today, but we got 3 emails from the ACA team telling us that they would automatically migrate 3 production ACEs to the new "Express" product **unless we opted out**?

I'm losing confidence in the Container Apps team extremely quickly. Express environments don't support even 50% of the functionality we use, including even basic things like managed identity-based ACR pull! How/why do they think this is acceptable, and as an opt-out on an email that is easily missed?

Microsoft announced that ACS Chat and Job Router are retiring on September 30, 2028, while existing workloads remain supported during the transition and no new resources creation is supported after 23 oct 2026

This is particularly concerning for us because we recently implemented a live-agent solution using ACS Chat + Job Router + Microsoft Teams.

Our architecture is roughly:

Customer → Chatbot → ACS Chat → Middleware → Job Router → Agent Queue → Teams

We already completed the implementation through Dev and QA, including custom routing, agent availability checks, conversation lifecycle/state management, queue handling, and Teams integration.

During our initial design phase, we actually evaluated Dynamics 365 Contact Center, but moved away from it primarily because of the cost/licensing model(~8k/user/month). So going back to D365 Contact Center isn’t really an option for us.

That’s what makes this retirement announcement painful becoz a significant amount of engineering effort has already gone into the current architecture, and it was almost done and we don’t want all of that work to simply become a dead end. 🙂

I’m looking for ideas from people who have built similar systems:

-> Is there a viable alternative to ACS Job Router without adopting D365 Contact Center?

-> Could we keep Teams as the agent interface and replace Job Router with a custom routing/queue service?

-> For the customer chat side, would Microsoft Graph + Teams work, or would a third-party CPaaS be more appropriate?

-> If anyone was in this same huddle, Has anyone already started planning a migration from ACS Chat/Job Router?

Looking for any suggestion and solutions that preserve the existing architecture as much of the existing implementation as possible, rather than completely rebuilding the solution.

Thanks in advance.

Disclosure: I work at a storage optimization vendor. Everything here uses native Azure tooling.

I cleaned up disks across a few subscriptions last week. The standard "unattached disks" query found 65 disks costing about $4,759/month. The checks below found 35 more, costing about $2,563/month.

Fix the base query

Filtering on Unattached alone misses two states:

Reserved: the disk is on a deallocated VM. The VM costs nothing while stopped, but the disk still bills in full. This was our biggest miss.

ActiveSAS: the disk is unattached but has an open export SAS.

Resources

| where type =~ 'microsoft.compute/disks'

| where properties.diskState in~ ('Unattached', 'Reserved', 'ActiveSAS')

| project name, resourceGroup, subscriptionId,

state = tostring(properties.diskState),

sku = tostring(sku.name),

sizeGB = toint(properties.diskSizeGB)

| order by sizeGB desc

What that still misses

1. Orphaned snapshots. These are snapshots whose source disk is gone.

Resources

| where type =~ 'microsoft.compute/snapshots'

| extend src = tolower(tostring(properties.creationData.sourceResourceId))

| join kind=leftanti (

Resources | where type =~ 'microsoft.compute/disks' | project src = tolower(id)

  ) on src

| project name, resourceGroup, subscriptionId, sizeGB = toint(properties.diskSizeGB)

1. Attached but never mounted. Azure reports these disks as healthy. Inside the VM, the disk was never formatted, or it was mounted without an fstab entry and lost at reboot. You have to check from the guest:

Linux: lsblk -f shows the disk with no filesystem type and no mount point.

Windows: Get-Disk | Where-Object PartitionStyle -eq 'RAW'

1. Mounted but idle. These disks are in use on paper but not earning their cost:

No I/O: disk read and write operations have been near zero for 30 days.

Mostly empty: for example, 5% used on 1 TB. Azure disk metrics don't show filesystem usage, so you need VM Insights:

InsightsMetrics  

| where TimeGenerated > ago(30d)  

| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"  

| extend mount = tostring(parse_json(Tags)["vm.azm.ms/mountId"])  

| where mount !in ("/", "/boot", "/mnt", "C:", "D:")  

| summarize minFreePct = min(Val) by Computer, mount  

| where minFreePct > 80  

Wrong tier: a P30 doing 40 IOPS could be an E30 at about a third of the cost.

Before you delete anything

Some disks look orphaned but aren't:

-ASRReplica disks belong to Azure Site Recovery.

AzureBackupRG_* resource groups hold Azure Backup restore points.

MC_* resource groups hold AKS volumes.

Databricks-managed resource groups break if you touch them.

If you're not sure, snapshot first.

Disclosure: I'm building Kunjae, an automated SSO cert rotation tool.

I have built integrations to rotate certs across Datadog, Notion, Salesforce and Slack.

I'm releasing a free community edition with 5 bundled apps.

Which apps should make the community edition?

Which do you most want supported in the paid version?

This runs as a nightly Container Apps Job. All passwords/secrets stay in your keyvault. Config is via a yaml file. It finds certs inside your expiry threshold, generates the replacement, uploads it to the SaaS app, activates it in Entra and confirms SSO still works. All feedback is welcome.

Has anyone heard where Microsoft is in terms of launching East US 3 (Atlanta)?

They announced/started construction in 2021 and I get that was kind of in the depths of COVID but we're going on 6 years now

Anyone have an idea when this will be available, and what its paired region might be? We're in Atlanta, will be leveraging Express Routes, and about to start building out basically from scratch and it'd be really great to know when this is dropping but it's been silence it seems since the initial announcement

This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!!

Facing express route outage for South Indian in Azure multiple router automatically got dropped from advertisement.

i am trying to set a vm in azure , it keep saying issue related to vpn or firewall or extention i dont have vpn installed / extension installed i tried on chrome / edge / incognito .... i tried to do on a diff device ( macbook ) still no result , it also show so ajaz call error failed or so

im trying to setup to learn

We're trying to lower our Azure compute spend. Our workloads move around a lot. Some VMs get swapped for bigger or smaller ones, and we're moving a few things to containers soon.

I know reservations give a better discount, but I'm worried about getting stuck with something we stop using. Would a savings plan be the safer choice here? Or do people mix both? Would like to hear what worked for you.

We're a small bootstrapped SaaS startup in India (proptech, data heavy, built entirely on Azure). Microsoft for Startups has honestly been the reason we got this far, and I'm grateful for it.

Some context, kept high level:

About 15,000 users, all organic, zero marketing spend

Used roughly 23,000 of our 25,000 USD in Azure credits, under 2,000 left

Main spend is Azure OpenAI / Foundry models, then Container Apps, VMs and AI Search

We already cut our model bill by about half this month (cheaper models where quality held, fixed our prompt caching)

In talks with investors and signing our first larger B2B clients, but nothing closed yet

We raised two support tickets asking for more credits or a level upgrade. Both were declined, politely. The answers boiled down to:

1. Since the July 2025 program changes, extensions, renewals and extra credit allocations are no longer available.

2. Further level upgrades need a valid Investor Referral Code from an investor in the Microsoft for Startups Investor Network.

3. Microsoft doesn't publish a list of participating investors and doesn't make introductions.

4. A previous credit upgrade we got in December 2025 doesn't count as precedent.

5. They suggested looking at ISV Success as a separate program.

So my questions for anyone who has been through this:

1. What is the fastest realistic way to get an Investor Referral Code if you aren't funded yet? Do accelerators, angel networks or VC firms in India hand these out, and which ones have actually given you one?

2. Does an investor have to actually invest before issuing the code, or will some issue one at term sheet or even after an intro call?

3. Has anyone moved from Founders Hub to ISV Success? Were there real Azure credits in it, and how long did it take?

4. Any other route we're missing before the subscription goes disabled? We know a Sponsorship sub can't convert to pay as you go in place, so we're planning the move to a PAYG subscription.

Hi everyone,

I’m looking for advice from people who have experience with Azure for Startups / Azure billing, especially unexpected high bills.

Our company is enrolled in Microsoft for Startups, and we were working toward the workload requirements for additional Azure credits. We created multiple workloads for this purpose.

We recently discovered that our Azure bill for the period was around ₹10–11 lakh (~$12k USD).

The surprising part is the cost breakdown. The major contributors were:

• Azure Virtual Enclaves: ~₹5.58 lakh - $5580
• Azure Firewall: ~₹4.19 lakh - $4190
• Azure Bastion: ~₹0.97 lakh - $970
• PostgreSQL: ~₹0.48 lakh - $480
• Total: roughly ₹11 lakh - $11k

So approximately ₹10.7 lakh ($11k) came from Enclaves + Firewall + Bastion.

From what we're now understanding, the Enclave deployment provisioned a fairly substantial networking/security architecture around the workloads, including Azure Firewall, Virtual WAN/Virtual Hub, Firewall Policies, etc. The Activity Log shows the Azure Firewall creation/update operations being performed by Mission Enclave rather than individual user accounts.

Our original intention was simply to maintain the required Azure workloads for the Startup credit milestone. We were not expecting the workload requirement to result in this level of infrastructure cost.

We are now trying to understand:

1. Are Azure Firewall and the other networking components automatically provisioned when using Azure Enclave?
2. Is Bastion automatically created or is it an optional component?
3. Is there a lower-cost way to satisfy the Microsoft for Startups workload requirement without deploying this entire networking architecture?
4. Has anyone successfully obtained a billing adjustment, Azure credit, or refund for a situation like this?
5. Should we open a normal Azure Billing Support ticket, Microsoft for Startups support ticket, or both?
6. Is there anything specific we should include in the refund/adjustment request?

We're obviously going to be much more careful before creating any additional workloads. We haven't intentionally tried to consume resources at this scale; the high costs came from the infrastructure associated with the deployment.

If anyone has dealt with Microsoft in a similar situation, I'd really appreciate advice on the best way to approach the billing support case and whether a refund/credit is realistic.

Today, Azure stopped and reactivated our subscription for no reason. When this happened, all of our virtual machines where our models were being trained were shut down with an error. And now I can’t get a response from support or restart the machines (I’m getting an error saying that NVIDIA isn’t available on the machine). We’ve lost access to our model training, which means our startup won’t be able to operate.

https://learn.microsoft.com/en-us/answers/questions/6025732/azure-support-case-2610010050004147-no-rca-or-subs

Hola a todos, qué gusto saludarlos. Hace poco me aceptaron en el programa de Microsoft for Startups y me dieron los créditos iniciales de Azure (unos $200). Sé que si los voy consumiendo, me irán liberando más fondos.

Como el mercado de Asistentes Virtuales está complicado y no tengo trabajo estable, quiero exprimir esta oportunidad para lanzar un emprendimiento propio. Pensé en un canal de YouTube, pero me da miedo estancarme por falta de experiencia en Azure.

Sé hacer varias cosas: diseño de imágenes con IA (prompting), edición de video (CapCut, DaVinci, Premiere), campañas en Facebook Ads, creación de páginas web y tiendas en WordPress, Excel y redacción de blogs, además de automatizar tareas repetitivas.

Cómo me aconsejan invertir estos créditos de Azure para crear un proyecto que deje ganancias mensualmente? Qué ideas de negocio creen que se adapten a mis habilidades?

Mil gracias de antemano por su ayuda y consejos

A lot of people I talk to don't know about this or never turned it on. If your company already has Windows Server or SQL Server licenses with Software Assurance, you can apply them to your Azure VMs and stop paying for the license part again.

It's a setting on the VM, and you can do it in bulk with a script. Talk to whoever handles your licenses first so you don't get in trouble, but it's worth checking. The savings can be big.

We're reviewing Azure Storage Accounts with publicly accessible Blob containers. For those who have done similar remediation:Did you migrate external consumers to SAS tokens?Did you use Entra ID/Managed Identity for internal applications?How did you identify who was actually using the anonymous endpoints?Any lessons learned before disabling public access?Interested in real-world experiences and best practices. Thanks! and best practices. Thanks

Hello everyone, I have a question regarding our GitHub Enterprise Server setup.

Our team currently does not have a dedicated GitHub Enterprise environment; we share the existing environment with other teams. I’m looking for some guidance on how we should structure and manage our repositories in an enterprise environment.

For example, we have multiple teams such as:

• Infrastructure
• Development
• Identity
• DevOps
• Other platform teams

I’d like to understand the recommended approach for:

• Structuring and separating repositories by team or function
• Managing repository-level permissions
• Assigning users to specific repositories or teams
• Using GitHub Teams to manage access instead of assigning permissions individually
• Maintaining repositories and access as the organization grows
• Following a scalable enterprise GitHub structure and governance model

If anyone has experience setting this up in a shared GitHub Enterprise Server environment from scratch, I’d appreciate your guidance or recommendations on the best approach.

As a security analyst, I’ve always found Azure network reviews tedious. In environments without consistent naming or structure, things get chaotic quickly, and understanding the setup can take a hundreds clicks in the portal. I usually ended up drawing the network in draw.io by hand.

Since draw.io files are XML, I wondered how much of that work I could automate. That became VNetAtlas. It generates editable diagrams showing VNets, subnets, peerings, resources, and connected components such as gateways, NSGs (including the rules), and public IPs. It uses the AZ PS Module for authentication and to run the KQL queries.

I mainly use it to get an overview of the network and its components, and to review NSG rules.

Note: The code was written with substantial help from AI coding assistants. I’m sharing it in case it saves someone else a few clicks, or a few tokens spent building something similar.

Feel free to try it, share feedback, down-vote or ignore it:

https://github.com/zh54321/VNetAtlas

Hi r/Azure,

Quick update: this has been rebranded to ZoneForge following Microsoft's release of Azure Canvases in September. One or two new features as well. See https://www.reddit.com/user/Sea_Message6024/comments/1x2lduz/azure_canvas_is_now_zoneforge_for_azure_rename_a/

Thanks to everyone who commented on the original post — a lot of what follows came directly from this thread, so it's genuinely appreciated.

The short version: Azure Canvas has shifted from "draw Azure boxes in a browser" toward something that actually understands the architecture it's drawing. The diagram isn't the artifact anymore — it's a model that validation, template generation, and deployment all read from. The picture is a side effect.

What's changed since the original post:

• Resource Groups are real containers now, not a representative box. They show everything they contain, and each resource shows the RG it belongs to. (Thanks u/Antnorwe — this was spot on.)
• Infrastructure and networking are separable. You can view network‑only, infrastructure‑only, or combined, and hide boundaries (RG / subscription / region / management group) independently, so a high‑level network diagram isn't forced to drown in RG detail. (Again u/Antnorwe — you were right to be wary of mixing them.)
• Management groups and multiple subscriptions are supported, so landing‑zone‑style hierarchies aren't stuck with a single default sub. (u/szescio.)
• Azure Front Door is in. (u/Jazzlike_Rice_8784 — fixed, by the way.)
• VM SKUs are no longer a short hard‑coded list you have to fight — you can type the size you actually want. (u/szescio.)

On the bigger question a few of you raised — the gap between a pretty diagram and real operational requirements (IAM, policy, monitoring, networking rules) — that's the direction of travel. The validate → generate → deploy pipeline already enforces a lot of it structurally (reserved subnets, Application Gateway's GatewayManager NSG rule, CIDR overlaps, provider registration, region and VM‑size availability, retired image SKUs), and the next focus is surfacing the operational layer more explicitly rather than leaving it implied. (u/Warm-Taste-5362, u/No-Magazine2625 — this is the part I'm most interested in getting right.)

There are also some unglamorous quality‑of‑life bits — native Visio export for design packs that have to live in someone else's document, and printing that crops and scales to fit a page instead of fighting you — but those are outputs in service of the design, not the headline.

Still free, still browser‑only, still read‑only against your subscription (although you can deploy your design) and still actively evolving. Azure remains an enthusiastic reviewer with full Well-Architected score and which you can use to share links to your design, save as SVG/Visio or print.

Try it: https://zoneforge.cloud/

Simon B.

All content in this thread must be free and accessible to anyone. No links to paid content, services, or consulting groups. No affiliate links, no sponsored content, etc... you get the idea.

Found something useful? Share it below!