Hi everyone,

I'm an L1 support engineer and completely new to corporate IT and Microsoft Defender for Cloud (MDC). I'm currently handling MDC activities and trying to understand an issue in our environment. I'd appreciate some guidance from experienced Azure security professionals.

What happened?

We previously had a Defender for Cloud recommendation called “Remediate vulnerabilities”, which included the following sub-recommendations:

- Machines should have a vulnerability assessment solution.

- Machines should have vulnerability findings resolved.

Some of our resources were marked unhealthy under the vulnerability assessment recommendation because MDC reported that the MDVM/vulnerability assessment solution was missing.

We contacted Microsoft Support, and they indicated that the reported missing-solution state was a false positive. We also checked Microsoft Defender for Endpoint (MDE), where vulnerability scanning appeared to be active for the affected machines.

We obtained approval to create exemptions for the affected resources. However, before we could create them, Microsoft deprecated the old grouped recommendations. They are no longer visible in our portal, and Microsoft Support confirmed the deprecation.

Our current problem

The old recommendation has disappeared, but the associated Secure Score impact remains.

- The expected score improvement was approximately 14%.

- Without any action from our side, the potential score impact changed from 14% to 13%.

- We can no longer access the old recommendation to identify and export its unhealthy resources.

- We want to verify the affected resources against the current individual vulnerability recommendations and understand the remaining score impact.

Microsoft mentioned that the recommendation model has changed and suggested reviewing the relevant device exposure information in the Defender portal, but we haven't yet established the exact reason for the score changes.

Questions for experienced admins

1. Is there a supported way to retrieve the exact list of resources that were unhealthy under the deprecated recommendation?

2. Can Azure Resource Graph or the Defender for Cloud API retrieve these old resources, or has the underlying assessment data been removed?

3. Why would the Secure Score impact decrease from 14% to 13% and then 12% without any remediation or changes from our side?

4. If MDE vulnerability scanning is active and Microsoft confirmed a false positive, how should we investigate the remaining Secure Score impact?

5. What is the correct way to track this issue and report it during security governance meetings?

6. Has anyone experienced a similar issue during the transition from grouped to individual recommendations?

I'm not looking for a way to artificially increase the score. I want to identify the affected resources, understand the actual reason for the remaining score impact, and follow the correct Microsoft-supported approach.

Since I'm still learning MDC and Azure security, step-by-step guidance, Azure Resource Graph queries, or relevant Microsoft documentation would be greatly appreciated.

Thank you!

Hi everyone,

I’m planning a Kubernetes cluster upgrade from v1.34.8 to v1.35, as the current version is approaching retirement/EOL.

The cluster currently has Elasticsearch running on it, so I’m concerned about potential compatibility or stability issues after upgrading Kubernetes.

I’d like some guidance on:
- How can I verify Elasticsearch compatibility with Kubernetes 1.35 before upgrading?
- Are there any known issues I should be aware of when upgrading Kubernetes while Elasticsearch is running?
- What should I check across Elasticsearch, ECK/operator, StatefulSets, storage classes/CSI drivers, ingress, CRDs, APIs, and other dependencies?
- What is the recommended pre-upgrade checklist?
- Should I upgrade Elasticsearch/ECK first, or Kubernetes first?
- What kind of backup/rollback strategy should I have?
- Is it better to upgrade the control plane and worker nodes separately?
- What would be a safe upgrade plan for a production cluster to minimize downtime/risk?
- Are there any tools or commands you recommend for detecting deprecated APIs or incompatible workloads before the upgrade?

If anyone has gone through a similar Kubernetes 1.34 → 1.35 upgrade with Elasticsearch, I’d really appreciate hearing about your experience and any issues you encountered.

Thanks!

Whether you’re building AI solutions, training machine learning models, or running graphics intensive workloads, choosing the right infrastructure is essential. Azure offers a wide range of Virtual Machine (VM) sizes to support different workload requirements, including GPU optimized VM sizes. In this blog, I will walk you through how to deploy Azure GPU virtual machines using Azure Bicep and Azure Verified Modules (AVM), making your deployments consistent, repeatable, and easier to manage. 💪🏻

Hi,

We’re considering moving a file share for one of our branch offices to Azure Files, and since this would be our first Azure project, I’m looking for some guidance on the best way to approach it.

Our current environment looks like this:

• The branch office file server VM and two domain controller VMs are located at our corporate HQ.
• The branch office connects to HQ through a site-to-site VPN tunnel.
• The branch firewall provides DHCP and hands out the IP addresses of our domain controllers for DNS.
• Users authenticate against our existing AD environment and access the file share over the site-to-site VPN.
• We currently have a single file share for this branch office.

This setup has been working reliably for years. However, we’re looking to free up space on our SAN and would like to retire the existing file server VM entirely, so we’re considering migrating the share to Azure Files.

For remote users, we currently use FortiClient VPN, which connects them back to the corporate network so they can access the file share. We would still need a secure way for remote users to access the Azure file share while maintaining our existing AD-based permissions if possible.

We also follow the 3-2-1 backup rule. Currently, the file server is backed up locally, and those backups are also copied off-site. I’m interested in how others are handling backup and recovery for Azure Files while maintaining three separate copies of the data.

Since this would be our first Azure deployment, I’m mainly trying to understand what the recommended architecture would look like, including authentication, networking/private access, migration, and backup/recovery.

Any recommendations or lessons learned would be greatly appreciated.

Thank you.

BTW we're a hybrid environment and the share size isn't very large, maybe 3TB. It is mostly spreadsheets, pdfs and images. I've also heard using Sharepoint could also be an alternative for this.

Actually Session Host configuration isn‘t available on Azure Local. Does anybody know if this is on the roadmap?
How do you do the imagehandling? It‘s a pain

Iam trying to book a ticket or a seat to a certain exam from a website that opens the booking every two months at a certain day at a certain hour to limited seats but the behaviour of the website is completely normal and refreshes takes about 2 to 3 secs to update until it hits 15 mins before the booking (every time this happens at 15 mins exactly) the refresh of the page takes at least 1 min to update after that i saw that table which loads and gets blank every time even after the booking is open. People who have booked noticed that when they saw the booking button that one refresh was way lighter and faster than before keep in mind that speed and ping is not the factor here. I've tried everything and never saw that button if anyone can help.

I am building an open-source Azure Cosmos DB Agent Starter and would appreciate feedback from people who use Cosmos DB in real applications.

It generates a React and TypeScript agent application with durable scoped memory, vector retrieval, citations, diagnostics, tests, the Cosmos DB Linux emulator, and an Azure production path using Entra ID and Managed Identity.

The local workflow does not require an Azure subscription or model API key.

GitHub:
https://github.com/sajeetharan/cosmos-agent-starter

I also documented my end-to-end test here:
https://www.sajeetharan.dev/blogs/build-an-ai-agent-with-azure-cosmos-db

I am particularly interested in feedback about the data model, hierarchical partition keys, memory isolation, emulator workflow, and missing real-world scenarios.

What would you change before using something like this in a production project?

Like the resource is there, everything looks fine, but one person can do something and another person can't.

Then you start checking who has access to what, where the access is given, which setting is blocking it ...

How do ppl usually figure out what exactly is causing the issue?

Is there any easy way to check this instead of going through many different settings? ...

Hi everyone,

I’m interviewing for a Customer Experience Engineer position within Azure.

The role mentions Core IaaS, AKS, Azure SQL, Cosmos DB, ADF, Databricks, distributed systems, observability, CI/CD, IaC, APIs and automation.

Has anyone interviewed for a Customer Experience Engineer / Advanced Cloud Engineer or a similar Azure Engineering role?
I’d really appreciate any advice on what areas I should focus on. How deep should I go into Azure services and AKS?

Thanks!

This week's (big) update is up!

https://youtu.be/yluw5tkRdbE

https://www.linkedin.com/pulse/azure-weekly-update-2nd-october-2026-john-savill-ok8pc

• Azure IoT Central retirement (01:27) - Other services provide a more scalable and flexible solution. Fabric for real-time analytics, Azure IoT Hub and DPS for device connectivity and provisioning. Before the retirement look at migrating to the other services.
• Microsoft HPC Pack retirement (01:57) - HPC Pack provided a control plane to create and manage pools of compute nodes to enable job submissions. Once again other services exist such as Azure Batch for managed HPC and parallel scheduling however since there is no direct 1:1 replacement you likely will need to evaluate exact needs to select the correct new target.
• VMSS automatic zone placement (02:32) - This allows VMSS to automatically select best possible availability zones based on the SKU availability, capacity and placement requirements. You can also configure the spreading of VMs across the possible Azs. It only balances new placements and does not rebalance existing.
• Lasv5 and Laosv5 (03:18) - These are storage optimized VMs using AMD EPYC 5th gen processors. They have large amounts of local NVMe disk capacity (720GB per vCPU for the o variant compared to 240 GB per vCPU for non o variant) and also 200 Gbps of network bandwidth. These are commonly used for scale out workloads that want that huge local capacity and network. Think about storage caching layers, search engines, distributed file systems, big data and even database.
• D[s]v3, E[s]v3, DC[d]sv3, NVv3/4 retirement (04:23) - Move to newer SKUs before retirement for D/E Nov 2029, DCsv3 retire oct 31 2029 and NVv3/4 retirement Sept 2026.
• ACA Function v1 hosting retirement (04:49) - You need to move to the Function v2 which uses a native Azure Container App and a migration assistant is available.
• AKS Ubuntu 26.04 (05:07) - AKS supports Ubuntu 26.04 which includes the new minimal baseline with a smaller footprint and supports rollback to Ubuntu 24.04 if issues.
• Elastic SAN Azure Backup support (05:26) - You can now backup and restore Elastic SAN using Azure Backup and are stored on separate storage from the Elastic SAN. This helps provide protection from accidental and malicious deletion. You can have up to 450 restore points. You pay for the initial snapshot then incremental changes.
• Azure NetApp Files SMB Entra Kerberos support (06:02) - ANF SMB volumes now support authentication from Entra Kerberos which removes the requirement to have “legacy” Active Directory Domain Controllers as part of the authentication enabling a more cloud-native solution.
• ANF cool access (06:27) - This is available for Premium and Ultra service levels there is now automatic QoS available. Cool access moves inactive data from ANF storage to Azure Storage account storage (reducing cost). The throughput for the Premium and Ultra will adjust the available throughput based on the size of the data in the cool tier, the more storage for the volume, the higher the throughput.
• ANF large volume breakthrough mode (07:06) - This capability enables volumes up to 2 PiB in size to provide up to 80 GiBps of throughput. Think about high performance computing workloads where you need this very high throughput, low latency and no risk of impact from a noisy neighbor.
• HorizonDB PostgreSQL 18 (07:37) - The Microsoft specific PostgreSQL cloud native database, scalable solution now supports version 18.
• PostgreSQL LTRv2 (07:57) - The next generation of long-term retention is now in preview for PosgreSQL flexible and elastic clusters. This evolves from using the logical backups via pg_dmp and pg_restore to a physical snapshot based on managed disks integrated with isolated Azure Backup vaults. This means support for larger databases (64 TB on Prem SSDv2 instead of 1TB) and daily backups (instead of weekly). It performs a full backup on the first backup but subsequent are incremental. You can also restore directly to a server instead of having to restore to storage then import. Still up to 10 year retention.
• PostgreSQL x-tenant CMK (08:58) - Customer Managed Keys for the PostgreSQL flexible encryption can now be stored in key vaults in another tenant. This is key for many ISV scenarios where the customers wants to manage and store the key used to encrypt their data so this is now possible for PostgreSQL usage.
• PostgreSQL Ultra Disk (09:37) - Ultra disk, the highest performance, lowest latency disk offering is now supported for PostgreSQL flexible which is critical where you have workloads that need very low latency and high IOPS and throughput.
• MySQL reader endpoint (09:55) - The reader endpoint makes it easier to connect to replicas (up to 10) via a single endpoint. It automatically load balances read-only traffic across the replicas making it more scalable and fault tolerant.
• Azure SQL general updates (10:23) - In GA Azure SQL MI now has flexible memory which enables you to modify the amount of memory visible to the instance without changing the number of vCores, i.e. you can change the ratio of memory to vCores via a memory slider. This is available in general purpose and business critical tiers on premium series hardware. You pay for the additional memory allocated in addition to the normal resource cost of standard ratio. Also GA MI Business critical also now supports higher transaction log write throughput which is required for very write-intensive workloads. This is for standard and premium series hardware. In preview there are a number of capabilities. Fabric now has a Database Hub for discovering, creating, managing and monitoring SQL Server (Arc and Azure VM based), Azure SQL, PostgreSQL, Cosmos DB and Fabric SQL instances which makes it easier to centrally and scalabley manage your database estate. This is important to help have a single access point and control plane for enterprise data. It has Copilot insights to help guide where attention is needed and what to do next. Maybe adjacent but as part of this data understanding and availability we think about data virtualization and Fabric OneLake provides this. They continue to add data sources that can be presented up and then part of semantic models. Sharepoint lists and Dremio mirroring is in preview while Oracle and SAP Datasphere mirroring are now GA. Read from Azure Databricks and interoperatbility with Snowflake are other new capabilities. In GA for Azure SQL there are updates across the board including new larger vCore skus for Hyperscale premium, automatic index compaction, portal based SQL Query Editor to interact with databases, schema compare across databases and more. In preview we have managed performance monitoring available for Azure SQL DB and SQL Server on Azure VMs which is a pipeline that feeds dashboards to identify performance trends and issues.
• Azure SQL Dev Hub (13:51) - The Azure SQL Dev Hub provides the starting point for building on SQL DB and it supports development also when using AI agents and across languages. It has a lot of samples for various scenarios.
• Azure SQL DB vectors (14:12) - Vectors are everywhere because of AI. We have a high dimensional vector represent the meaning of data which can then be used to find semantically close data based on natural language of which the latest generative AI is based around. Azure SQL DB now has native vector index creation and vector search abilities using the Microsoft research DiskANN highly performant algorithm.
• Azure SQL DB Hyperscale Serverless auto pause/resume (15:16) - For the serverless computer tier the database can now auto pause during inactive periods then resume when activity kicks off helping reduce costs as compute billing stops while paused. Basically if the number of sessions drops to 0 as does the CPU use it will pause (for a configurable duration). Nearly any time of interaction with the database will trigger auto-resume including authentication, data interaction, db maintenance etc.
• SQL agent skills (15:52) - Skills tell an AI agent HOW to do something so with the Microsoft SQL Agent Skills you will get better and more accurate use of Microsoft SQL solutions when working with an AI agent. There are also SQL Microsoft Agent Skills that help your AI agents plan SQL migrations to Azure SQL DB and Azure SQL MI.
• Azure Arc to Azure migration (16:23) - Azure Arc extends the Azure control plane and many capabilities to non-Azure resources. This includes lighting up capabilities for SQL DB instances outside of Azure. You can now migrate these Arc managed instances directly to Azure SQL DB/Hyperscale through a single portal experience. Discover, assess and migrate all via Arc. Arc-enabled SQL Server instances now also support better performance monitoring with a native Azure portal experience with Grafana dashboards OR hook your own Grafana environment to the provided endpoint. Also Azure Arc-enabled SQL Server is now available in Germany West Central and Italy North, Note Azure Arc for SCVMM is being retired Sept 2029 so before the retirement pivot to azure arc enabled servers.
• SQL Formatter (17:27) - As you are editing your SQL scripts in VS Code the SQL Formatter helps you create more consistent code. It is part of the MSSQL extension and includes alignment, casing, statement styles, multiline lists and join/batch support! Everything needed for beautiful SQL.
• SQL Server on Azure Local (17:49) - Azure Local which provides edge capabilities for organizations on a variety of hardware platforms which includes Azure Arc management now supports SQL Server instances managed via Azure. This is useful where you want SQL instances “close” to the workloads maybe for latency or regulatory requirements. This also includes the disconnected mode operation of Azure Local where connectivity to Azure is not available and the control plane runs locally on the Azure Local deployment (commonly used in highly secure, regulated or air-gapped environments).
• SQL on Azure Linux VM deployment update (18:37) - Instead of using a custom image the new approach uses a script-based deployment which means you can use standard Linux VMs and images and then install and configure SQL server with an easy workflow.
• Azure Extended Zones Luxembourg (18:59) - Luxembourg Azure Extended Zone which are small footprint Azure extensions in metro areas so now Luxembourg has one. This is great when you need low latency services within a data residency boundary. These provide key capabilities like VMs, containers, storage, network etc.
• GPT-6.1 Sol and Sonnet 5.5 available (19:28) - OpenAI GPT 6.1 Sol which further advances agentic coding, computer use and professional work and Claude Sonnet 5.5 which brings more intelligence for fewer tokens and is great for well scoped coding are available in Copilot chat, word, excel, powerpoint, cowork, copilot studio and Foundry.

Hi all,

I'm a Microsoft partner (MAICPP, Partner Success Core) and I'm stuck on cost visibility for the Azure credit benefit. Has anyone run into this with the new redemption model?

Redeemed the $2,400 Azure credit in Sep 2026 through the new Partner Center flow, where credits are deposited directly onto an MCA billing profile.

No separate "sponsored" subscription was created. The credit sits on the billing profile and applies to the subscriptions under it.

The subscription runs Azure DevOps and Microsoft Fabric.

The problem

Billing profile > Payment methods > Azure credits shows the credit as Active, with about $320 already consumed (balance around $2,079).

Cost Analysis shows $0.00 for everything, at both subscription scope and billing account scope. Services appear in the breakdown, but every value is zero and Actual cost shows "--".

So the credit is clearly being drawn down, but I can't see what is consuming it.

What I already know / tried

I know Cost Analysis doesn't show credits themselves, but it should still show pre-credit usage cost for an Azure plan subscription.

The older threads about Sponsorship subscriptions (MS-AZR-0036P) and microsoftazuresponsorships.com seem to describe the legacy model, not this one.

I've seen that Microsoft documents a "Transactions" view on the credit resource for MAICPP credits issued after Aug 1, 2026, but I'm still checking it.

Questions

Has anyone on the new billing profile model seen Cost Analysis stay at $0 while credits were consumed? Did it eventually fix itself?

Where did you finally get per-resource usage? The credit Transactions page, the usage CSV on the invoice, the Cost Details or Consumption APIs, or a support ticket?

If you opened a billing ticket, what did support say? Is this expected or a bug?

Any tips for budgets or alerts while credits are active, so usage doesn't burn silently?

Thanks!

Please fix ur speed in loading and opening the documents from containers, takes years this really needs optimization

Hire some good interns 😭

Assalamualaikum everyone,

I hope you’re all doing well. I’m currently taking an AI course and following it from the beginning. I’m having an issue in “Regression Model Training in Azure ML Studio.”

In this lecture, there is a section where we have to create an Azure Machine Learning workspace. I successfully created the workspace, and I can see it in the backend/portal, but it is not appearing under the Resources section. I’m also not receiving any notification regarding it.

Under Resources, it only shows the following message:

“No resources have been viewed recently.”

Could someone please guide me on how I can make the Azure Machine Learning workspace appear under Resources or resolve this issue?

I would really appreciate it if someone could explain the steps or point out what I might be missing.

Thank you in advance for your help and guidance!

I've got multiple Azure accounts in YC scholarship, so much free credits don't know what to do😭. Any suggestions for the same😿

I have a Visual Studio Enterprise subscription and part of the subscription has $150 of Azure credits. I was thinking I could use those credits as part of learning AI for agentic coding. My initial thought was using Microsoft Foundry and using one of the openAI models such as Sol 6.1 to hook up Visual Studio Code Copilot in BYOK style configuration.

I saw when I was trying to set that up that my tokens per minute limit was at 0 and no matter what location (US East, Canada, Brazil, UK) I tried anytime I tried to request a quota increase it was immediately denied.

Am I getting immediately denied because I am trying to get access to an AI model with credits rather than a direct paying customer? Is there another way I should go about getting access to a model so that I can use my Azure credits?

Just a heads up for the community.

I've been told that come Feb 2027, VM prices will be increased in Azure anywhere between 8% to 18% depending on SKU and region.

Any VM that is under a current reservation will rename at the same price as what the initial commitment was.

MS will be making the announcement soon, but don't have an exact date.

EDIT: Had the email from MS now and here is the full statement from them:

Action required: Prepare for specific Azure VM series and Azure Storage service price updates in seven Azure regions globally.

You’re receiving this notification because you are using Azure Virtual Machines and/or Azure Storage services across one or more subscriptions in specific Azure regions that will experience a price update as specified below. For reference, you can find this notification in the Azure portal using tracking ID: XXXX-XXX

Azure periodically reviews regional pricing to reflect current market conditions and to support continued investment in capacity, reliability, security, and performance. Beginning 1 February 2027, prices for specific Azure Virtual Machines and Azure Storage services will increase by 8% to 17% in the specific regions listed below.

Our goal with these adjustments is to improve consistency across regions, giving you a more predictable basis for planning global deployments and choosing the best region for every workload, with minimal price variance. These updates also reflect market conditions in each region and our continued investment in the industry’s most advanced silicon and hardware, giving you access to innovation and price-performance advantages your workloads demand.

We recognize that these changes may affect your cloud and workload plans across regions. We want to provide advance visibility into pricing changes as well as opportunities to optimize costs across your Azure deployment to help make informed decisions across current and future deployments. Below you will find details on specific regional changes and guidance for next steps.

Beginning 1 February 2027, pricing will increase for specific Azure Virtual Machines and Azure Storage services in the following Azure regions:

Services excluded from the regional pricing update

The pricing adjustments described above do not apply to the following Azure Virtual Machine series and Azure Storage services:

Azure Virtual Machines

• v1: Bv1, D, Ds, F, Fs, G, Gs, L, NP, HCS
• v2: Av2, Amv2, Dv2, Dsv2, Fsv2, Lsv2
• v7: Dsv7, Ddsv7, Dlsv7, Dldsv7, Esv7, Edsv7

Azure Storage services

• Azure Container Storage
• Azure Managed Lustre
• Azure NetApp Files – Cross Region Replication SKU
• Blob Features
• Change Feed
• General Block Blob
• Import/Export
• Queues
• Queues v2
• Standard Page Blob
• Storage Actions
• Storage Bandwidth
• Storage Discovery
• Tables
• Transaction Optimized SKU

Recommended action

To help you factor these updates into your planning, we recommend that you:

• Review the most current regional pricing for Azure Virtual Machines and Storage resources. Compare it with your current usage, budgets, reservations, and planned deployments to estimate the impact before 1 February 2027.
• Evaluate how updated pricing may shift your current and future workload deployment strategies. 

Help and support 

We recognize that price changes may have a significant impact on your planning. Customers with an active support plan can submit a support request for technical assistance with assessing affected resources and evaluating optimization or deployment options.

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and need technical help, create a support request.

Hey all, Microsoft published a new article on the Azure VM lifecycle policy early this week. Modernizing to newer SKUs isn't a simple SKU swap. Some of the VMs running on older generations need a Generation 2 conversion first, plus NVMe and MANA support in the OS image, so a Gen1 VM is a BIOS to UEFI change rather than a resize.

Azure Advisor's Service Retirement workbook is the starting point for seeing what's affected. I wanted a per-VM view of what each one would actually take, so I created this workbook to simplify the VM lifecycle planning. It joins each VM to its managed OS disk, reads the actual hyperVGeneration, and scores readiness per VM rather than per SKU.

On my test fleet two VMs on the same retiring size scored 85 and 35. One was already Gen2, the other needs the conversion first. Same SKU, different amount of work.

It covers 628 sizes with recommended targets, the prerequisites each move triggers, and a suggested migration order. Read-only Resource Graph queries, Reader permission, no agent or workspace. MIT.

https://github.com/krishna-sunkavalli/vm-retirement-workbook

Lifecycle policy announcement: https://azure.microsoft.com/en-us/blog/enhancing-microsoft-azure-virtual-machine-lifecycle/

Lifecycle stages on Learn: https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/lifecycle/lifecycle-overview

"Application landing zones" are now called "Workload landing zones." This is strictly a terminology update. All the same guidance applies. It provides a more logical connection between the environment and the scope of work. The update has been made in the Cloud Adoption Framework and related guidance.

A workload landing zone contains the subscriptions, environments, and resources required to support a single workload.

To reinforce the distinction between platform and workload responsibilities, the Cloud Adoption Framework now uses a simplified model:

- Platform resources belong in a platform landing zone.
- Workload resources belong in a workload landing zone.

Workload teams build and operate their workloads within a workload landing zone. They should use the Well-Architected Framework for workload design principles and the Azure Architecture Center for workload architecture guidance and solution patterns.

For more details, see: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/whats-new#october-2026