The archive
Blog
32 articles
The VMs that LAPS cannot reach still have passwords
Windows LAPS handles domain-joined machines. Entra login removes the local credential entirely. This is about the machines neither one reaches, and a tool that rotates their…automationazurepowershell
Azure in-place upgrades don’t have to stay manual
Microsoft documents the Windows Server in-place upgrade on Azure as a per-VM procedure with an RDP session in the middle. What stops it from running unattended…automationazurepowershell
169.254.169.254: The Cloud Metadata Endpoint
Managed Identity solves credential storage problems. It does not eliminate identity abuse. Managed Identity is one of those Azure features almost everyone recommends — and honestly,…azureknowledgesecurity
There’s no built-in policy for Entra VM login
Azure ships a built-in policy to disable local accounts on your VMs. It ships none to enable the Entra login that makes disabling them survivable. Here’s…azureentraid
Stop letting your AI guess Azure RBAC
azure-rbac-advisor — a prompt skill that researches least-privilege RBAC for your IaC and doesn’t make up permission strings.* How this started This didn’t start with an…aiazuresecurity
App Lifecycle Analysis for Entra ID
Every large Entra tenant has the same problem: hundreds of app registrations, most of them forgotten. Here’s a tool to find them and act on what…complianceentraidprojects
Find the Azure Updates That Affect You, With Claude
A Claude Code skill that stops you reading retirement notices for services you don’t use. How this started Azure publishes a lot of updates. Retirements, security…aiazure
Automate Azure Golden Image Builds
One Bicep deploy. Monthly builds. No manual sysprep. How this started Back when I was still heavily working in the Azure Virtual Desktop space, I handled…automationazurebicep
The Privileged Role Exposures Defender Misses
A look at Tier Zero exposure paths that don’t show up in the obvious places — and a tool to find them. Update, September 2026. The script…automationazureentraid
Least Privilege Studio: An Azure RBAC Tool
If you’ve ever set up a service principal in Azure and thought “I’ll just use Contributor for now” — this is for you. It’s not carelessness,…azuresecurity
Hardening Entra ID with Terraform
A practical implementation guide covering identity baseline, privileged access, conditional access, and monitoring – fully managed as infrastructure as code. Entra ID is the identity backbone…entraidsecurityterraform
Azure Cloud Adoption: Landing Zones, WAF, and the Big Picture
This post is different from my usual project or solution based posts — no code, no architecture diagrams. Just the mental model I wish I’d had…azureknowledge
Private Azure Monitoring at Scale — Terraform, Zero Public Traffic
Modern enterprise cloud architectures demand more than just functional monitoring — they demand secure monitoring. By default, the Azure Monitor Agent ships logs and metrics over…securityterraform
Automated Azure VM Power Management with a Tag-Driven Runbook
In a previous post, I introduced a lightweight, tag-driven VM power management solution in Azure that combined an Automation Runbook with a custom PowerShell GUI —…automationpowershellprojects
Entra ID Login with Azure Bastion (Public Preview)
Managing credentials for virtual machines has always been a balancing act between security, usability, and operational overhead. With the new native Microsoft Entra ID login for…entraidknowledge
Deploying Agents to Azure VMs Using Azure Policy and VM Applications
The Problem: Organizations need to deploy agents, monitoring tools or security agents across all Azure VMs consistently. Traditional approaches often fall short: The Solution: Azure Policy…automationcomplianceterraform
Using Azure Firewall as a NVA with Terraform
Using Azure Firewall as a Network Virtual Appliance (NVA) provides a powerful alternative to traditional VNet peering in hub-and-spoke designs. Instead of relying on implicit trust…securityterraform
Managing Secrets in Terraform: From Bad to Automated
When it comes to Infrastructure as Code (IaC), Terraform is an incredibly powerful tool. It allows us to define, deploy, and maintain entire environments in a…automationazurepowershell
Sending Custom Logs to Log Analytics via HTTP
Centralized logging is a cornerstone of any professional IT or DevOps setup. Azure Log Analytics (LAW) / Azure Monitor provides a powerful platform not only for…azurecompliancepowershell
Automated Terraform Deployments with GitHub
Managing infrastructure through Terraform is powerful — but doing it securely and automatically is where real efficiency begins. In this guide, we’ll set up GitHub Actions…automationazurecompliance
Azure Service Groups – A New Way to Organize Your Cloud
Microsoft has recently introduced Azure Service Groups (public preview since August 2025) – a feature designed to bring flexibility and clarity into how you organize and…azureknowledge
Auditing Azure VM Operating Systems
Managing a growing Azure environment often means dealing with multiple subscriptions, distributed teams, and a wide range of virtual machine configurations. One critical but often overlooked…azurecompliancepowershell
VM Power Management in Azure Using Tags, Runbooks, and a Custom GUI
As a Cloud Solutions Engineer, optimizing costs and automating operations is a daily priority. One of the common challenges in Azure is managing the runtime of…armautomationazure
Collecting GPU Metrics on Azure VMs with Telegraf
When working with GPU-enabled Azure virtual machines — such as those used for AI training, inference, or video rendering — you often need to monitor GPU…automationazurecompliance
Azure Template Specs: Reusable ARM Templates
Infrastructure as Code (IaC) is undoubtedly the gold standard when it comes to modern cloud infrastructure. Tools like Bicep, Terraform, and Pulumi allow for clean, repeatable,…armautomationazure
Using Terraform to Generate Local Zip Files
Terraform is most commonly used to provision infrastructure — VMs, storage accounts, networking, etc. But sometimes, your infrastructure code also needs to prepare local files or…automationterraform
Terraform vs ARM vs Bicep – Which IaC Tool Should You Use for Azure?
In the world of Infrastructure as Code (IaC), several tools are available for deploying and managing Azure resources programmatically. The most commonly used are: But which…armbicepknowledge
Quickly Find Azure VMs Without NSG Protection
Network Security Groups (NSGs) are a key security feature in Azure, acting as virtual firewalls to control network traffic to and from your Virtual Machines (VMs).…azurecompliancepowershell
Self Service VM & AVD Order via Web Form
In one of my projects, I developed an Azure-based solution that enables users to provision a virtual machine (VM) or an Azure Virtual Desktop (AVD) instance…armautomationazure
Getting Started with Terraform – File Structure & Best Practices
When I started using Terraform, I didn’t really have a clear structure in place. I tried to force everything into modules way too early, and ended…knowledgeterraform
Deallocate VM based on Activity Log
In many organizations, virtual machines in Azure are kept running even when they’re no longer needed – especially during business hours. But what if users could…armautomationazureNo articles match those filters.