# Simon Vedder

> Cloud Engineer · Zürich


## Posts

- [The VMs that LAPS cannot reach still have passwords](https://simonvedder.com/the-vms-that-laps-cannot-reach-still-have-passwords/): Windows LAPS handles domain-joined machines. Entra login removes the local credential entirely. This is about the machines neither one reaches, and a tool that rotates their passwords and SSH keys off a single signal: the expiry date on a Key Vault secret.
- [Azure in-place upgrades don't have to stay manual](https://simonvedder.com/azure-in-place-upgrades-dont-have-to-stay-manual/): Microsoft documents the Windows Server in-place upgrade on Azure as a per-VM procedure with an RDP session in the middle. What stops it from running unattended is a single error code.
- [169.254.169.254: The Cloud Metadata Endpoint](https://simonvedder.com/169-254-169-254-the-cloud-metadata-endpoint/): Managed Identity solves credential storage problems. It does not eliminate identity abuse.
- [There's no built-in policy for Entra VM login](https://simonvedder.com/theres-no-built-in-policy-for-entra-vm-login/): Azure ships a built-in policy to disable local accounts on your VMs. It ships none to enable the Entra login that makes disabling them survivable.
- [Stop letting your AI guess Azure RBAC](https://simonvedder.com/stop-letting-your-ai-guess-azure-rbac/): This didn't start with an agent idea. It started with a website.
- [App Lifecycle Analysis for Entra ID](https://simonvedder.com/app-lifecycle-analysis-for-entra-id/): Every large Entra tenant has the same problem: hundreds of app registrations, most of them forgotten. Here's a tool to find them and act on what you find.
- [Find the Azure Updates That Affect You, With Claude](https://simonvedder.com/find-the-azure-updates-that-affect-you-with-claude/): A Claude Code skill that stops you reading retirement notices for services you don't use.
- [Automate Azure Golden Image Builds](https://simonvedder.com/automate-azure-golden-image-builds/): One Bicep deploy. Monthly builds. No manual sysprep.
- [The Privileged Role Exposures Defender Misses](https://simonvedder.com/the-privileged-role-exposures-defender-misses/): A look at Tier Zero exposure paths that don't show up in the obvious places — and a tool to find them.
- [Least Privilege Studio: An Azure RBAC Tool](https://simonvedder.com/least-privilege-studio/): If you've ever set up a service principal in Azure and thought "I'll just use Contributor for now" — this is for you.
- [Hardening Entra ID with Terraform](https://simonvedder.com/hardening-entra-id-with-terraform/): A practical implementation guide covering identity baseline, privileged access, conditional access, and monitoring – fully managed as infrastructure as code.
- [Azure Cloud Adoption: Landing Zones, WAF, and the Big Picture](https://simonvedder.com/azure-cloud-adoption-landing-zones-waf-and-the-big-picture/): This post is different from my usual project or solution based posts — no code, no architecture diagrams. Just the mental model I wish I'd had earlier.
- [Private Azure Monitoring at Scale — Terraform, Zero Public Traffic](https://simonvedder.com/private-azure-monitoring-at-scale-terraform-zero-public-traffic/): Modern enterprise cloud architectures demand more than just functional monitoring — they demand secure monitoring.
- [Automated Azure VM Power Management with a Tag-Driven Runbook](https://simonvedder.com/automated-azure-vm-power-management-with-a-tag-driven-runbook/): In a previous post, I introduced a lightweight, tag-driven VM power management solution in Azure that combined an Automation Runbook with a custom PowerShell GUI — a setup that helped teams control VM runtime, reduce costs, and improve usability compared to Microsoft’s StopStartV2.
- [Entra ID Login with Azure Bastion (Public Preview)](https://simonvedder.com/entra-id-login-with-azure-bastion-public-preview/): Managing credentials for virtual machines has always been a balancing act between security, usability, and operational overhead.
- [Deploying Agents to Azure VMs Using Azure Policy and VM Applications](https://simonvedder.com/deploying-agents-to-azure-vms-using-azure-policy-and-vm-applications/): The Problem: Organizations need to deploy agents, monitoring tools or security agents across all Azure VMs consistently.
- [Using Azure Firewall as a NVA with Terraform](https://simonvedder.com/using-azure-firewall-as-a-nva-with-terraform/): Using Azure Firewall as a Network Virtual Appliance (NVA) provides a powerful alternative to traditional VNet peering in hub-and-spoke designs.
- [Managing Secrets in Terraform: From Bad to Automated](https://simonvedder.com/managing-secrets-in-terraform-from-bad-to-automated/): When it comes to Infrastructure as Code (IaC), Terraform is an incredibly powerful tool.
- [Sending Custom Logs to Log Analytics via HTTP](https://simonvedder.com/sending-custom-logs-to-log-analytics-via-http/): Centralized logging is a cornerstone of any professional IT or DevOps setup.
- [Automated Terraform Deployments with GitHub](https://simonvedder.com/automated-terraform-deployments-with-github/): Managing infrastructure through Terraform is powerful — but doing it securely and automatically is where real efficiency begins.
- [Azure Service Groups – A New Way to Organize Your Cloud](https://simonvedder.com/azure-service-groups-a-new-way-to-organize-your-cloud/): Microsoft has recently introduced Azure Service Groups (public preview since August 2025) – a feature designed to bring flexibility and clarity into how you organize and monitor your Azure environment.
- [Auditing Azure VM Operating Systems](https://simonvedder.com/auditing-azure-vm-operating-systems/): Managing a growing Azure environment often means dealing with multiple subscriptions, distributed teams, and a wide range of virtual machine configurations.
- [VM Power Management in Azure Using Tags, Runbooks, and a Custom GUI](https://simonvedder.com/vm-power-management-in-azure-using-tags-runbooks-and-a-custom-gui/): As a Cloud Solutions Engineer, optimizing costs and automating operations is a daily priority.
- [Collecting GPU Metrics on Azure VMs with Telegraf](https://simonvedder.com/collecting-gpu-metrics-on-azure-vms-with-telegraf/): When working with GPU-enabled Azure virtual machines — such as those used for AI training, inference, or video rendering — you often need to monitor GPU utilization.
- [Azure Template Specs: Reusable ARM Templates](https://simonvedder.com/azure-template-specs-reusable-arm-templates/): Infrastructure as Code (IaC) is undoubtedly the gold standard when it comes to modern cloud infrastructure.
- [Using Terraform to Generate Local Zip Files](https://simonvedder.com/using-terraform-to-generate-local-zip-files/): Terraform is most commonly used to provision infrastructure — VMs, storage accounts, networking, etc.
- [Terraform vs ARM vs Bicep – Which IaC Tool Should You Use for Azure?](https://simonvedder.com/terraform-vs-arm-vs-bicep-which-iac-tool-should-you-use-for-azure/): In the world of Infrastructure as Code (IaC), several tools are available for deploying and managing Azure resources programmatically.
- [Quickly Find Azure VMs Without NSG Protection](https://simonvedder.com/quickly-find-azure-vms-without-nsg-protection/): Network Security Groups (NSGs) are a key security feature in Azure, acting as virtual firewalls to control network traffic to and from your Virtual Machines (VMs).
- [Self Service VM & AVD Order via Web Form](https://simonvedder.com/self-service-vm-avd-order-via-web-form/): In one of my projects, I developed an Azure-based solution that enables users to provision a virtual machine (VM) or an Azure Virtual Desktop (AVD) instance through a simple web form.
- [Getting Started with Terraform - File Structure & Best Practices](https://simonvedder.com/getting-started-with-terraform-file-structure-best-practices/): When I started using Terraform, I didn't really have a clear structure in place.
- [Deallocate VM based on Activity Log](https://simonvedder.com/deallocate-vm-based-on-activity-log/): In many organizations, virtual machines in Azure are kept running even when they’re no longer needed – especially during business hours.

## Pages

- [Six things I go deep on.](https://simonvedder.com/topics/)
- [Cookie Policy](https://simonvedder.com/cookie-policy/): This Cookie Policy was last updated on 30.07.2025 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.
- [Legal disclosure](https://simonvedder.com/legal-disclosure/)
- [Privacy policy](https://simonvedder.com/privacy-policy-2/)
- [Contact](https://simonvedder.com/contact/)
- [Posts](https://simonvedder.com/posts/)
- [About Me](https://simonvedder.com/about-me/): automation that keeps both from drifting.
- [Blog](https://simonvedder.com/blog/)
- [Home](https://simonvedder.com/)

## Optional

- [Agent (MCP protocol)](websites-agents.hostinger.com/simonvedder.com/mcp)

[comment]: # (Generated by Hostinger Tools Plugin)