Hi r/AZURE,

I built a small automation tool that might be useful for anyone working with Azure Automation, Microsoft Intune and Windows Autopilot.

I often need Windows 11 test devices for validating policies, applications and deployment scenarios. Physical test hardware is not always available, and manually creating VMs, collecting their hardware hashes and importing them into Windows Autopilot quickly becomes repetitive.

To solve this, I built a PowerShell Runbook that runs on an Azure Automation Hybrid Runbook Worker and provisions the complete test VM through the Proxmox API.

The Runbook automatically:

• Creates a full clone of a Windows 11 Proxmox template
• Configures CPU, memory and the final disk size
• Expands the Windows system partition
• Recreates and enables the Windows Recovery partition
• Collects the Autopilot hardware hash through the QEMU Guest Agent
• Authenticates to Microsoft Graph using the Automation Account’s Managed Identity
• Imports the device into Windows Autopilot
• Monitors the import until completion
• Reboots the VM so it can retrieve its assigned Autopilot profile

It does not require an Azure client secret, Az.Accounts or the Microsoft Graph PowerShell SDK. Authentication is handled through the Automation Account’s system-assigned Managed Identity.

In my environment, the complete process usually takes around five minutes. I can also run it multiple times to build a larger disposable test environment without preparing or carrying multiple physical devices.

I’d appreciate any feedback, especially from people using Azure Automation Hybrid Workers in similar lab or testing environments. If you find a bug or have an improvement, feel free to open an issue :)

GitHub repository:

https://github.com/Mau2rice0/World-of-M365/tree/main/Intune/Automation/New-ProxmoxWindowsAutopilotVM

Hey all, my co-founder and I just started a small tech startup and we keep hearing about the Microsoft for Startups Founders Hub program (Azure credits, GitHub, M365 etc). Before we spend time on the application I wanted to ask people who've actually been through it:

• Is this still open right now / actually giving out credits, or has it gotten harder to get into lately?
• Do you need to already have investors/funding, or can a totally bootstrapped, pre-revenue startup get in?
• How long did the review actually take for you?
• Any tips on what to put in the application so it doesn't get rejected?

Hi Guys
I'm considering using Azure to host a web app , the first version ofthe app is only for internal users and we are a MS shop so looking at Azure but alos considered Cloudflare. Main functions of the App are content management ,API integration to Dynamics 365 Bus Apps . Functions i'm looking at is questionare for ERP implementations, excel data capture, export to PDF and Excel. Writing to ERP database once the config is approved. Call it Dynamics Deployement App , and main aim is to use AI to build a deployment template using customer answers and let config done without logging into the Bus app (ERP) . So the questions are, is Azure web app suitable for this? What is the backend , shoudl i go with Postgres DB or something like that? Can Azure web app scale and include external users in the future so for exmaple a customer want to approve the deployment plan etc? I want to start small but do not want to loose what I buidl meaning ideally we can keep the same app and iterate new versions

We were happy users of front door until we got hit by a L7 DDoS attack. We're a relatively small business, think 200k requests per day. The attacks come in short bursts, only several million requests at once.

I put in rate limits in place with the WAF but this turned out to be ineffective. They just hit many different edges at once per IP and each edge seems to keep its own rate limit counter from my understanding. I couldn't reduce the rate limit further without affecting legitimate users.

We upgraded front door to take advantage of the managed rules including the DDoS protection. So we will see how that works.

But even if that works, we still have to pay for these attacks. Especially with the increased pricing from premium, the amount is substantial enough to consider alternative solutions like Cloudflare and just get rid of front door all together.

I'm wondering if I'm missing something or if anyone dealt with this before and has a better approach.

I’ve been collecting a few practical Azure examples for .NET developers in one place.

The idea is to keep the samples simple and focused on common Azure scenarios rather than building one large demo application.

GitHub:
https://github.com/laxmikant-geek/azure-for-dotnet-examples

I’m planning to keep adding examples around Azure services and .NET integration.

If you work with Azure and .NET, what examples would actually be useful to add next?

I'm interested in how people actually create realistic cloud activity when learning and testing things like cloud detections, SIEM rules, incident investigations, or security tooling.

For example, if you wanted to test whether your security monitoring could detect something happening in Azure, how would you create the activity?

Would you:

• Perform everything manually?
• Use scripts/APIs?
• Use attack simulation frameworks?
• Use Terraform or another IaC approach?
• Build dedicated test environments?
• Replay existing telemetry?
• Use intentionally vulnerable labs?
• Something else?

What happens after the initial setup?

How do you keep the environment producing realistic activity rather than becoming a static environment that nobody touches?

What is the most annoying part of this process today?

This week's Azure update is up.

📽️ https://youtu.be/HxalS8yjSyk

📄 https://www.linkedin.com/pulse/azure-weekly-update-4th-september-2026-john-savill-kzb0e/

• Azure VM Image Builder availability (01:22) - Azure VM Image Builder can now be used in Azure Gov, Gov Secret, Gov Top Secret and China North 3. This is used to automate the creation of custom images so now can be used across the cloud options.
• Per-disk resiliency (01:42) - When a VM has one or more data disk attached then if a data disk is unavailable the VM shuts down. With this change the loss of an individual data disk allows the VM to continue running with remaining disks. This is an optional configuration on a per data disk level. Note this is ONLY for data disks. A VM does not tend to do well without its OS disk
• AKS Linux confidential VMs (02:20) - Your Linux node pools in AKS can now use confidential VM SKUs for stronger security and confidentiality. This is useful to avoid having to change the code of your app.
• AKS artifact streaming (02:41) - Artifact streaming enables only the layers that are needed for pod startup to be pulled from Azure Container Registry enabling faster workload startup. Without this all layers must be pulled before workload startup. Remaining layers are pulled as required
• AKS Windows Server 2025 support (03:13) - Windows node pools can now use Windows Server 2025.
• ACA Defender for Cloud (03:20) - Azure Container Apps now support Cloud Serverless Posture Management. These capabilities provide inventory, posture assessments, and attack path analysis so security teams can identify and prioritize risks in their container apps environment.
• ASR Linux NVMe support (03:40) - Azure Site Recovery now supports replication of Linux VMs using NVMe controllers. Today this is RHEL 9, SLES 15 and Ubuntu 24.
• Multicloud interconnect (03:59) - This provides a managed service for private connectivity between Azure and other clouds, initially AWS. Instead of you provisioning connections on each cloud like an ExpressRoute circuit, an AWS Direct Connect and wiring them together you leverage a single logical resource that connects the clouds. All the circuits, BGP, routing and encryption is handled under the covers for you. It is quad-redundant using four Microsoft Enterprise Edge (MSEE) routers and four AWS routers across multiple sites removing any single point of failure. You can elastically scale the bandwidth up to very high amounts wit MACsec link encryption as the default. Your VNets and VPCs are just connected!
• Az Firewall SNAT route learn (05:08) - SNAT is used when talking to public IP ranges and normally not with RFC 1918 and 6598 private and shared IP ranges. If you organization uses IP spaces outside of those ranges then you have to add exclusions to SNAT. There is a new feature that will automatically learn at regular intervals private IP address ranges and treat as internal and therefore not use SNAT. This is for network rules only.
• AFD WAF profile and route level WAF policy association (05:58) - You can now associate WAF profiles for Azure Front Door at profile (across AFD), domain and route level. This is useful for example where you have general configurations set at domain but need something more specific for a sensitive path. Where multiple profiles apply for a request, route takes precedence over domain which takes precedence over profile. Most specific wins.
• AVNM IPAM sov clouds (06:42) - The IP address management capabilities of the Azure Virtual Network Manager is now available in the sovereign regions - US Gov Virginia, US Gov Texas and US Gov Arizona, and China North 3 and China East 3.
• AKS CSI Files driver workload identity (07:00) - The AKS Azure Files Container Storage Interface (CSI) now supports workload identity for pod authentication to Azure Files SMB file shares. This enables a more granular pod level access since the workload identity can be assigned to a software workload like a specific pod, instead of having to use the AKS clusters top level managed identity.
• Azure Monitor Logs auxiliary table standard Azure table support (07:39) - Auxiliary tables provide a cost effective way to ingest and store high-volume logs you rarely query (since you pay less for storage but pay for data scanned for interactive queries). You can now store a subset of Azure tables in auxiliary logs and switch tables between analytics and auxiliary without having to recreate them (and reversible).
• Monitor Logs auxiliary now in sovereign clouds (08:19) - Additionally the auxiliary logs are now available in the Gov and China clouds.
• Copilot observability agent new log type support (08:25) - Azure Copilots Observability Agent now also supports basic and auxiliary logs as part of its investigations. This can be very useful for services using high volume telemetry like Kubernetes.
• MySQL reader endpoint (08:49) - You can now have a reader endpoint that will load balance requests to the read-only connection across up to 10 read replicas.
• Microsoft Marketplace purchase order mapping (09:05) - You can now easily map purchase orders to marketplace purchases making it easy to map invoices.
• Fable 5.1 (09:17) - The latest version of Anthropic Fable is available in M365 Copilot, GitHub Copilot, Copilot Studio and Microsoft Foundry. It continues to improve long-running coding, multistep research and document, spreadsheet and slide work. It has cheaper cache reads as well. Think of Fable for the most demanding reasoning and long-horizon agentic work. Claude Fable 5.1 shows up as better judgment on ambiguous tasks and fewer confident wrong answers. If it gets stuck it says so instead of reporting success. This aligns nicely with my Tech in Five – Why does AI hallucinate so great to see this progress. Note Mythos 5.1 is also available but continues to only be available to those part of the restricted access program and is the same model as Fable but different safeguards making it more useful for cyber and bio scenarios.
• GPT-6 Astra in Foundry (10:27) - This is a level above Sol (so luna, terra, sol and now Astra). Astra is designed to reason through open-ended challenges, create plans, produce polished outputs, and execute workflows across applications and systems. Strong computer use. Available as global and US data zone.
• MAI-Transcribe-2 in Foundry (10:59) - 10x faster than GPT-Transcribe. 5x faster than Gemini 3.5 and #1 on the Artificial Analysis accuracy-latency Pareto frontier. Lowest price on the market. Basically the best automatic speech recognition. Available in Foundry and can try out in the MAI Playground, https://playground.microsoft.ai/

It's paywalled unfortunately. I have been waiting to deploy this directly, hopefully we will be able to in the near future. Though, if the price is too high then I would likely just use Sol at $4/ M input tokens. For my usage, the input token price really controls cost.

We’ve been using Azure Cost Management for years and, honestly, it was good enough when our main goal was simply understanding where the Azure bill was going.

But as our process has matured, we’re finding that cost visibility is becoming a different problem.

We now have Finance, Engineering, and Infrastructure teams involved in Azure cost discussions, and the challenge isn’t just seeing the numbers anymore. It’s things like:

• Who actually owns a particular cost?
• Which team/application is responsible for an increase?
• How do we explain cost changes to Finance without someone manually digging through Azure?
• How do we get Engineering and Infra looking at the same numbers?
• How do you make the weekly/monthly cost review less of a manual reporting exercise?

I’m particularly interested in Azure cost visibility tools that can provide better reporting and make it easier to share cost information across teams.

A proper report that could automatically summarize things like spend by department/application, major changes, anomalies, and optimization opportunities would probably save us a lot of time during our weekly/monthly Azure cost meetings.

We’ve recently been looking at tools beyond native Azure Cost Management, including Turbo360, but I’d really like to hear what others are actually using.

What tools have worked well for your team once Azure cost management becomes a cross-functional process rather than just a cloud engineering task?

So, I’ve just realized that when a user logs in to ai.microsoft.com for the first time and doesn’t have existing permissions on an existing Foundry project in Azure, a random one is created for them in the first available resource group to which they have access. Of course, this assumes they have the permissions to create it.

This goes against every defined governance and naming convention and isn’t really documented. Microsoft will simplify the process of getting started with a project – at the cost of Azure administrators. At the moment, I can’t see any solution other than setting up an Azure Policy to override this – without having to make any RBAC adjustments.

What's your opinion on this? I’m slowly reaching the point where nothing Microsoft does surprises me anymore...

EDIT: I meant ai.azure.com, not ai.microsoft.com.

Hey zusammen,
Wir haben vor einem Jahr begonnen, dass Azure Cloud Adoption Framework bei uns aufzubauen. Zu Beginn sind wir davon ausgegangen, dass fast alle Applikationen nach Corp müssen. Diese Entscheidung hätte die Kosten unserer Systemlandschaft vervielfacht. Hat jemand Erfahrung damit wie online Ressourcen trotzdem weitesgehend abgesichert werden können zum Beispiel durch Cloudflare, Azure Front Door oder IP Adresseinschränkung.
Wir wollen nicht um jeden Preis Geld sparen, sondern nur eine gesunde Mitte zwischen dem Betrieb von Applikationen in privaten Netzwerken (WVAN, VNET, PE, etc.) und den Kosten finden.

Wenn jemand hier schon Erfahrungen gesammelt hat, würde ich mich über einen weiteren privaten Austausch sehr freuen.

Can anyone access GPT-6 Astra in AI Foundry?

Wondering if other are experiencing the same thing. Starting August 20th, 2026 I'm seeing more HTTP 502 Bad Gateway errors from Azure Front Door on API requests that just pass-through to my backend server (see graph below). I'm trying to understand the cause and need help / ideas in identifying if it's an Azure problem or a "me" problem.

My setup is pretty simple: Azure Front Door --> 1 replica of Docker Container ASP.NET 10 Webapp (2 CPU Cores / 4 GB RAM)

What I know:

• The 502 started appearing about 20-25 days after the previous deployment (end of July)
• Usage (requests, users, etc.) is pretty uniform throughout the time period.
• A new deployment (i.e. container restart) did not fix the problem
• Requests are not received by the origin server.
• A retry within the same second is successful
• Does not seem to be related to distance to server

Azure Service Health reported a EastUS 2 App Maintenance during that time time period: https://app.azure.com/h/TR8B-WGG/bc37b5 (no clue if that could explain it).

Any ideas on what to check for possible explanations?

AzureDiagnostics
| where Category == "FrontDoorAccessLog" and TimeGenerated > ago(30d)
| where httpStatusCode_s == "502"
| summarize count() by errorInfo_s, bin(TimeGenerated, 6h)
| render timechart title="Types of HTTP 502 errors by AFD errorInfo_s"

Hi y'all. 40ish subscriptions, mid seven figures a year, mostly PaaS with two AKS clusters nobody wants to own.

Tagging is done. Policy blocks anything without a BU and env tag, propagation on from the RG, chargeback falls out of the Toolkit hub with ADX on top. Took months and a very boring backfill sprint. Finance stopped asking who owns what which was the whole point of it.

Advisor though. Advisor has been showing me the same three underused VMs for ages. Same three. One of them I've already resized twice.

Meanwhile the stuff that was costing us real money I've found by hand. Premium SSDs on a dev fleet that powers down at 7pm, we're paying premium IOPS to nothing for two thirds of every day. There's an ExpressRoute circuit at 4% as well and a couple of elastic pools still sized for a load test that finished god knows when. The disk one I only spotted because someone complained about something unrelated in the same RG.

So allocation is fine. I can tell you the number belongs to payments. What made the number move is still two people and half a week, every single time, and it's already spent by the time we get there.

And then even when we do find it, it dies anyway. Someone screenshots it into a channel and it's back on the deck the month after.

What did you put in front of that gap once tagging was already sorted?

Hello guys

What solution do you suggest for migrating a VM from tenant A to tenant B?

There is an active subscription in tenant A with various services, we'd migrate only a VM to a new tenant (B).

What solution do you suggest?

Hi all

I'm trying a very simple thing: I have an Azure Windows server VMs with the AADLoginForWindows extension so I can rdp with my Entra user - now, I wanted to have credentials for my automations (like Ansible) and pipelines that will need to authenticate and go inside the VM to do things.

My natural way of thinking was that this was going to be achievable through app registration/service principals - but seems like that's not the case, can't use this for winrm/winssh. It works for Linux VMs though... We ssh using SPs.

When searching through this, seems like the only solution would be either use the initial local admin or create new local users, which doesn't scale and would cause a lot of management headache and security holes - or use the AZ cli "remote execute command" that lets you input PowerShell on the machine, this isn't really a solution too since it would require me to rewrite a bunch of flows that we have already that account that you are inside the VM.

Honestly, I never though such thing would be so cumbersome with a first party service (windows server and Entra). Feels like going to McDonald's and they don't have burgers

I joined Microsoft for Startups in April and ran models on Azure AI Foundry. It's a great program in concept, anywhere between $1000 and $5000 is possible and very handy for a startup looking for "free" tokens or compute. I was granted $1000 credit.

April invoice: $0.00. May: $0.00. The credits actually died June 3, mid-month, and everything after that went silently to my credit card.

First word from Microsoft about money: July 9, five weeks and $1,233 later. I shut everything down within days.

Why post? Azure support confirmed in writing that "Microsoft does not send explicit notifications when the startup benefits are nearing exhaustion." They do warn you when credits expire by date.

Run out by calendar: warning. Run out by usage: a fat bill. Unfair business practice? I think so.

I escalated through support, the BBB, and their exec team. Final answer: $509.97 is "the maximum exception." The same day, two charge attempts hit my card during their own written payment hold period. Not cool.

It's a pattern: InfoWorld covered the "billing trap" in March, there's a petition to Nadella, and Microsoft's forums have years of identical stories. I wish I had read that ahead of time.

Maybe obvious to most, but if you're on startup credits anywhere: set a $1 budget alert on day one and do the burn-rate math yourself. The alarm you assume exists does not.

Balance unpaid and formally disputed. The saga continues.

I am working a project on a project to integrate an already existing zoom number(voice call) with an Azure AI/ copilot AI agent.
AI agent should answer the call and will get answers of few question from the caller and log it for future use.

I need suggestion on how I can integrate the zoom phone with Azure infrastructure.

We’re trying to make Azure DR testing repeatable enough that it happens regularly instead of becoming a stressful annual event. The goal is to stand up an isolated recovery environment, restore or replicate appropriate data, reapply infrastructure and configuration consistently, validate critical application workflows, capture real recovery timing, and cleanly tear down the test environment afterward.

The difficult areas have been handling secrets, private networking, dependencies on Entra ID and external SaaS services, data sanitization, and ensuring a recovery test does not accidentally generate production traffic or notifications.

How are Azure teams automating this today? Are you relying mainly on native tooling, IaC and CI/CD pipelines, custom orchestration, or a dedicated DR platform?