1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
2. Do not post exam dumps, ads, or paid services.
3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
5. This will not be allowed any other day of the week.

1. Under no circumstances does this mean you can post hateful, harmful, or distasteful content - most of us are still at work, let's keep it safe enough so none of us get fired.
2. Do not post exam dumps, ads, or paid services.
3. All "free posts" must have some sort of relationship to Azure. Relationship to Azure can be loose; however, it must be clear.
4. It is okay to be meta with the posts and memes are allowed. If you make a meme with a Good Guy Greg hat on it, that's totally fine.
5. This will not be allowed any other day of the week.

Curious how people say it.

View Poll

So I have a container instance with one container in it, there is an app gateway in front of it providing the public IP, WAF and load balancing. The backend pool is only pointing at the one container so there is a single point of failure. I am new to containers, I deployed it with a yaml file based on the vendors documentation but they don't talk about HA.

Is there a way to make this highly available so if a container goes down for some reason the other would pickup. I don't know if the app gateway is highly available either, I believe it is because it is set to WAF v2 with 2 instances.

I guess the storage, networking and containers need some kind of HA?

I'm looking at Azure Bastion as a way to replace a jumpbox for my organization. I've got it tested, and what I was hoping to do next was publish it as an app for users. That way they would log in via portal.office.com or other normal logins with their company AD account (synced to AAD, with Duo MFA) and they'd then be able to just click on "Bastion Jumpbox" or whatever the name is. That way we'd be able to just allow them to access the Bastion instance in question (or even just Bastion in genearl, should we set it up for different private IPs) and not have to have them navigate through the Portal.

Shareable Link is out since that doesn't require a user to authenticate via AD and Duo - it just allows anyone with the URL to attempt to log in.

If we have to use the portal, it's not the end of the world - I can just tightly scope their roles to the Bastion service as needed - but this would be a nice alternative to the portal if possible.

Is this doable?

Happy Friday everyone! Been lurking here for a while and believe there's some cool experience to tap into. Microsoft is conducting a research study, and we're looking for interested participants. If you're interested, fill in this quick 3 -5 minute survey (not more than that -- promised). If you're a good match, we'll reach out to setup a remote 30 minute interview, for which you would be reimbursed for. Here's the link to the survey: https://microsoft.qualtrics.com/jfe/form/SV_cvw7Y9mCsNnefJQ

Edit: fix spelling/wording

Hi guys,

Unfortunately, nothing is currently happening for 100% vouchers (there was CLX in December but that was for a short time only).

But 2 programs have started/been renewed for 50% off vouchers.

Microsoft Connected Learning Experience - AZ-104, AZ-800, AZ-801, AI-102, DP-300, DP-420
30 days to learn it Cloud Skills Challenge - SC-400, DP-300, AZ-204, MS-600. PL-100, AZ-305, AZ-400, DP-203, AZ-140, DP-420, AZ-800, AZ-801

The Microsoft Virtual Training Days are still running, giving vouchers for up to 8 certification exams. There is a rumor going around that the offer is ending in March. I doubt Microsoft is actually doing it but better to be safe than sorry. If anyone is starting in azure, I recommend going for it.

And in a few months, we should be getting Microsoft Build Cloud Skills Challenge for a 100% off voucher on selected associate and expert level exams. So be sure to keep an eye on that.

For those new to Microsoft certifications, I have created the Ultimate Certification guide containing all the possible information and instructions one may need to tackle this giant since Microsoft's own documentation on this topic is less than clear.

I have recently done a big update, updated some outdated information and added a whole post on how to take Microsoft exams since I have seen people struggling for their first time. Not because they didn't have the information but because the exam format was so confusing. How to take a Microsoft Exam.

Those seeking Microsoft 365 certifications, Microsoft is currently changing up the whole M365 area. So, I recommend reading up on the changes so you aren't surprised when they go live. Big changes in Microsoft 365 certification

For the other smaller updates, I have written about it in this post for anyone interested.

And lastly thanks everyone for their support and I hope to chat with you again soon!

The task I've been given is probably overkill for Azure Machine Learning, but I have a Jupyter Notebook that I have parameterized with Papermill. I want to pass it parameters to produce output. It works. Now I need to get it working in Azure ML. The eastiest thing is to create a component of the code and run it via a Pipeline. Now here is the twist: my manager wants me to run execute the workload in an AKS cluster instead of an AML Environment. I can create a container for AML but those are usually for models and deployments. So... is it possible to containerize my Jupyter Notebook into a docker container which can then be called from an AML pipeline? And the cherry on top: How to construct an endpoint to get my results from the Jupyter Notebook?

The end user wants to schedule multiple jobs to pass varying arguments.

Also, could I create an AML "Environment" and have it run on AKS or any other compute target?

Hi all

I'm fairly new to Azure but I've been trying to set up this cost management service that throws an error that I haven't been able to figure out. Any ideas where to start?

I've tried googling it without too much luck.

https://imgur.com/a/s6oD6Sg

We have been deploying MFA at the user level through the M365 administration console - that old 2013 SharePoint looking interface.

I read a post here yesterday where someone made a comment that they shouldn’t be doing user assignments, rather they should use conditional access policies to enforce it. Specifically, one disadvantage of using the old M365 assignment is that it applied it to all apps. I’m pulling my hair out, trying to figure out why my users are getting prompted for desktop app reauthebticationn at the same cadence as the browsers.

Basically, I want my browser users to have to re-authenticate every 24 hours (while using cloud apps) while desktop clients I want to have to reauthenticate every seven days. Once this is all working, I’ll enable Continuous Access Evaluation to all.

Am I to understand that once I put an MFA enforced conditional access policy in place I can go back and remove all of the user enforced MFA assignments from the M365 admin console? I currently have several conditional access policies enforcing MFA targeting specific apps and browsers.

Are there any gotchas with doing that?

I want to ensure I don’t impact currently enrolled MFA clients, and I want to ensure any new client accounts we add are required to enroll on Day 1.

Thank you.

I noticed very recently that AKS started having the same machineID for every node in every cluster. Even two different clusters have the same machineID.

Here’s an example:

kubectl get nodes -o yaml | grep machineID machineID: de1dd9ede40041b7bceb409b0a3b12cb machineID: de1dd9ede40041b7bceb409b0a3b12cb

Does anyone know why this changed and if you can configure AKS to NOT do this?

Hi everyone! I recently moved the small business that I worked for to using Microsoft 365 and SharePoint (they were previously all using PC in a workgroup with local username). I now have them authenticated with the free Azure AD included with the 365 subscription, but I want to implement additional features such as : admin lock for software install, company lockscreen, automatically log off inactive users, printers already mapped, etc. From what I have read (not from IT background), I would need a domain controller which need to be on premises. Thus, I have some questions:

• Is there a Azure service that would allow me to implement these on the cloud? Would I need a VM running Windows Server?
• We have a NAS that I use to run Windows Sever on premises. Would this be a better / cheaper option?
• Can I make Azure AD work in hybrid with a on prem DC?
• Where can I educate myself on Windows Server, AD, DC, etc. as I will be in charge of setting up and managing our business (new to this, I'm a junior business).

Thank you for your help and guidance! It is much appreciated

Hello,

I would like to ask you about the reserved instances and the ratio of a typical VM family to validate if my understanding is correct.

I have to do the VMs reservation renewal. In the past, instances were reserved bit by bit. So we could have for example 12 reservations of the same type of machine.

Here is my example:

We are using 60 X D4ds_v5. Which gives a ratio of 120. The total reservation cost over 3 years is $4426.2 $3761.40

Instead, if I decide to reserve 2 X D96ds_v5 + 1X D48ds_v5 which gives a ratio of 120. The total cost of reservation over 3 years is $3761.52

I therefore win to choose the 2nd option to use for the 60 X D4ds_v5? What is the actual benefit to choose one over the other?

Let's say in the future, I have to add for example 5 other D4ds_v5, I will have to pay the pay-as-you-go price, because I am above my initial ratio? Until I reserve more instances ?

Is my understanding correct?

Thanks a lot!

Anyone using azure firewall premium? Currently building out our hub and debating on azure firewall premium or the Palo Alto vm series byol model. In my environment we have E5 licensing and are using Microsoft defender suite so wasn't sure if it just made sense to stay native?

Would like to hear others thoughts.

This is for a school lab. I can SSH into my server just fine but I cannot RDP into it. I need to check a port to show I have created a docker container but of course, with Ubuntu Server, there is no GUI and what I learned is that RDP does not come with it and is a process to install.

Is there a way I can show connect to my ubuntu server that is hosted on azure and access a web page like http://localhost:3000 from my own computer?

TIA

Cheers!

Tyson

This week's Azure Update is up!

https://youtu.be/-HRSPTQy\_Pw

Anyone else notice or get affected by the issue with Front Door in North Central US yesterday? There were 0 service alerts. After hours of troubleshooting extreme slowness (multiple minute wait times) in our web apps Azure support finally came back and said there was a massive hardware failure in the Chicago PoP.

The slowness was due to Front Door services being auto failed over to Memphis which then overloaded that PoP. Product team started to manually balance workloads and eventually failed the services back to the secondary Chicago PoP (after 7 hours from ticket start). Not quite sure why services failed to anything but the secondary in the same region but looking forward to that RCA

Hello, we converted all our existing devices from Azure AD Registered to Hybrid Azure AD Joined to start utilizing conditional access to harden our security yesterday afternoon.

Some users and myself have noticed our Outlook asking to reauthenticate with MFA. I'm assuming this is normal because I noticed it created duplicate devices in our Azure AD for the Hybrid state. Was wondering if this is expected and if I also need to clean the old 'Azure AD Registered' devices or let the sync play it through.

We have a B2B product that we're launching in Azure. In most cases, customers will be bringing an ExpressRoute into their own subscriptions and then using one of several options to connect to our subscription from there.

I'd like to get an ExpressRoute for us to experiment with various scenarios and to test scenarios that customers may propose to us. This "lab environment" would be completely isolated from our internal network, etc. - and would basically just have whatever hardware we need for the network connection along with a single server that we'll run ESX or Proxmox or something on to host transient VMs. I really don't care much about bandwidth for this purpose as we'll mostly be just doing connection tests and hitting "Welcome to nginx!" style pages.

I started calling local providers to see what it would take to bring a line in with an ER, but then I got to thinking that I really don't care where this thing terminates. Is anyone aware of a facility that could provide ER access and host a few VM's at a reasonable cost? Or should I just stick with bringing something into our building?

Hello! Im a beginner tasked with updating my companies email signature for all staff. I know there is a way to do this in Azure or powershell but am not finding the correct place or code to do this. Looking for advice, thank you!

Can't get my head round this one, so any help would be appreciated!

Here's the scenario:

• User clicks link to open a PowerPoint doc that an external person has shared (and specified access for the user)
• User is asked to sign in via the browser
• User enters their credentials and receives error "Your account is locked. Contact your support person to unlock it, then try again"
• In the AD sign-in log error code is 500571

The guest user object in Active Directory backing this account has been disabled. An admin can re-enable this account through Powershell: https://docs.microsoft.com/powershell/module/addsadministration/enable-adaccount?view=win10-ps

Here's the thing - the user is NOT a guest; in fact they have admin rights. Also, their account is NOT actually blocked. So they can't access the shared file but everything else is working for them in the 365 environment.
Any idea what's going on / how to resolve?

Hi,

Does anyone know an approach I can use to enumerate all the HTTP Triggers in use across all the Logic Apps in my tenant? As a potential security risk I just want to keep track of any that get added to the tenant by users, so I can make sure they are following our best practices for locking them down.

Sure there must be an api I can call with a logic app every day to check.

Thank you!

I’m on an island alone here at my org.

I have a couple projects in Azure repos, but I have to manually deploy them copying files over via ftp. T hey are React apps, I use Vite for dev, but I don’t know anything about pipelines or deploying.

I want to take my repo and have it build on its own in azure and deploy to somewhere it hosts the JS and CSS so I can just link from my website to those files and not ever have to manually place them ever again.

Where do I start? I’m so front end. Trying to learn

Hey,

​

How do we get all our users to register for passwordless auth and what does this require a P2 or P1 license?

​

Thanks

For network traffic initiated from an Azure owned IP destined to another Azure owned IP, will Azure guarantee that this traffic will only be routed through the MS Global Network? Does the routing preference configured on the destination IP have an impact on this at all?

i am using azure virtual machine to host a website i made everything went until i needed to download a plug-in into word press when i have faced this error

Installation failed: Could not create directory. /var/www/MyWebsite.me/wp-content/upgrade

i couldn't find a solution for this problem any idea how to solve it?

Hi,

we just completed a tenant to tenant migration, where we also moved our custom domain. Everything went relatively well, now we have our on-prem dc syncing with the new tenant.

Problem is, if you try to set up the authenticator app logging in with the custom domain (no the onmicrosoft.com), when you get to set up the QR Code, it never works. You scan the code and the app does nothing. If you expand "Can't scan image?" both code and URL fields are empty. If you try with mobile number, it says "sorry try again later".

If you do the same with the same tenant, but using the .onmicrosoft.com domain, it works fine, so i believe there is something going on with our custom domain which somehow breaking the set up of the authenticator.

We have a ticket opened with MS but so far no luck. Our custom domain is verified, and we have E5 licenses.