Managed Identities vs Service Principals - when to use what ?
Managed Identities eliminate the need for users to manage credentials by providing an identity for the Azure resource in Azure AD and using it to obtain Azur...
Posts by Year
2023
2022
How to get the System Assigned Managed Identity Object Id from within the VM?
To get the Object Id of the VM’s System Assigned Managed Identity, you need to call the Azure Instance Metadata Service (IMDS) endpoint and use the provided ...
Deep dive into Azure Container Apps - Operating, security, reliability and pricing
Azure Container Apps is a serverless offering you can use to host your containers. It is a good fit for containerized apps and hosting microservices. Integra...
Deep dive into Azure Container Apps - Overview and Networking
Azure Container Apps is a serverless offering you can use to host your containers. It is a good fit for containerized apps and hosting microservices. Integra...
Deep dive into Defender for Containers
Microsoft Defender for Containers is the new plan that merges the capabilities of the two existing Microsoft Defender for Cloud plans, Microsoft Defender for...
OAuth 2.0 with Managed Identities
Using Managed Identities to access an OAuth 2.0 protected application is a best practice for an application to application communication or, as referred to i...
Private Link and Flexible Server DNS resolution using custom VNET resolvers
In enterprise scenarios, when you need to resolve on-premise DNS records or have cross-subscription DNS resolution of the private DNS zones, configuring prop...
Building an AKS baseline architecture - Part 4 - AAD Pod Identity
In this series of posts, you will find all the steps needed to build a baseline or reference architecture for Azure Kubernetes Service (AKS) by incorporating...
2021
Building an AKS baseline architecture - Part 3 - GitOps with Flux2
In this series of posts, you will find all the steps needed to build a baseline or reference architecture for Azure Kubernetes Service (AKS) by incorporating...
Azure Function keys - what are those and how to access them
Azure Function Keys are used for authorizing access to the functions. The host and the master key exist at the Function App level, while each function also h...
Falco as an Azure Kubernetes Service (AKS) runtime security tool
Falco is an open-source tool for container runtime security that can help you secure Azure Kubernetes Service (AKS) from zero-day vulnerabilities and unexpec...
Access HashiCorp Vault secrets from AKS using Managed Identities
HashiCorp Vault agent and the CSI (Container Storage Interface) provider use Kubernetes type of authentication, based on Kubernetes Service Account Token. Az...
Building an AKS baseline architecture - Part 2 - Governance
In this series of posts, you will find all the steps needed to build a baseline or reference architecture for Azure Kubernetes Service (AKS) by incorporating...
Building an AKS baseline architecture - Part 1 - Cluster creation
In this series of posts, you will find all the steps needed to build a baseline or reference architecture for Azure Kubernetes Service (AKS) by incorporating...
Get login details for service principals
Microsoft added support for querying audit reports for service principals in the beta version of the Microsoft Graph APIs. This functionality can help you bu...
Azure Container Instances in VNET with custom DNS
Azure Container Instances (ACI) is a serverless container runtime offering. You can use it to deploy Linux containers into an Azure virtual network, which wi...
Logic App connector for Key Vault using Managed Identity
Connectors provide quick access from Azure Logic Apps to events, data, and actions across other apps, services and platforms. One of the frequently used conn...
Identifying VMs with Public IP address
Identifying all the VMs that are reachable from the Internet is something you must do to govern your environment successfully. It is not a simple task to per...
Virtual Machine Scale Sets (VMSS) best practices
Virtual Machine Scale Sets (VMSS) enable you to create and manage a group of load-balanced virtual machines easily. VMSS is an IaaS service usually used in t...
2020
Idempotent script to provision Private DNS Zone in Azure
Azure Private DNS provides a reliable, secure DNS service to manage and resolve domain names in a virtual network. By using private DNS zones, you can use cu...
Azure Well-Architected Framework
Following industry standards and terms, the Azure Well-Architected Framework provides a set of Azure architecture best practices that support your cloud solu...
Certificate management using Let’s Encrypt certificates and Azure Key Vault
Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. Key Vault ACMEBot is an open-source solution for autom...
Run Kubernetes on Windows 10 using WSL 2
Kubernetes is originally designed to be deployed and used in Linux environments. The Windows Subsystem for Linux lets you run a Linux environment on Windows,...
Run Linux containers on Windows 10 using WSL 2
The Windows Subsystem for Linux lets you run a Linux environment on Windows, without creating a virtual machine. WSL 2 is the latest version of the Windows S...
How to add Microsoft Graph API permissions to a Managed Identity
Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure AD. When accessing the Microsoft Graph, the man...
Integrate Storage with Computer Vision and Cognitive Search using Logic Apps
Azure Logic Apps is an event-based serverless offering that enables connecting and integrating disparate systems without writing a single line of code. Follo...
Zone to Zone Disaster Recovery in Azure
Availability Zone is a high-availability offering that protects you from datacenter failures. Zone to Zone Disaster Recovery enables VM replication between t...
Protect your APIs with Azure API Management - part 2 (OAuth 2.0)
OAuth 2.0 authorization at API Management gateway is an excellent solution if you want to introduce modern authorization for your legacy APIs, offload the au...
Back to basics - OAuth 2.0 and OpenID Connect
OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows ...
Protect your APIs with Azure API Management - part 1 (client certificates)
API Management gateway can enforce TLS client authentication, and it can inspect the certificate contained within the client request and check for properties...
Azure Resource Manager templates - a lesson learned
Last week I worked on an ARM template for a deployment that, among other resources, included Web Apps and SQL databases. One of the tasks was to allow the co...
Managed and secured hub-spoke architecture using Azure WAN and Firewall Manager
Azure Virtual WAN is a managed hub-spoke architecture, that supports public (VPN) and private (Express Route) connectivity. The hub enables transitive connec...
Quickly and efficiently scale containerized applications using Azure Kubernetes Service, Container Instances, and Application Gateway
Azure Kubernetes Service (AKS) is a managed Kubernetes cluster offering in Azure, meaning Microsoft is taking care of managing the Kubernetes masters. AKS is...
SSL certificate error when accessing Application Gateway listener using curl
If you get the following error when you try to open a webpage using Linux command-line tool curl: curl: (60) SSL certificate problem: unable to get local ...
Using Azure DevOps to build and release a Jekyll site
“Jekyll is a static site generator. You give it text written in your favorite markup language and it uses layouts to create a static website. You can twea...
How to use Key Vault references in App Configuration from .NET Framework Console application
Azure App Configuration provides a service to centrally manage application settings and feature flags. Modern programs, especially programs running in a clou...
Limit the size of POST requests in Azure API Management
If there is a need for a file upload support using API POST request, and there is a maximum file size set the backend, the best place to validate the file si...
Basic authentication in API Management using Key Vault
Policies are a powerful capability of the Azure API Management (APIM) that allows the publisher to change the behavior of the API through configuration. APIM...
Generate self signed certificates
In this post, I’m explaining how to generate a wildcard certificate for the custom domain with openssl, using a custom Certificate Authority. You can find th...
Migrate virtual machine into availability zone
Availability Zones is a high-availability offering that protects you from datacenter failures. Think of them as separate datacenter inside one Azure location...