r/AZURE

I'm trying to transition into Cloud Operations from IT Support, and I've been learning Azure and Terraform for a few months now. I keep hearing how it's best to include your own projects in your CV to increase your chances of finding a job, but tbh I've never been good at coming up on my own with feasible ideas for these things that wouldn't amount to be simply rehashing some guided projects/labs you can find online on Udemy and similar sites.

I've tried extending some concepts I've learned about in my Azure training, and so this is what I've come up with:

• Deploy a storage account with a blob container, and then show 2 ways you can restrict access to it.
• The first way is to disable public network access, and create a private endpoint connecting the storage account to a virtual network. I would then deploy a virtual machine on that network (with a key vault to store the login password to the VM in), remote to it through Bastion, and access the blob container from there.
• The second way is to use RBAC. I would disable key access and default to Entra ID authentication, then create a group with a "Storage Account Contributor" role assigned to it in that storage account's scope, and assign users to that group.
• Finally, I would convert this into IaC in Terraform to automate deployment, with an added option of using another storage account for storing remote state files through Azure backend. The Terraform code would be stored on GitHub.

I've already written and tested most of the code, but I can't shake the feeling that this whole idea is somewhat... crude. Would it really make sense to put something like this in my portfolio?

Hi, is anyone else having issues deploying new compute resources in NE? Opened several tickets for quota increase (from zero) and getting the backlog response.
For now it’s affecting manage instance and logic apps.
Waiting to hit the wall with general compute🙈

I'm setting up training labs and have this setup.

Attacker connects through WAN (10.0.2.4) on pfsense. Also have OPT1/DMZ at 10.0.4.4 with a webserver at 10.0.4.213. Now the tricky part.

LAN interface is 10.0.6.4.

I have two subnets 10.0.3.0 and 10.0.5.0 pointing to the 10.0.6.4. Goal is to build it out into more subnets like HR, Finance, Business, etc. I have UDRs set for each network and can reach each host just fine.

Problem: when I have a UDR set for 0.0.0.0/0 pointing to 10.0.6.4, I can't access the internet and pfsense does not see the traffic. Network watcher confirmed 10.0.6.4 is the next hop.

My goal is to build a network traffic analysis lab only focused on zeek and security onion. That works fine in 10.0.3.5, managed to setup port mirroring via open VPN on pfsense.

I want live web access to make noise, but hitting a wall. I may just give up and use inetsim to respond to the web/dns requests and stop fighting the routing/no internet. Internet works when the 0.0.0.0 rule is removed.

Any ideas what could be causing this? Or any ideas on a better way to do this? I'm slowly building out a network with VHDs I've configured and deploying via ARM templates.

Thank you in advance.

Our production Azure Batch pools, jobs, tasks and config are missing and were deleted by Azure. Our account was temporarily disabled for two hours due to a lapse in payment which was quickly updated to reactivate the account. In the email notice of disablement it said data would be deleted on 8/27/2026, over 3 months away, if payment wasn't made. It was made in two hours, but our Azure Batch infrastructure was deleted. Azure external support staff from India said to recreate the pool and jobs and they didn't know how to recover the batch data. We do backup task runtime logs and have scripts to recreate batch infrastructure, but want to recover the existing batch infrastructure, config, and task history.

Who can we escalate this to in order to get real effort into batch data and infrastructure recovery? Why would they delete our Azure Batch resources when it said no data would be deleted? I want to talk to the internal Azure Batch engineering team who builds and develops Batch, to an internal Azure backend data recovery specialist, or anyone else who has the required access level and expertise needed to help with this since azure standard support staff were not able to. How can we get our data back? Are there internal data recovery specialists?

It is not acceptable to delete customer infrastructure without warning of deletion and extremely prematurely within a 2 hour period when the given notice said any possible deletion would occur after about 100 days. Is this expected behavior for batch resources to be completely deleted when an azure account gets temporarily disabled? Azure should honor the disabled state and preserve batch resources, configurations, and history.

I'm looking for a pattern for app deployments I can reuse where the resource group holding the app's resources is constrained to a budget, but it looks like brand new resource groups cannot be tied to a budget through the portal UI.

Anyone have an approach for this pattern? Thanks.

For people working with cloud infra daily:

What’s the most mentally draining part of managing cloud systems?

Not the hardest technically.

The part that repeatedly burns attention and energy.

I’m noticing a lot of engineers spend more time managing complexity than actually building.just curious

Start-AzVM fails with:

"Allocation failed. We do not have sufficient capacity for the requested VM size in this zone."

Region/Zone: North Europe / 1

VM size: Standard_D4as_v6

Did retrying work for you, or was resize / move zone the only fix?

Hi, really more of an API design question than an azure-specific one.

I'm building a mixed B2B/B2C file API. Customers/partners upload/download up to 500MB files. Storage account is locked down (currently) with no public access (publicNetworkAccess: Disabled) but I'm considering changing this.

Downloads: Two options:

1. GET /files/:id/content streams bytes through the API (App Service, private endpoint to blob).

2. MS Graph style: 302 w/ presigned URL, client downloads straight from blob. No streaming through app but storage needs public access.

Uploads:

Currently doing chunked upload sessions modeled on MS Graph createUploadSession. Client POSTs to create a session, gets back an upload URL with a 24h HMAC token, PUTs chunks. Server calls stageBlock. Token is the only auth on the PUT.

Chose this because:

• 230s App Service request cap rules out single PUT
• Chunked PUT direct to blob w/ SAS (like downloads option 2) means public storage
  • I'm still wondering if straight-to-SAS-URL is the right move instead of my chunked sessions
  • It makes it a little weird to use because you also have to tell the client what headers they need to include
  • User can upload ANY size to that endpoint (and we can only check when they commit)
  • User can their own storage tier etc. with the headers it seems?

Has anyone done this tradeoff? I see a lot of "just hand out the blob storage SAS URLs" for both but there seems to be some significant downsides for using them for either download or upload. Just looking for advice or examples.

edit: Thanks for all the feedback. Since security and control is much more important to me than a bit more load on my server, I think I'm going to settle on this set up:

• publicNetworkAccess: Disabled / vnet-only access to the blob storage
• app-level Bearer/cookie auth on all file endpoints (no presigned urls anywhere)
• upload is ms graph-style with PUT /files/upload-sessions + PUT /files/upload-sessions/:id (loop) with auto-commit on the last byte uploaded
• download is direct from a /files/:id/content with a Range: header supported to allow downloading huge files/resumable downloads despite the 230s request timeout.

Disclosure first because the mods will catch it: I wrote this, MIT licence, link at the bottom, no upsell.

School IT background, but the use case generalises to any small-to-mid-size M365 estate (schools, small businesses, charities, roughly 20-500 users) wanting proper drive-letter mapping for OneDrive and SharePoint where the OneDrive sync client isn't the right shape. Wanted a drive-letter sync setup with a few specific things: image thumbnails that actually render in Explorer for cloud-mounted files (most existing tools don't), accurate cloud-quota numbers in the drive-properties dialog (refreshed from Graph), a local-first design where files always exist as real NTFS first and sync to the cloud in the background (rather than presenting the cloud as a virtual filesystem), one config.json that deploys to the whole estate, and zero telemetry. Didn't find one off the shelf with all of those, and was also curious whether I could build it myself. Side project that turned into a real thing.

It's called OneSync. .NET 8, Dokan for the FS bridge, MSAL + Graph SDK for auth and sync. Self-contained exe, Intune-deployable.

Highlights:

- True drive letters via Dokan (not subst, not "OneDrive sidebar entry under TenantName - LibraryName")
- One config.json deploys to the whole estate. OneSync probes Graph at startup and silently skips drives the signed-in user can't access, so different roles (staff/students, sales/finance/ops, whatever your split is) share one config
- Accurate cloud quota shown in Explorer drive properties (refreshed from Graph)
- Image thumbnails (JPG/PNG/HEIC) render like a local disk
- LRU eviction below a free-space threshold so shared/hot-desk laptops don't fill up over time
- Office desktop AutoSave + co-auth on docx/xlsx/pptx (via file-association redirect to ms-word:ofe with the direct SharePoint URL, slightly cursed but works)
- Zero telemetry. No analytics, no licence-server pings, no anonymous usage stats. Only outbound calls are to graph.microsoft.com and login.microsoftonline.com.

One war story while I'm here: Dokan's FindFiles callback enters synchronously from the kernel, so anything that blocks in there hangs Explorer. The first version called Graph synchronously to enumerate folders via .GetAwaiter().GetResult() (I know, I know). Worked fine until Graph went into 429 cooldown, at which point opening a folder hung Explorer for ten minutes while the cooldown lifted. I learned a lot in those ten minutes about how Explorer's UI thread feels under those conditions. Current behaviour: if Graph is in cooldown, folder browse returns immediately with on-disk placeholders and file hydration kicks off via Task.Run. Obvious in hindsight.

Repo: https://github.com/madeyouclickstudio/OneSync (DEPLOYMENT.md covers silent install switches and Intune detection rules)

Honest caveat: I'm running it with a handful of pilot users, not a full estate. The fleet-scale stuff is engineered for it but not battle-tested. Anyone deploying this to thousands of users is a pioneer at their own risk. Bug reports very welcome.

Yes I know about the OneDrive sync client. We tried it. The reasons it didn't fit (no real drive letters, every library is its own sidebar entry, no way to cap disk usage on shared laptops, no central deployment for which libraries each user sees) are exactly the reasons this exists. If those don't bother your fleet, OneDrive sync client is fine and you should ignore me.

Tell me what's wrong with it.

Hello everyone! IT/Tech noob here working to dip his toes into the industry. I have been working on a project the past couple months that allow me access to Microsoft Enterprise Applications/Platforms such as Azure, Intune, Entra, etc. Currently done with said project but still have a few more months of access. Are there any beginner projects/excercises/things I can do on Azure or any of the applications or on the VM i have on Azure to help increase my knowledge from a practical perspective? Thank you for your time

EDIT: I don't actually mean I'll work in prod, you don't need to ward me off of it. I'm just looking for different ways to develop so I don't duplicate efforts and raise costs. Probably not the best title to give it, but I was in a rush

Hello,

I'm developing a Data Warehouse project using Azure (Azure Data Factory, Azure SQL Server, VNets, VMs, Bastion, etc. etc.). I'm handling PHI in the Data warehouse, which is why there's so much infrastructure.

I basically plan to install a SHIR for the source (it's an on-premises server), link it to ADF, set up a VNet and use private endpoints for the connection from ADF to the actual data warehouse (Azure SQL Database). Since the database is closed from public connections, and I can't just 'whitelist my IP', I wanted to set up a Virtual Machine on the same VNet, get into it via Bastion, and do the necessary developing/querying there.

I also want to do this all in Bicep, using one version-controlled project so that I can use CI/CD and also not lose my head looking for files since I'm working solo.

The plan is good and all, but because we're cost conscious, I'm using my Azure free account to develop a smaller version to test and break before working on the official pay-as-you-go company account. I'm using different data and my own laptop.
However, the Azure free restrictions are so intense that I had to wire up extra modules and infrastructure just to get things working. I needed to set up another VNet in a different region because that's the only place SQL server and SQL database were available, I had to set up peering, and ultimately scrapped working with the VM and Bastion at all in dev because there were no available VM SKUs. On top of that, since I want to develop with DACPAC's and a sqlproj in my version controlled project, I have to use a mock database. ATP, my project doesn't even look like the structure of what I want prod to be anymore.

I feel like I'm literally chipping away at a different problem and not working on my actual project assigned to me. I don't even know how my dev and prod branches will look in practice with so intensely discordant environments. But I need to prioritize security, costs, and keeping things neat and organized for myself. I need a second opinion on this because it doesn't feel right.

I ran the following azcopy sync command. It supposedly completed in 10 seconds, but there's no feedback. Nothing's returned.

Am I supposed to see the results somewhere else?

Here's the screenshot.

https://preview.redd.it/mwdsypx7c52h1.png?width=1279&format=png&auto=webp&s=634dea08d8150a8ae7e8fa028ff207f3c6a5737a

What things in cloud services make you guys just be like do I really need this ?! Im asking for educational purposes

We always had this issue of not knowing if our environment was reflecting "What good looks like". We come from the on-prem world, so we did have general knowledge of security practices, but we did lack proper architectual knowledge when it came to Azure.

Besides us lacking we also have different teams spinning up new ressources in their environment and it was hard for us to keep track of potential misconfigurations.

We started using a tool called Anubion and it just helped with the insight and advise we needed to start setting up our environment towards best practice.

We were in the beta so I assume the tool is relatively new and just wanted to highlight something that helped our case

Long story short: I downloaded the contents (i.e. files) of container "images" from Azure Account 1 and then uploaded all of it to container "gasolina" from Azure Account 2. Unfortunately, my internet connection is slow and spotty, and I want to make sure everything was uploaded correctly.

Using the Azure portal, can I check to see if these two containers have the same size? I would prefer this than using any command-line tools or Azure Storage Explorer (which currently isn't working for this new account).

https://preview.redd.it/7n57wqfbp42h1.png?width=1012&format=png&auto=webp&s=369ade1fe6787e3c9d93542aedd936771a2dc87d