Seeing more people use Copilot, Claude Code etc not just to write scripts but to actually run them against Entra and M365. Sometimes in a test tenant, sometimes not.

Reading the script yourself works when a human wrote it and runs it once. It feels different when an agent is generating and running stuff in a loop and you’re approving it half asleep.

So for anyone doing this, how are you scoping it? Separate app registration with minimal Graph permissions? Only ever a lab tenant? Read-only accounts? Or just not allowing it at all?

And has an agent ever tried to do something you didn’t ask for?

Disclosure, I’m a student building a side project in this area so I’m biased, but not linking anything. Genuinely want to know what people are doing in practice.

Moving our externally hosted website to another provider. DNS is hosted with Microsoft (M365). Hosting provider needs me to point www and @ to CNAME entry. Can only point the @ record for our domain to an IP address. Hosting provider only supports CNAME hostnames. Is there an easy way to set up a 301 redirect for our domain to point to a hostname? Saw references to Azure Application Gateway or Azure Front Door, but wasn't sure if those would be adequate or if I'm missing something else.

EDIT: It appears there is Azure DNS as well which may provide aliases. I may look into that.

Is any body facing the same issue azure sql west europe region is failing connections intermittenly and lost all our tables no listing of tables is available, on SMSS

the failover region read only is fine i can view data and tables

setup as a failover group

Hi all,

I’ve seen very mixed opinions on Entra External ID (EEID) here. The common complaints seem to be:

• Poor documentation
• Heavy reliance on click-ops
• Problems with password reset emails
• Weak SSO integrations
• A general sense that the product is still immature

My team is considering moving from B2C to EEID for two main reasons:

1. Less MFA friction. Our users are tired of waiting on email OTPs and I assume the friction is much the same entering codes from auth apps. We’d love to use passkeys or biometrics wherever possible. We also wanted a “remember this device” feature, but since B2C doesn’t manage devices, I expect most of that would have to live in our own API.
2. App-level role assignments. We’ve had authorization bugs in our app around role-based actions, so we’d like the identity provider to own role assignment instead.

Given B2C’s end-of-sale, this also seems like a good time to modernize.

For context, this is a relatively small healthcare application, and we don’t need SSO with other organizations’ IdPs.

My questions:

• Is EEID mature enough for a use case like ours?
• How well do passkeys actually work in EEID in practice?
• Has anyone used EEID app roles in production? Any gotchas?

I’m fairly new to cloud administration, so apologies if anything here is off. I’d appreciate any experiences or opinions.

Microsoft gave us free credits to build our startup. Then it billed us ₹16 LAKH for an AI model we’ve never touched. Imagine what they’d charge if they actually disliked us.

We got into Microsoft for Startups and received $5,000 (~₹4.2 lakh) in Azure credits. We felt like winners. Turns out it was the free trial of a very long prank.

Read more: https://www.linkedin.com/feed/update/urn:li:activity:7521156141238816768/

On our server 1/2 elastic pools is not working at all. Databases show no tables. Cannot do anything with the elastic pool. Restart, Update. Cannot remove databases from pool.

Hi

It possible to make it where certain users only use yubikeys and not Microsoft authenticator at all?

I'm currently migrating ~100 VMs from a VMware datacentre across to Azure, I've ran into an issue with a few servers which I'm hoping someone as encountered and solved previously.

I do not have access to the VMware environment, this is controlled by another 3rd party. I have access to a Migrate discovery in which I can get the SCSI info and which disk the OS resides on.

My problem is

• I have to use Azure Migrate agent based migration due to the VMware platform being shared by multiple of the other MSP's customers so I'm unable to have hypervisor level access.
• There are multiple servers which have 4+ disks of the same exact size, one of which is the OS disk, via the GUI there is no way to differentiate these disks.

I have found example Microsoft scripts for this but no scripts allow me to be granular with which disk type, SKU, IOPS I set per disk which is a requirement.

Have I missed something obvious, or is my only solution to write something in PowerShell myself?

I need AI credits for rent, such as Azure GPT. Can anyone provide them?

Hey everyone,

I’m currently running into a frustrating wall trying to pipe Tencent Cloud Audit logs over to an Azure Log Analytics Workspace for Microsoft Sentinel.

I’ve followed Tencent’s official documentation (Delivering Azure Logs) step-by-step, but the logs simply refuse to show up in the workspace. Wondering if anyone here has successfully built this integration and can point out what I might be missing.

What has been configured so far:

1. Source Log Topic: Set up a dedicated CLS log topic capturing Tencent CloudAudit logs.
2. Azure Shipping Task: Created the shipping task under Data Shipping & Consumption > Ship to Azure Log in the Tencent CLS console.
3. Monitoring Metrics Publisher assigned on the Data Collection Rule (DCR).
4. Log Analytics Reader assigned to the Resource Group.
5. Field Mappings & Pre-filtering: Configured the required custom mappings and verified the JSON payload structure using the shipping log preview.

Has anyone dealt with Tencent-to-Azure log forwarding recently? Are there hidden gotchas with permissions or Any tips ?

Hi everyone,

I'm working on a notification system that sends interactive Adaptive Cards to Microsoft Teams 1:1 chats using the Microsoft Graph API. I've got the authentication and message delivery working, but I'm stuck on handling button clicks.

What I have working

- I'm authenticating using username/password credentials and obtaining a delegated Microsoft Graph access token.

- Using that token, I'm able to create a 1:1 Teams chat and send an Adaptive Card to it.

- The card renders correctly in Teams.

- The message is sent through Microsoft Graph using a normal user account, not a Teams bot.

What I want to achieve

My Adaptive Card contains actions such as:

- Approve

- Reject

- Trigger an external API

When a user clicks one of these buttons, I want to make a POST request to my backend API immediately, ideally in the background, without opening a browser, webview, or another page.

What I've discovered so far

- "Action.OpenUrl" works, but it opens a URL. I could use this to redirect users to a confirmation page that triggers my backend, but I want to avoid this extra step.

- "Action.Submit" and "Action.Execute" don't appear to work for my scenario because the card was sent through Graph API by a user account rather than a bot. There is no bot endpoint to receive the interaction.

- Adaptive Cards don't appear to provide a standard "Action.Http" mechanism that lets a card sent through Teams invoke an arbitrary REST API directly.

From what I've read, the supported approach for handling these interactions seems to require a Teams bot.

My questions

1. Is there any supported way to trigger a backend REST API directly from an Adaptive Card button click without registering a Teams bot?

2. Is there any alternative mechanism in Microsoft Teams, Microsoft Graph, or Adaptive Cards that allows a silent/background API call from a card sent by a normal user account?

3. Has anyone implemented a similar approval workflow without a bot, while keeping the interaction entirely inside Teams?

4. If a bot is unavoidable, is there a lightweight approach that can handle only card interactions while leaving message delivery and the existing Graph API integration unchanged?

I'm specifically looking for a solution that doesn't open an external page when the user clicks Approve or Reject.

Any technical insights, documented alternatives, or real-world implementation examples would be greatly appreciated.

Thanks!

Genuine question for people doing Entra / M365 security work.

When you find a script online, say something to pull inactive users or check app permissions, what do you actually do before running it? Read every line? Try it in a test tenant first? Only trust known authors? Or just run it and hope for the best?

I keep running into this. Half these scripts start with Connect-MgGraph asking for a pile of scopes and I can’t always tell if they really need all of them, or what they’ll do with them once they have them.

Has a script ever done something you didn’t expect? And does your team have any actual rule about this, or is it on whoever’s running it?

Full disclosure, I’m working on a side project around this, but not linking anything. Mostly trying to figure out if this is a real pain or just me being paranoid.

I am so freaking tired of dealing with Azure bullshit. Why this cloud just CANNOT work like it is supposed to? It is unreal. To give you some example.

For the past month we've been debugging a case, where applications running on AKS (Linux-based VMs) have connectivity issue. The conclusion was: it is (of course) fucking Azure. Literally a bunch of VMs from the same zone, at the same time becomes unresponsive (most likely running on the same rack/host). Inbefore "but muh Azure has Freeze events" - no, our instances haven't received a single event of this type.

Kumar and Krishna from support weren't useful (anyone surprised?). We decided to change VM series (from Dasv6 to Dsv7).. and magically all freezes dropped to 0. Check attached image.

The only problem is that Dsv7 costs 50% more than Dasv6. What a joke.

Hi all, I've been using Logic Apps in my job for some time. A while back I saw the banner about using the newer version, however when I did it broke my flows visually so I reverted back to the old experience. I see now the banner says support will be removed from legacy so realisticly I need to go to the newer experience. I'm concerned that if I do the flows will still be glitchy and maybe not work and I won't be able to revert back to legacy. I don't have the capacity to go through each flow and fix them before it would become an issue. I don't know if the flows are actually broken when the visual flow chart view is glitchy, I would prefer not to take a chance.

So I guess my questions are:

Has anyone converted recently, if so what was your experience?

Does anyone know if I can go back to legacy if needed?

If the flow has a visual glitch will it still work properly?

As the title says, my computer got hacked. As soon as I found out, the computer has been isolated and wiped, that part has been taken care of already.

Last friday, someone from russia (got this from the firewall log) was able to connect to my computer despite having region blocking enabled. For some obscure reason, my computer had not automatically logged me out that day like it usually does after 5 mins of inactivity. Now, I happen to have a camera on the ceiling behind my desk which has full view of my monitors.

At 2AM sharp, I can see my cursor start to move and chrome open. They opened gmail (was already logged in) and scrolled thru my emails. I exclusively use my gmail for garbage and subscriptions, they found nothing but ads and newsletters. They then opened a second tab and opened the Microsoft Azure login page. They then tried to log in using my gmail address, unsuccessfully, as there is no Azure account tied to it. And that was it, they left my computer alone. This took place over the course of about 2 minutes. I don't even use Azure...

I had saved credit cards and a bunch of business files on this computer which they had seemingly no interest into... So now I am wondering what were they after? Azure is a cloud computing plateforme, as far as I am aware? What were they hoping to find? Thanks!

I've been tasked to move the entire AD domain over to the new syncing tool from Microsoft. The way it's currently setup we use on-prem AD to create and manage the accounts which gets sync'd to Azure. We don't have anyone using on-prem AD to authenticate against as they always use Azure for that. None of their computers are hybrid joined as it's all Azure joined.

Any gotchas I should be aware of? Seems the Connect Sync is doing a full sync of the AD domain. From what I understand I can add the cloudNoFlow and JoinNoFlow to prevent Connect Sync from exporting objects adds, object deletions, and non-reference attribute updates.

How well does the automatic migration tool work or should I just try doing this manually? I am aware of the 150K objects limit.

We're rolling out MFA to about 800 users across multiple sites. We have a CA policy that requires MFA when users are offsite, but not when they're onsite. That part works fine.

The issue I'm running into is getting everyone registered before we enforce the policy. I want users to be forced to set up Authenticator while they're onsite, but not have to use MFA every time they sign in onsite.

I've tried the Authenticator registration campaign and the Identity Protection MFA registration policy, but neither seems to prompt users to register while onsite.

I know we could just enable the CA policy and let users register whenever they eventually sign in offsite, but I don't really like that approach. Some users may never sign in offsite, so they could go months without registering. My bigger concern is that if one of those accounts gets compromised before the user registers, an attacker could potentially register their own MFA method.

I could temporarily enforce MFA for everyone to get them registered, but that seems like a stupid workaround for something that should be pretty simple, especially with 800 users.

Am I missing something here? How are you guys handling this?

I graduated from Computer Engineering this year and am yet to get a job. I want to get into DevOps/Admin roles and know linux, containers, vms etc.

I'm thinking of getting certs for one of the major cloud platforms in order to get job opportunities, and am confused as to which one to pick and learn.

AWS:

I used up my free trial for AWS while in college for coursework and didn't rewlly learn much. Add to that, AWS cert costs are higher, and I'd have to pay to learn it too.

Azure:

I think I can get the 12 month free tier for this via the Github Student Developer Pack, which has not ended yet. Same thing can be used for 50% discount on AZ-900 cert which is already cheaper in India. Also, renewals are free.

GCP:

I honestly have no idea about this one, it has a higher cost for certification, and also has high costs for renewals. And I'm not clear on how long the free tier for this one will last as it's $300 free credits for 6 months or something.

I'm leaning towards Azure for the reasons mentioned above, but have heard that AWS is more popular and support is leagues ahead of Azure.

I want to know your opinions on what would be better based on your experiences with either, and your own career. I was thinking of going for learning azure with the free tier, and AZ-900 and AZ-104 certs, while learning AWS from videos and free resources online while trying them out in a local emulated environment like localstack, ministack or floci, to be able to put AWS on the resume and later get AWS certs from an employer or own salary if needed.

Also, while I'm at it, could you share your opinions on Zoho Catalyst? I just came across it recently and it has a seemingly good free tier, but doesn't seem as popular.

This has been going on since Friday but they finally just updated the Service Health dashboard - Region East US 2

Hi everyone i'm trying to understand something about DLP mostly for Sharepoint and Onedrive

I made a policy for audit that checks Exchange, Teams, Onedrive and Sharepoint, then i have some rules that check for stuff sent outside our tenant and some inside

The issue i'm having is

1) It seems that each time someone uploads something to a sharepoint that has sensitive information it triggers the DLP rule, i though it was only for sharing? (ye i know Sharepoint is a share site so i'm guessing uploading a file is auto considered a sharing action?)

2) Onedrive we are getting hit from users that are disabled for like 3 months ago and their onedrive are disabled, it says the document was shared, but i cannot find to who, when i go to audit no one tries to access his Onedrive, user is disabled without a licence and when we try to get more info it says the onedrive is archived

Thanks

🔥What if you could build a custom Azure Bicep extension that provides day zero support for Microsoft Graph APIs, allowing you to use newly released Graph capabilities directly from Bicep? In this blog I will show how to deploy Microsoft Teams, Conditional Access Policies and Administrative Units using Bicep!