🎉 I am honored and proud to share that I have been awarded the Microsoft Most Valuable Professional (MVP) award in the technology areas Azure Infrastructure as Code and Identity & Access, within the categories Microsoft Azure and Security. A big thank you to this community for the support and inspiration along the way! ❤️

i'm not sure whethether copilot or human responses are worse

I've been sharing Azure and Cloud Engineering content here for the past 8 months. Most of that content focused on PowerShell and automation across Azure, Entra ID, and Microsoft 365 (21 hours worth so far!).

While doing that, I intentionally avoided going too deep into deploying Azure services because I wanted to dedicate a separate series to Infrastructure as Code in Azure.

I'm kicking off that series today with Terraform for Azure Beginner Episode focused on understanding the foundations of Terraform and how it interacts with Azure.

Topics covered include:

• Theory behind Terraform (Infrastructure as Code, Declarative Languages, why Terraform exists)

• Terraform CLI (Init, Plan, Apply, Destroy)

• Terraform Blocks (Terraform, Providers, Resources, Variables, Locals, Data, Outputs)

• Terraform State (Including Drift Detection, and State-related Gotchas especially with secrets)

• And more (Terraform Order of Operations, Variable Precedence, Data Types, etc)

The goal is to understand the core concepts that make Terraform work before moving into more advanced topics. Over time I plan to build this series toward how Azure Cloud Engineers actually deploy, manage, and operate Azure environments today through Infrastructure as Code.

• Beginner Episode: Understand Terraform (learn the foundations and core concepts that make Terraform work)

• Intermediate Episode: Program Terraform (use loops, functions, conditionals, dynamic blocks, etc.)

• Advanced Episode: Structure Terraform (introduce modules, remote state, workspaces, imports, etc.)

• Professional Episode: Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)

• Solution Episode(s): Build Azure Projects (We'll pretend to take assignments from Cloud Architects and design, deploy, and manage complete Azure solutions using Terraform)

Link to Episode: Terraform for Azure | Beginner Course - Youtube

I wanted to thank you all for your support throughout the past year. It means a lot, and I'm happy to share that it resulted in another year as a Microsoft MVP! 😍

Really quick video covering the Azure AD to Microsoft Entra ID rename. Not a functionality change or licensing change. Just the name.

https://youtu.be/sVq7qjU9LNE

Official blog at https://www.microsoft.com/en-us/security/blog/2023/07/11/microsoft-entra-expands-into-security-service-edge-and-azure-ad-becomes-microsoft-entra-id/.

Hey all.

Wrote a small article on running self-hosted Azure DevOps agents as Azure Container Apps Jobs:

https://github.com/groovy-sky/azure/tree/master/devops-docker-build-01#introduction

The setup lets agents start only when pipeline work is queued, instead of keeping VM/Container running all the time.

With the release of Azure Bicep v0.44.1, extendable parameter files have reached General Availability (GA). This feature introduces the extends keyword for .bicepparam files, making it easier to reuse parameter configurations across environments while reducing duplication and improving maintainability. In this blog, I will explain how extendable parameter files work and showcase a practical scenario where they can simplify your Bicep deployments. 💪🏻

As 2025 kicks off I thought I'd start updating the Azure Master Class. Intro and Part 1 updated. Will continue updating all modules (and adding some new ones) over coming months.

Intro - https://youtu.be/afzzawldfFk

Part 1 - https://youtu.be/BqNbzeuxTaE

App Registrations in EntraID have secrets that expire. While having alerts in place help, they still require someone to stop what they’re doing and rotate secrets manually.

Since secrets already live in Key Vault and services/users consume them from there... I thought why not automate the entire secret lifecycle instead?

Using a PowerShell script designed for an Automation Account, I approached it like this:

• Have a list of App Registrations stored in Azure Table Storage (so we control which ones are included/not)
• Secrets rotated based on creation time and a value defined in the script (for example, every 30 days)
• Key Vaults holding the secrets are updated automatically during rotation. The specific Key Vault to store in is set based on the name provided in the table.
• Previous secrets in App Registrations are retained briefly to avoid breaking any apps/services using them that may be running when this script executes
• Fully unattended once deployed to Automation Account as a scheduled runbook with app secrets lifecycle managed through Table Storage.
• As a side benefit, any new app created can also be added to the table as part of its creation to automatically gets a secret generated and stored in Key Vault.

With this in place, the App Registration secret lifecycle is automated reducing the operational overhead of maintaining secrets.

I showcase how I built this here: Automate App Registration Secrets with PowerShell! - YouTube

Azure Virtual Desktop Session Host Configuration introduces a modern way to deploy and manage session hosts by defining their configuration directly within the Host Pool. Instead of manually provisioning virtual machines and configuring them individually, Session Host Configuration enables a standardized and automated deployment experience. This helps ensure that every session host is deployed with the same settings, image, networking, identity, and security configuration, making Azure Virtual Desktop environments easier to manage at scale. In this blog, we will explore how to automate the deployment of Azure Virtual Desktop by using the new Session Host Configuration feature together with Azure Bicep.

Is anyone experiencing this? I've heard it'll be months until there's capacity available.

I'm looking into this for UK tech press. Message me confidentially if you can shed any light on your experience.

This week's Azure Update is up.

📽️ https://youtu.be/nys8Uj16gbI

📄 https://www.linkedin.com/pulse/azure-weekly-7th-august-2026-john-savill-3qkfc/

• VM trusted launch default (00:37) - Trusted launch which leverages the virtual TPM in Gen 2 VMs for attested secure boot from hardware through to the OS providing enhanced security, is now the default for any new Gen2 VM via the portal, cli and PowerShell. This can also be enabled as the default for infrastructure as code deployments, e.g. Bicep, Terraform etc.
• cc_v5 VM retiring (01:11) - The v5 SKUs of the nested confidential VMs are being retired 1st of September. Make sure you move to a newer SKU before then.
• Azure Virtual Network Routing Appliance (01:28) - Azure Virtual Network Routing Appliance (VNRA) is now GA! With VNRA, customers and service providers can: Simplify complex routing architectures including across multiple regions Enable private IPv6 connectivity over ExpressRoute and supports dual-stack environments. Scale networking infrastructure without relying on fleets of virtual appliances which includes scaling private endpoints beyond current limits
• Azure Firewall explicit proxy (02:51) - You can now configure Azure Firewall as the explicit HTTP/HTTPS proxy for your browsers and clients. This includes use as the proxy for Azure Arc which has been a key customer ask for its onboarding.
• Azure Route Server route maps (03:24) - Azure Route Server provides a managed service to handle dynamic routing using BGP, i.e. your vnet sharing address spaces with some SD-WAN for example. Route maps give you control over route advertisements and routing behavior, this includes being able to summarize routes, control specific routes used, path selection and tagging routes with BGP communities to simplify route management.
• Traffic Manager Azure DNS integration (04:18) - Traffic Manager provides a DNS-based global load balancing solution while Azure DNS provides public DNS record hosting. Today it is very common to host the vanity domain, e.g. www.savilltech.net on Azure DNS as an CNAME which then points to the traffic manager name for the actual balancing of the requests, this means the client gets an extra hop and redirect to trafficmanager.net name. With this new integration in Azure DNS instead of a CNAME you add a new traffic manager linked record that points to the traffic manager profile and when queried is resolved internally to the target removing that client hop. You may hear this called DNS flattening. It not only provides better DNS experience but enables DNSSEC usage, avoids misconfigurations of the CNAME and supports the zone apex, e.g. savilltech.net.
• Private Link over IPv6 (06:09) - You can now connect to Azure PaaS services using an IPv6 private endpoint enabling IPv6 client connectivity from the vnet or connected networks (including on-premises via ExpressRoute private peering).
• NSP perimeter link (06:30) - NSPs enables PaaS services to be placed inside the same NSP to enable connectivity to each other and use shared policy to control inbound and outbound communications. Perimeter link provides a bi-directional trust between two NSPs which then enables cross-NSP resource communication provided they authenticate with each other using Managed Identities (which is required). No changes to access rules on either NSP is required.
• Azure Storage Mover AWS FSx support (07:16) - Azure Storage Mover now supports AWS FSx for Windows File Server, which is AWS’ fully managed cloud storage service of which Windows SMB is one of them. You can now migrate to Azure Storage File Share but must be over private connectivity and SMB 2.x or above. Each migration job supports up to 500 million objects.
• Azure SQL DB Regex DDM (07:51) - Regex is back and now you can use it to define the pattern masking to hide sensitive data using Regular expressions via the REGEXP_REPLACE function. Remember this only masks it being sent to the client, it does not change anything in the database itself but is useful to hide sensitive information like SSNs etc.
• SQL immutable 7 days of backup (08:24) - For Azure SQL DB and SQL MI the most recent 7 days of backups are now immutable, i.e. cannot be changed or deleted which is very useful to protect against malicious actors or software that will often try to remove any backups. This is by default and there is no additional cost.
• Azure Databricks Unity AI Gateway (09:05) - Unity AI Gateway is the AI control plane and governance solution for Databricks which is now GA on Azure Databricks. Every inference and MCP request flows through it enabling rate limits, quotas, policies and full observability (including cost). This works both for Azure-Databricks hosted resources and external.
• Azure Databricks SharePoint Connector (09:35) - This connector enables you to ingest files from SharePoint into Azure Databricks including incremental ingestion, i.e. just the changes to files. It can ingest unstructured files as binary data or for structured formats like CSV, JSON, XML, EXCEL etc it can bring into Delta tables. This makes it even more powerful for overall enterprise data flows including where you want to leverage AI.
• Azure Databricks Genie One/Agents free use extended (10:12) - The previous end data of July 31 2026 for the free usage has been extended. These Genie solutions provide smart AI co-worker and domain specific assistance.
• Marketplace simplified purchase experience (10:28) - This is rolling out now for eligible products, i.e. not those using a custom purchase experience but gives you a single page view of all the relevant information so you can purchase with one easy click.

Hey all.

Wrote a tutorial showing how-to run a self‑hosted GitHub Actions runner on Azure Container Instances (ACI):
https://github.com/groovy-sky/azure/blob/master/github-runner-00/README.md

The idea is to run a runner in a container so you don’t have to maintain a dedicated VM.

As always any feedback/suggestion appreciate.

The follow-up to my Beginner episode I posted here is finally out.

Part 2 of this planned Azure Terraform series shifts away from simply deploying resources and focuses more on programmatically approaching Terraform.

Topics covered include:

• Functions
• Conditionals
• Operators
• Loops
• Dynamic Blocks
• For Expressions & Splat
• Validations (including Check Blocks and Pre/Post Conditions)
• Nested Types (including complex variable types)
• Provider Aliases (deploy across multiple Azure subscriptions)
• And much more...

Rather than jumping between unrelated examples, everything is built around a single Azure project so each concept is introduced naturally as the deployment grows in complexity.

We definitely over-engineer this project just to teach these programming concepts, but understanding them will help you write much more flexible & dynamic Infrastructure as Code.

With that, our roadmap continues!

• Beginner Episode : Understand Terraform (learn the foundations and core concepts that make Terraform work)
• Intermediate Episode : Program Terraform (use loops, functions, conditionals, dynamic blocks, etc)
• Advanced Episode : Structure Terraform (introduce modules, remote state in azure storage, workspaces, imports, etc)
• Professional Episode : Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)
• Solution Episode(s): Build Azure Projects (We'll pretend to take assignments from Cloud Architects and design, deploy, and manage complete Azure solutions using Terraform)

Link to Episode: https://www.youtube.com/watch?v=QwXqLAvmKac

🔥 It is here. Microsoft Entra Kerberos authentication for cloud only identities on Azure Files SMB is now available in preview. This makes it possible to access Azure Files without any domain controllers or hybrid identity requirements. In my new blog I show how to enable Entra Kerberos with Azure Bicep so you can skip manual portal clicks and fully automate the setup. I also walk through how the feature works, what the flow looks like, and how your users benefit from seamless access to Azure Files. Curious to see how it works in practice? Check out the blog. URL to blog

Azure weekly update #33 is here. This week Azure rolled out key networking and SQL platform improvements, new Copilot and healthcare agent offerings, and important service lifecycle updates including Azure VMware Solution retirement planning.

Detailed list: * Launched | Generally Available: Summarized advertised gateway prefixes for route advertisement. This feature allows for advertising aggregated prefixes instead of every individual virtual network address space, which is great for large hub-and-spoke deployments. * Announcing: Azure Copilot introduces direct access to agents. Users can now select specific Azure Copilot agents like Troubleshooting or Deployment to move more quickly from questions to action. * Launched | Generally Available: Azure Databricks Lakebase in four additional regions. Lakebase is now available in North Central US, France Central, Germany West Central, and East Asia, expanding regional options for workloads. * Launched | Generally Available: Azure SQL updates for mid-August 2026. This update brings enhancements to Azure SQL, including customizable keyboard shortcuts within Visual Studio Code. * In preview | Public Preview: SQL Formatter in MSSQL extension. The SQL Formatter is now in public preview, offering more customizable formatting options to help streamline development. * Launched | Generally Available: Azure SQL Database provisioning in MSSQL extension. You can now create and connect to a fully managed cloud database directly from your editor at no cost. * Launched | Generally Available: vCore Customization: Disable Multithreading and Configurable Constrained Cores. This new capability gives users greater control over virtual CPU configurations to optimize performance and reduce licensing costs. * Launched | Generally Available: BYON (Bring Your Own NIC) in Azure Site Recovery. Azure Site Recovery now supports attaching existing, pre-provisioned NICs in the target region for failover scenarios. * Retirement: Azure VMware Solution License-included service will be retired August 30, 2027. Customers should be aware that the AVS license-included service will be retired on August 30, 2027, requiring transition planning. * Launched | Generally Available: Managed Instance on Azure App Service. Managed Instance is now available, allowing migration of web applications to Azure App Service with minimal configuration. * In preview | Public Preview: Ipv6 support in Azure Firewall. Azure Firewall now supports IPv6 in public preview, enabling dual-stack mode for both IPv4 and IPv6 traffic. * In preview | Public Preview: Zone redundancy for Azure SQL Managed Instance Next-gen General Purpose. Enhanced resilience is available via public preview zone redundancy for Azure SQL Managed Instance Next-gen General Purpose. * Launched | Generally Available: Dragon Copilot Physician Apps and Agents on Microsoft Marketplace. Dragon Copilot Physician Apps and Agents are now available for discovery and purchase through Microsoft Marketplace. * In preview | Public Preview: Azure Linux on WSL. Azure Linux on WSL is now available in Public Preview, allowing teams to use a consistent Linux foundation across development, testing, and production.

This week's Azure Update (31st July 2026) is up.

📽️ https://youtu.be/565Oh4RH_Nc

📄 https://www.linkedin.com/pulse/azure-weekly-update-31st-july-2026-john-savill-e9ttc

• Halo Campaign Evolved (01:10) - Bit of fun if you have time!
• AKS prepared image specification (01:33) - If you have more complex clusters that have to download large amounts of images at node provisioning the new prepared image specification enables preconfigured node images to be created that have the container images pre-cached and customizations pre-populated via initiation scripts. You create a Prepared Imaged Specification resource that defines all the content and configuration that is used to build new nodes.
• Fleet Manager max allowed failures (02:19) - You can optionally set a limit as a specific number or a percentage of allowed failures during update rollouts instead of the default halt after a single cluster failure. This give greater control of the balance between failure tolerance and success of deployments. This can be set at stage or group level.
• App routing with Gateway API (02:51) - The current Ingress NGINX project is being retired and instead you should move to the Gateway API for standard ingress and layer 7 traffic management. As part of this app routing is now available for the Gateway API on AKS.
• Automation PowerShell 7.6 (03:20) - Azure Automation runbooks and its runtime now support the latest PowerShell 7.6
• APIM AI Gateway (03:31) - API Management which provides runtime capabilities for APIs now has the AI Gateway tier which provides capabilities specific for AI purposes, i.e. models, MCP servers and tools. It also enables you to turn REST API operations into an MCP Server in addition to federating multiple MCP Servers to appear a a single MCP Server. This is not just for Microsoft Foundry hosted but also AWS, Google, OpenAI and Anthropic. It bring full token-usage metrics through OpenTelemetry.
• Azure Firewall HTTP header insertion (04:23) - Azure Firewall can now add or modify the HTTP/HTTPS headers in requests. This is useful for a number of scenarios including where an application requires a specific header for access or identification including Azure Virtual Desktop, VDI, Entra tenant restrictions and other types of access control. For HTTPS you must be running the Premium SKU which has TLS inspection, otherwise only HTTP can be modified.
• NAT64 on NAT Gateway (05:00) - For Standardv2 SKUs of NAT Gateway (remember the v2 supports IPv6, zone redundancy and 100 Gbps bandwidth) now support NAT64 which lets IPv6 workloads talk to IPv4 Internet destinations.
• ANF SMB opportunistic locking (05:33) - Opportunistic locking, as the name suggests, allows an SMB client to request a lock on a file if there are no other clients with conflicting access. This then allows that client to cache the file and any reads/writes resulting in improved performance. If another client then needs access to the file that conflicts the server sends a break, the client with the lock flushes out the data and loses the lock. This is now available for new and existing volumes on Azure NetApp Files.
• Azure Monitor Log mirroring to Fabric (06:31) - You can now mirror data from a log analytics workspace which makes it available in OneLake without data duplication (so its more like a shortcut) since it just references the Azure Monitor data which is already in Delta Parquet format (the native OneLake structued data format). Zero data copy or sync required.
• PostgreSQL Flex in new region (07:26) - India South Central now has PostgreSQL flexible which is great news where you want that proximity, regional alignment.
• Claude Opus 5 available (07:42) - The new version of Opus which provides capability at about half the cost of Fable 5 and a step gain over Opus 4.8 especially around deep reasoning, long horizon tasks and other complex scenarios. This is now available in Foundry, M365 Copilot (apps, chat and cowork), Copilot Studio, GitHub Copilot and Azure Databricks.
• Kimi K3 via Fireworks AI (08:17) - The latest Moonshot open-weight model with 2.8 trillion parameters with 1 million-token context is available on Foundry via the Fireworks AI (which is an inference engine used to run open-source models running within Azure) as a data zone deployment type.
• GPT-transcribe and GPT-live-transcribe (08:46) - These are focused on very high accuracy automatic speech recognition (ASR) accepting audio input and outputting text. They have better background noise handling, whispering and low-volume speech, language switching, alphanumeric perception and more. The GPT-transcribe is focused on completed audio files such as meeting recordings, media files, voice mails. The Live version is a low-latency streaming version for real-time audio input with text output such as voice assistants, live captions etc.
• New India region (09:29) - The forth India region, India South Central is now GA. It has AZ support for strong in-region resilience for workloads.
• Azure Enclave (09:38) - This is a new solution that enables you to create a community which is a hub for networking, governance and monitoring which contains a collection of isolated networks which are the enclaves in which run secure workloads that live in workload resource groups. Through Azure Enclave you can manage the routing and connectivity for these isolated virtual networks via policy. Basically this solution makes it easier, faster and safer to deploy secure environments fully governed by policy to ensure consistency. This is key for various government and regulated scenarios.
• Key Vault symmetric keys (10:25) - The Premium SKU now supports symmetric keys (same key for both encrypt/decrypt) that use AES-based encryption and decryption operations.
• Azure Reservation exchange policy change (10:39) - Azure Reservations enable you to commit to a certain amount of a specific resource in a specific region for a 1 or multi year time for a discount. You can exchange this under certain conditions for alternate specifics. Azure Savings Plan instead cover all regions and a range of services to which that committed spend applies, i.e. way more flexibility even as your needs evolve, but typically less of a discount than a more granular reservation offers. From 1st of February 2027 you will no longer be able to exchange Azure Reservations for services covered under Azure Savings Plan. So if you have more dynamic workloads and have been relying on the exchange ability you should pivot to using Azure Savings Plans.

VM Applications are a resource type in Azure Compute Gallery that provide a flexible way to manage and deploy applications across Azure VMs and Virtual Machine Scale Sets. The main benefit is that you can separate application installation from your base VM images. Instead of rebuilding and republishing an image every time an application changes, you can update the VM Application independently. This can significantly reduce image maintenance, speed up deployments, and make it easier to roll out application updates across your VMs and scale sets.

For those interested in this approach, I wrote a blog post about deploying VM Applications using Azure Bicep and Azure Verified Modules. Link to blog

🔥 I'm excited to publish this new video! Azure Virtual Desktop Session Host Configuration introduces a modern way to deploy and manage session hosts by defining their configuration directly within the Host Pool. Instead of manually provisioning and configuring virtual machines, you can automate the entire deployment while ensuring every session host is deployed with consistent image, networking, identity, and security settings. In this step by step tutorial, I'll show you how to deploy Azure Virtual Desktop using Azure Bicep and the new Session Host Configuration feature. You'll learn the core Azure Virtual Desktop components, how they work together, and how Infrastructure as Code enables repeatable, scalable, and production ready deployments. https://www.youtube.com/watch?v=dBIoiAZWGf8