Hi All,

Just a quick observation, it looks like last night a pair of Azure Policies were added to the Tenant Root Group of my tenant. I checked a few other tenants, some have them and some don't. Based on the names and descriptions, I assume this is Microsoft preparing for some upcoming changes, and is rolling this out.

Policy 1:

Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Write Actions
Policy: Multi Factor Authentication Enforcement - Write
Type: SystemHidden
Name: sys.mfa-delete
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure

Policy 2:

Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Delete Actions
Policy: Multi Factor Authentication Enforcement - Delete
Type: SystemHidden
Name: sys.mfa-write
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure

The policies are not visible in the azure portal, they are hidden, but you can see them with an ARG query from Graph Explorer:

PolicyResources
| where type =~ 'microsoft.authorization/policyassignments'
| extend assignmentScope = tostring(properties.scope)
| where assignmentScope =~ strcat('/providers/Microsoft.Management/managementGroups/', tenantId)
| extend displayName = tostring(properties.displayName)
| extend description = tostring(properties.description)
| extend policyDefinitionId = tostring(properties.policyDefinitionId)
| extend enforcementMode = tostring(properties.enforcementMode)
| extend parameters = properties.parameters
| extend nonComplianceMessages = properties.nonComplianceMessages
| extend notScopes = properties.notScopes
| extend createdBy = tostring(properties.metadata.createdBy)
| extend createdOn = tostring(properties.metadata.createdOn)
| extend updatedBy = tostring(properties.metadata.updatedBy)
| extend updatedOn = tostring(properties.metadata.updatedOn)
| extend assignedBy = tostring(properties.metadata.assignedBy)
| project id, name, type, location, subscriptionId, tenantId,
          assignmentScope, displayName, description, policyDefinitionId,
          enforcementMode, parameters, nonComplianceMessages, notScopes,
          identity, createdBy, createdOn, updatedBy, updatedOn, assignedBy
| order by id asc

There's an equivalent activity log entry for each from the principle:

Microsoft Authorization System Policy

d2381cb8-26aa-404d-9218-550726c79b07

Just curious if anyone else noticed this or got these polices. I have alerts setup for when any policy changes occur in my environment, and got an email last night on it. Thought it was interesting, so decided to make a post about it.

Hi all.

Anyone tried Azure Monitor’s OpenTelemetry preview? Trying to understand is it worth to learn more about it.

Any opinion/suggestion/feedback are welcome.

The follow-up to the Terraform series I’ve been posting here is finally out.

Link to Episode : https://www.youtube.com/watch?v=Ui5ozyOkIeY

This time, rather than focusing Terraform, I wanted to build out an actual Azure project and show all the pieces that go into bringing one to life.

From the development side, we look at the application architecture, some of the design decisions, containers, and how that work gets handed off to operations. (No Dev Experience required & If you are new to containers, I will explain them in details)

From the operations side, we design the architecture in Azure for it's infrastructure. Think through networking, identity, security, persistence data, etc.... using Terraform to build the platform from the image above.

My goal with this episode to give a real taste of what it’s like to work on projects like this in the real world, from the perspective of developers, operations, and architects where I explain the reasoning behind everything involved with infographs to make it as clear as possible at every stage.

With that, our roadmap continues!

• Beginner Episode : Understand Terraform (learn the foundations and core concepts that make Terraform work)
• Intermediate Episode : Program Terraform (use loops, functions, conditionals, dynamic blocks, etc)
• Advanced Episode : Structure Terraform (introduce modules, remote state in azure storage, workspaces, imports, etc.)
• Project Episode : Build Azure Project (Less about Terraform itself & more about building interesting architectures in Azure)
• Professional Episode : Operationalize Terraform (use GitHub, CI/CD, pull requests, state management, and deployment workflows to work in a team environment)

Link to Episode : https://www.youtube.com/watch?v=Ui5ozyOkIeY

Hello,

In our current environment we are starting new to Azure. We are planning to build few VMs for our infrastructure starting with Domain Controllers and we want to host our website using Azure apps. The website is static. We are medium sized organization will remain hybrid for now. Should we create different management group for the Domains and web app? or different resource group is enough for security? Is App service good for the website? let me know if am missing any information. I am new to azure so i might not be planning properly.

have anyone tried proactive spinning of replicas before traffic hits ? if yes, can you say how useful it is and how did you set it

I have a quick question on data zone deployments using AI Foundry vs Open AI deployments.

With Open AI deployments, the endpoint and subsequent model deployments are tied to selected region, e.g. Sweden Central. Point is, I select the region, along with associated quota, etc.

When I deploy an endpoint using Foundry, I select the region where the project is hosted, but when deploying a model into the data zone, I cannot tell where that model actually runs. Now, when I look at the deployment notes, it does say that it can run and process anywhere withing the data zone. Fair enough.

So my question then:

1. Does the data zone inherit the region where my project is deployed, e.g. the model runs in any regions that is part of the Sweden Central data zone?, and;

2. Does this imply that there is a degree of high-availability with this deployment, where if an entire region goes dark that requests will be processed in another data zone region without me having to manually update any applications on my side, unlike what I am having to do under the Open AI deployments?

Hey everyone,

I've been working for years in the Microsoft Bizz Apps space (Dynamics 365, CRM/ERP, Power Platform, integrations, etc), mostly as a senior solution architect...

Lately I've been feeling that more and more stuff is moving towards Azure and cloud-native development, so I'm thinking about shifting my career more in that direction,

curious to hear from people working in Azure consulting or cloud development, what are you actually using in real projects these days?

A few things I'm wondering about:

• Development: .NET, TypeScript, Azure Functions, Container Apps, AKS? Is full-stack cloud development the way to go?
• AI: Azure OpenAI, AI Foundry, RAG, agents? How much of this is actually being used in production?
• Architecture: Microservices, event-driven systems, APIs, messaging?
• DevOps: Docker, Terraform, Bicep, Kubernetes, CI/CD?
• Demand: What technologies are clients asking for the most lately?

Coming from a senior Biz App architecture background, I'm not really looking to start from scratch, but rather figure out where to focus next

If you were making this transition today, what would you prioritize learning?

Would love to hear what people are actually working with, not just what's being hyped by Microsoft :)

Just wanted to check if i can post articles links here or not