CloudRunbook | Practical Cloud Engineering
Collected notes from running Azure platforms in anger: landing zones, identity guardrails, networking, and the Azure changes that genuinely warrant a brew and a chat.
Exchange Online EWS retirement: what Microsoft's sources say about dates, how to find EWS users in the usage report, and how to allow-list apps.
Sorted newest first. Use tags above for a curated feed.
How the Defender for Cloud secure score is calculated, what to fix first, and how exemptions can flatter the number. A runbook from Microsoft Learn.
Entra SMS voice retirement dates, who is in scope, and how to choose a telephony provider or move users to passkeys before the cut-off.
Learn gives 31 March 2027 for the Sentinel Defender portal move. What changes for roles, automation and workspaces, and a runbook to onboard safely.
An Azure Policy baseline built on Microsoft Learn guidance: audit first, stage rollout, handle exemptions and remediation, then move to enforcement.
A baseline for Entra app consent: user consent, admin workflow, credential expiry, app management policies and owners, with portal paths and roles.
Entra passkeys on Windows: what MC1282568 says, where Learn disagrees on AAGUIDs, and a runbook to pilot, check and roll back.
How to pick Sentinel analytics rules to enable first: content hub templates, data source checks, false-positive tuning and the Defender portal.
Learn lists 10 November 2026 as the expected end of support for PowerShell 7.4, .NET 8, .NET 9 and in-process Functions. Who is affected and how to move.
A baseline for Entra break-glass accounts: two cloud-only Global Administrators, phishing-resistant MFA, Conditional Access exclusions, alerts, 90-day test.
A Sentinel cost control runbook: pick the right tier, set a commitment, filter at ingestion and monitor spend, with the Defender portal move in mind.
A sourced Conditional Access baseline for Entra: emergency access, legacy authentication, MFA, admin protection and a report-only rollout that avoids lockouts.
MC1325414 says Entra SSPR will stop accepting some directory attributes. What it says, where Microsoft's dates disagree, and how to check registration coverage.
How to run Privileged Identity Management day to day: licensing, eligible assignments, role settings, approvals, alerts, audit and lockout traps.
From 4 November 2026 default Entra users can create agent blueprints unless you turn it off. What changes, who should keep the ability, and how to restrict it.
A self-hosted Azure pipeline that ships SailPoint Identity Security Cloud audit events into Microsoft Sentinel, and the design choices that keep it Tier 0.
The customer-initiated window to move VPN Gateway off Basic public IPs has closed. How to check your gateways have moved, handle a pending one, and validate.
A practical Defender for Cloud baseline for Azure landing zones: plan coverage decisions, agent strategy, and closing the loop with policy-backed guardrails.
A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.
A runbook-style secure networking baseline for Azure: hub-spoke or vWAN, DNS ownership, private endpoints, egress control and inbound protection.
A hands-on walkthrough of Azure Landing Zones (ALZ): what they are, why they matter, and a runbook-style path to deploying a secure platform foundation.
A practical identity baseline for Azure landing zones: admin separation, PIM, Conditional Access, workload identities and secrets, written as a runbook.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, vpn gateway
