Azure Policy
7 parts — from definitions and assignments to policy as code.
Articles
Practical guides on Azure, infrastructure and DevOps.
The catalogue could not be loaded. Search and filters are unavailable; the prebuilt article links are shown below.
Featured selection
Articles
FeaturedAzureGovernanceAzure Policy
Azure Policy, Part 1: What Is an Azure Policy?
Part 1 of a seven-part series on Azure Policy: what a policy definition actually is, how the if/then rule works, aliases, the full list of effects and the order they run in, modes, versioning, and the limits that bite in production.
AzureGovernanceAzure Policy
Azure Policy, Part 2: What Is an Initiative (Policy Set)?
Part 2 of the Azure Policy series: policy set definitions explained - grouping definitions, policyDefinitionReferenceId, passing parameters down, definition groups and regulatory compliance, version pinning, and the initiative parameter you can never change.
AzureGovernanceAzure Policy
Azure Policy, Part 3: What Is a Policy Assignment?
Part 3 of the Azure Policy series: assignments are where governance becomes real. Scope and inheritance, enforcementMode, managed identities and remediation permissions, resourceSelectors and overrides for safe rollout, and non-compliance messages.
AzureGovernanceAzure Policy
Azure Policy, Part 4: What Is an Exclusion (notScopes)?
Part 4 of the Azure Policy series: exclusions explained. How notScopes carves a hole in an assignment scope, why excluded resources vanish from compliance entirely, the governance debt it creates, and when an exclusion is genuinely the right answer.
AzureGovernanceAzure Policy
Azure Policy, Part 5: What Is a Policy Exemption?
Part 5 of the Azure Policy series: exemptions explained. Waiver versus Mitigated, expiresOn, exempting a single initiative member, identity-based exemptions, compliance substate, the RBAC you need, and how to stop exemptions becoming permanent.
AzureGovernanceAzure Policy
Azure Policy, Part 6: Azure Policy as Code
Part 6 of the Azure Policy series: why the portal stops working at scale, Microsoft's create-test-deploy workflow, the deployment ordering problem, drift and desired state, the managed identity permission gap, and what to put in your repository.
FeaturedAzureGovernanceAzure Policy
Azure Policy, Part 7: EPAC and the Alternatives
Part 7 of the Azure Policy series: Enterprise Azure Policy as Code (EPAC) explained end to end - folder structure, global-settings.jsonc, pacEnvironments, desired state strategies, the three-stage pipeline, ALZ integration - plus an honest comparison with ALZ, Terraform, AzOps and doing nothing.
FeaturedAzureGovernance
Azure Lighthouse: Choose a Cross-Tenant Management Pattern
Choose between application maintenance, multi-tenant operations and ISV delegation, then review Lighthouse scope, role limitations, rollout and revocation.
FeaturedAzureDNS
DNS in Azure, Part 3: Azure DNS Private Resolver
Part 3 of the DNS in Azure series: inbound and outbound endpoints, forwarding rulesets, the query evaluation order, the centralized and distributed architectures, and how to log DNS queries without running your own servers.
FeaturedAzureDNS
DNS in Azure, Part 4: Private Link and Private Endpoints
Part 4 of the DNS in Azure series: what a Private Endpoint really is, sub-resources, the approval workflow, routing and NSG behaviour, Private Link Service, and why turning off public network access is a separate job.
FeaturedAzureDNS
DNS in Azure, Part 5: Private Endpoints and Private DNS
Part 5 of the DNS in Azure series: the privatelink CNAME chain, the exact zone name for every service, private DNS zone groups, running zones at scale with Azure Policy, and making Private Endpoints resolve from on-premises.
FeaturedAzureDNS
DNS in Azure, Part 6: Private DNS Fallback to Internet
Part 6 of the DNS in Azure series: why a privatelink zone returns NXDOMAIN for names you do not own, how the NxDomainRedirect resolution policy fixes cross-tenant Private Link, and when you should deliberately leave it off.
FeaturedAzureDNSSecurity
DNS in Azure, Part 7: DNS Security Policies
Part 7 of the DNS in Azure series: DNS resolver policies, traffic rules and domain lists, the Microsoft threat intelligence feed, full query logging in Log Analytics, and a rollout plan that will not take your platform down.
FeaturedAzureDNS
DNS in Azure, Part 8: The Resolution Decision Tree
Part 8 of the DNS in Azure series: an interactive decision tree that takes you from a client asking for a name to the exact Azure architecture that answers it - Azure DNS, private zones, privatelink, forwarding rulesets, or on-premises.
FeaturedAzureDNS
DNS in Azure, Part 2: Private DNS Zones
Part 2 of the DNS in Azure series: how private DNS zones and virtual network links really work, what autoregistration does to your records, the privatelink zones behind Private Endpoints, and how to design zones you will not regret.
FeaturedAzureDNS
DNS in Azure, Part 1: Fundamentals and Azure-Provided Name Resolution
Part 1 of an eight-part series on private DNS in Azure: the vocabulary, the 168.63.129.16 platform IP, where a VM actually gets its resolver from, and why the default internal.cloudapp.net namespace runs out of road.
Documentation
Contributing an Article to This Site
Everything you can use when writing a new article for /articles: frontmatter fields, headings, lists, callouts, code blocks, tables, images, and links.
AzureGitHub
Connect GitHub and Azure for Deployment Using OIDC
Stop storing long-lived Azure credentials in GitHub secrets. Set up OpenID Connect federation so GitHub Actions can authenticate to Azure with short-lived tokens.
AzureGovernance
What Is an Azure Landing Zone?
A practical introduction to Azure landing zones: what they are, why they matter, and the building blocks every platform team should know.
AzureBastion
Native RDP Through Azure Bastion
Step-by-step guide to connecting to an Azure VM with your native RDP client through Azure Bastion's native client support, including how to open the tunnel with the Azure CLI.
Azure
How to Delegate a Domain to Azure DNS
Prepare an Azure public DNS zone and its records before changing registrar name servers, using OVH as the example, then verify delegation and plan rollback.
Git
Display Latest Commits with Git Graph
A stylish one-liner to showcase the latest commits from a repository directly in the terminal.
GitHub
GitHub Contribution Workflow
The end-to-end workflow for contributing to a GitHub project: fork, branch, commit, push, pull request, code review, and merge.
Azure
Connect PHP App Service to Azure SQL Without a Password
Connect a PHP app running on Azure App Service to Azure SQL Database using a system-assigned managed identity, with no stored username or password.
Azure
Allow ICMP (Ping) on an Azure VM
Allow an ICMPv4 echo request in a Windows VM's guest firewall, then separately verify the Azure network path and test the response.
Azure
Network Security Perimeter (NSP)
Compare controls for PaaS public access and private connectivity, understand Network Security Perimeter objects, and prepare a scoped validation plan.
Azure
Restrict Web App Access with Entra ID Authentication
How to restrict access to an Azure Web App to specific users or security groups using Microsoft Entra ID, instead of allowing every user in the tenant.
Azure
Terraform vs Bicep: Choose by Team and Workload
Compare Terraform and Bicep by scope, state, review workflow and operating cost, then choose a fit for your team instead of a universal winner.
GitHub
Debug GitHub Actions Secret Configuration Without Revealing Values
Check whether a GitHub Actions secret is available without printing it, review repository and environment scope, and use OIDC for Azure instead of long-lived credentials.
Azure
Review Expired Azure Resources by TTL Tags Before Cleanup
Build a scoped, read-only TTL inventory before approving resource deletion, and separately investigate creator attribution without treating the last writer as the creator.
Azure
Search Azure Policy Aliases and Send Output to an Interactive Table
A PowerShell script that lets you interactively search Azure Policy aliases by namespace using Out-GridView.
Azure
Azure REST APIs, Versions, and Lifecycle
How Azure REST API versions work, how to find them with PowerShell, and why the api-version parameter matters.
Azure
Call Azure API with PowerShell
Make a read-only Azure Resource Manager GET for a storage account using Azure PowerShell, with explicit context, replaceable parameters and response checks.
Azure
Review RBAC Assignments with 'Identity Not Found'
Inventory unresolved Azure RBAC principals at an explicit scope, verify deletion independently, and preview removal before approving a change.
Azure
Don't Build Your Cloud Home on Shaky Foundations
A grouped Azure foundations checklist: decide ownership first, then governance, platform connectivity and ongoing operations before onboarding workloads.
Azure
KQL Query Library for Azure Resource Graph
A growing collection of Kusto Query Language (KQL) queries for Azure Resource Graph, covering AKS, disks, networking, policies, RBAC, subscriptions, and tags.
Azure
Azure Subscription Switcher
A PowerShell script to quickly switch between Azure subscriptions by index, with an optional Out-GridView interface.
Tools
Edit and Version Draw.io Diagrams in VS Code
Install the unofficial Draw.io integration, choose an editable file format and create your first diagram alongside source code in desktop VS Code.
Tools
Cyber Attacks Live Maps
A directory of vendor threat visualisations, with their different scopes and limits: useful for exploration, not an exhaustive map of attacks or attribution.
Hugo
Host a Hugo Site on GitHub Pages with Actions
Prepare a Hugo source repository, select GitHub Actions as the Pages source, build a pinned Hugo version and verify the deployed site.
Hugo
From WordPress to Hugo: Choosing a Publishing Workflow
A decision-focused comparison of WordPress and Hugo: editing workflow, dynamic features, hosting and maintenance trade-offs, without unrecorded migration claims.
GitHub
Publish a Versioned GitHub Script Snapshot in an Article
Distinguish a source link from build-time inclusion and browser fetching, and publish a readable static script snapshot with honest provenance.
Azure
Terraform and Entra ID Authentication
How to disable storage account key-based authentication and use Entra ID authentication for the Terraform azurerm remote backend.
Azure
Optimize and Reduce Costs in Azure
Prioritise Azure cost work by effort, reversibility and commitment: establish a baseline, review usage, improve governance, then evaluate financial commitments.
AzureTools
Set Up Your First Terraform Environment on Windows
Step-by-step guide to setting up your first Terraform environment on Windows: install the CLI, configure a remote state backend in Azure Storage, and run your first plan and apply.
Git
Git Basics: A Task-Based Command Cheat Sheet
Find Git commands by task: setup, cloning, the daily change cycle, synchronisation, branches and diagnosis. Each example explains its effect.
GitHub
GitHub Branch Naming Convention
A suggested team convention, not a GitHub requirement: readable branch names with a purpose, ticket identifier and short description.
GitHub
GitHub Commit Naming Convention
A practical commit message convention for GitHub projects, based on Conventional Commits: format, common types, and writing clear messages.
Start a series
DNS in Azure
8 parts — from name resolution to Private Endpoints and the decision tree.