Articles
RSS feedArticles and how-to guides about Azure, Terraform, GitHub, and cloud engineering.
Featured Posts
DNS in Azure, Part 3: Azure DNS Private Resolver
Part 3 of the DNS in Azure series: inbound and outbound endpoints, forwarding rulesets, the query evaluation order, the centralized and distributed architectures, and how to log DNS queries without running your own servers.
DNS in Azure, Part 4: Private Link and Private Endpoints
Part 4 of the DNS in Azure series: what a Private Endpoint really is, sub-resources, the approval workflow, routing and NSG behaviour, Private Link Service, and why turning off public network access is a separate job.
DNS in Azure, Part 5: Private Endpoints and Private DNS
Part 5 of the DNS in Azure series: the privatelink CNAME chain, the exact zone name for every service, private DNS zone groups, running zones at scale with Azure Policy, and making Private Endpoints resolve from on-premises.
DNS in Azure, Part 6: Private DNS Fallback to Internet
Part 6 of the DNS in Azure series: why a privatelink zone returns NXDOMAIN for names you do not own, how the NxDomainRedirect resolution policy fixes cross-tenant Private Link, and when you should deliberately leave it off.
DNS in Azure, Part 7: DNS Security Policies
Part 7 of the DNS in Azure series: DNS resolver policies, traffic rules and domain lists, the Microsoft threat intelligence feed, full query logging in Log Analytics, and a rollout plan that will not take your platform down.
DNS in Azure, Part 8: The Resolution Decision Tree
Part 8 of the DNS in Azure series: an interactive decision tree that takes you from a client asking for a name to the exact Azure architecture that answers it - Azure DNS, private zones, privatelink, forwarding rulesets, or on-premises.
DNS in Azure, Part 2: Private DNS Zones
Part 2 of the DNS in Azure series: how private DNS zones and virtual network links really work, what autoregistration does to your records, the privatelink zones behind Private Endpoints, and how to design zones you will not regret.
DNS in Azure, Part 1: Fundamentals and Azure-Provided Name Resolution
Part 1 of an eight-part series on private DNS in Azure: the vocabulary, the 168.63.129.16 platform IP, where a VM actually gets its resolver from, and why the default internal.cloudapp.net namespace runs out of road.
How to Create a New Article
Everything you can use when writing a new article for /articles: frontmatter fields, headings, lists, callouts, code blocks, tables, images, and links.
Connect GitHub and Azure for Deployment Using OIDC
Stop storing long-lived Azure credentials in GitHub secrets. Set up OpenID Connect federation so GitHub Actions can authenticate to Azure with short-lived tokens.
What Is an Azure Landing Zone?
A practical introduction to Azure landing zones: what they are, why they matter, and the building blocks every platform team should know.
Connect to an Azure VM Using the Native RDP Client Through Bastion
Step-by-step guide to connecting to an Azure VM with your native RDP client through Azure Bastion's native client support, including how to open the tunnel with the Azure CLI.
How to Delegate a Domain to Azure DNS
Step-by-step guide to delegating a domain purchased from a third-party registrar (OVH) to Azure DNS, and recreating the DNS records once delegation is complete.
Display Latest Commits with Git Graph
A stylish one-liner to showcase the latest commits from a repository directly in the terminal.
GitHub Contribution Workflow
The end-to-end workflow for contributing to a GitHub project: fork, branch, commit, push, pull request, code review, and merge.
App Service (PHP) Access to Azure SQL Database with Managed Identity
Connect a PHP app running on Azure App Service to Azure SQL Database using a system-assigned managed identity, with no stored username or password.
Allow ICMP (Ping) on an Azure VM
Azure VMs block ICMP (ping) by default via the Windows Firewall. Here's the firewall rule to allow it, applied through the Azure portal's run command.
Network Security Perimeter (NSP)
An overview of Azure Network Security Perimeter: the pain points it solves for PaaS resource access control, how it compares to existing patterns, and its current limitations.
Restrict Web App Access with Entra ID Authentication
How to restrict access to an Azure Web App to specific users or security groups using Microsoft Entra ID, instead of allowing every user in the tenant.
Terraform vs Bicep, the Match
A side-by-side comparison of Terraform and Bicep across language, state management, learning curve, cost, and more, based on hands-on experience with both.
Display GitHub Secrets for Debug
A quick method to print a GitHub Actions secret for debugging purposes, spaced out so it can't be read directly from the log.
Remove Old Azure Resources Based on Tags
Automate the cleanup of temporary Azure resources using a Time-To-Live tag, plus a script to auto-tag untagged resources with their creator.
Search Azure Policy Aliases and Send Output to an Interactive Table
A PowerShell script that lets you interactively search Azure Policy aliases by namespace using Out-GridView.
Azure REST APIs, Versions, and Lifecycle
How Azure REST API versions work, how to find them with PowerShell, and why the api-version parameter matters.
Call Azure API with PowerShell
How to call an Azure REST API directly from PowerShell: get an access token, build the request headers, and invoke the endpoint.
RBAC Delete Role Assignments with 'Identity Not Found'
Why Azure keeps RBAC role assignments for deleted users, groups, or service principals, and a PowerShell script to clean them up.
Don't Build Your Cloud Home on Shaky Foundations
Why cloud governance and security foundations - landing zones, management groups, policies, RBAC, naming, tagging, and networking - must come before any real workload.
KQL Query Collection
A growing collection of Kusto Query Language (KQL) queries for Azure Resource Graph, covering AKS, disks, networking, policies, RBAC, subscriptions, and tags.
Azure Subscription Switcher
A PowerShell script to quickly switch between Azure subscriptions by index, with an optional Out-GridView interface.
Draw.io VS Code Extension: A Must-Have for Your Diagrams
Discover the benefits of integrating Draw.io with VS Code for seamless diagram creation.
Cyber Attacks Live Maps
A curated list of free live dashboards that visualize cyber attacks happening around the world in real time.
How to Host Your Hugo Website on GitHub Pages
Step-by-step guide to publishing a local Hugo website to GitHub Pages, including the deployment pipeline and how to sync content updates.
From WordPress to Hugo Website
Why I migrated this site from WordPress to Hugo, and the trade-offs between the two platforms.
How to Embed a GitHub Script in an Article
How I keep long PowerShell scripts in a dedicated GitHub repository and embed them directly as code blocks instead of duplicating the code across posts.
Terraform and Entra ID Authentication
How to disable storage account key-based authentication and use Entra ID authentication for the Terraform azurerm remote backend.
Optimize and Reduce Costs in Azure
Practical tips to control and reduce your Azure spending: VM sizing, autoshutdown, reservations, hybrid benefit, storage tiers, tagging, and more.
Set Up Your First Terraform Environment on Windows
Step-by-step guide to setting up your first Terraform environment on Windows: install the CLI, configure a remote state backend in Azure Storage, and run your first plan and apply.
Git Basics
The fundamental Git commands every beginner should know: configuration, cloning, branching, committing, and logs.
GitHub Branch Naming Convention
A practical branch naming convention for GitHub projects: standard format, common prefixes, best practices, and special branches.
GitHub Commit Naming Convention
A practical commit message convention for GitHub projects, based on Conventional Commits: format, common types, and writing clear messages.
About these articles
Practical write-ups from real Azure, GitHub, and DevOps work: the configuration that was not obvious, the error message with no useful search result, and the procedure worth writing down before it is forgotten.
What you will find
- Azure infrastructure — networking, virtual machines, identity, and governance.
- Infrastructure as code — Terraform and Bicep, and how they compare in practice.
- GitHub — Actions, OIDC federation with Azure, branch and commit conventions, and contribution workflows.
- Operations — cost optimisation, policy and RBAC clean-up, and KQL queries for troubleshooting.
How to browse
Use the category and tag filters to narrow the list, or the search box to look across every title and summary at once. Each article is self-contained, with the commands and configuration in copyable blocks. An RSS feed is available if you would rather be notified when something new is published.