https://benoit-gaumard.io/articles/ Latest articles and how-to guides by Benoit Gaumard. en-us Thu, 08 Oct 2026 08:33:45 GMT https://benoit-gaumard.io/articles/azure-policy-part-1-what-is-a-policy/ https://benoit-gaumard.io/articles/azure-policy-part-1-what-is-a-policy/ Part 1 of a seven-part series on Azure Policy: what a policy definition actually is, how the if/then rule works, aliases, the full list of effects and the order they run in, modes, versioning, and the limits that bite in production. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Featured Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-2-initiatives/ https://benoit-gaumard.io/articles/azure-policy-part-2-initiatives/ Part 2 of the Azure Policy series: policy set definitions explained - grouping definitions, policyDefinitionReferenceId, passing parameters down, definition groups and regulatory compliance, version pinning, and the initiative parameter you can never change. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-3-assignments/ https://benoit-gaumard.io/articles/azure-policy-part-3-assignments/ Part 3 of the Azure Policy series: assignments are where governance becomes real. Scope and inheritance, enforcementMode, managed identities and remediation permissions, resourceSelectors and overrides for safe rollout, and non-compliance messages. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-4-exclusions-notscopes/ https://benoit-gaumard.io/articles/azure-policy-part-4-exclusions-notscopes/ Part 4 of the Azure Policy series: exclusions explained. How notScopes carves a hole in an assignment scope, why excluded resources vanish from compliance entirely, the governance debt it creates, and when an exclusion is genuinely the right answer. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-5-exemptions/ https://benoit-gaumard.io/articles/azure-policy-part-5-exemptions/ Part 5 of the Azure Policy series: exemptions explained. Waiver versus Mitigated, expiresOn, exempting a single initiative member, identity-based exemptions, compliance substate, the RBAC you need, and how to stop exemptions becoming permanent. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-6-policy-as-code/ https://benoit-gaumard.io/articles/azure-policy-part-6-policy-as-code/ Part 6 of the Azure Policy series: why the portal stops working at scale, Microsoft's create-test-deploy workflow, the deployment ordering problem, drift and desired state, the managed identity permission gap, and what to put in your repository. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-policy-part-7-epac/ https://benoit-gaumard.io/articles/azure-policy-part-7-epac/ Part 7 of the Azure Policy series: Enterprise Azure Policy as Code (EPAC) explained end to end - folder structure, global-settings.jsonc, pacEnvironments, desired state strategies, the three-stage pipeline, ALZ integration - plus an honest comparison with ALZ, Terraform, AzOps and doing nothing. Benoit G Fri, 04 Sep 2026 12:00:00 GMT Featured Azure Governance Azure Policy https://benoit-gaumard.io/articles/azure-lighthouse-cross-tenant-management/ https://benoit-gaumard.io/articles/azure-lighthouse-cross-tenant-management/ Choose between application maintenance, multi-tenant operations and ISV delegation, then review Lighthouse scope, role limitations, rollout and revocation. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure Governance https://benoit-gaumard.io/articles/dns-in-azure-part-3-private-resolver/ https://benoit-gaumard.io/articles/dns-in-azure-part-3-private-resolver/ Part 3 of the DNS in Azure series: inbound and outbound endpoints, forwarding rulesets, the query evaluation order, the centralized and distributed architectures, and how to log DNS queries without running your own servers. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-4-private-endpoints/ https://benoit-gaumard.io/articles/dns-in-azure-part-4-private-endpoints/ Part 4 of the DNS in Azure series: what a Private Endpoint really is, sub-resources, the approval workflow, routing and NSG behaviour, Private Link Service, and why turning off public network access is a separate job. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-5-private-endpoint-dns/ https://benoit-gaumard.io/articles/dns-in-azure-part-5-private-endpoint-dns/ Part 5 of the DNS in Azure series: the privatelink CNAME chain, the exact zone name for every service, private DNS zone groups, running zones at scale with Azure Policy, and making Private Endpoints resolve from on-premises. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-6-private-dns-fallback/ https://benoit-gaumard.io/articles/dns-in-azure-part-6-private-dns-fallback/ Part 6 of the DNS in Azure series: why a privatelink zone returns NXDOMAIN for names you do not own, how the NxDomainRedirect resolution policy fixes cross-tenant Private Link, and when you should deliberately leave it off. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-7-dns-security-policies/ https://benoit-gaumard.io/articles/dns-in-azure-part-7-dns-security-policies/ Part 7 of the DNS in Azure series: DNS resolver policies, traffic rules and domain lists, the Microsoft threat intelligence feed, full query logging in Log Analytics, and a rollout plan that will not take your platform down. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS Security https://benoit-gaumard.io/articles/dns-in-azure-part-8-decision-tree/ https://benoit-gaumard.io/articles/dns-in-azure-part-8-decision-tree/ Part 8 of the DNS in Azure series: an interactive decision tree that takes you from a client asking for a name to the exact Azure architecture that answers it - Azure DNS, private zones, privatelink, forwarding rulesets, or on-premises. Benoit G Thu, 03 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-2-private-dns-zones/ https://benoit-gaumard.io/articles/dns-in-azure-part-2-private-dns-zones/ Part 2 of the DNS in Azure series: how private DNS zones and virtual network links really work, what autoregistration does to your records, the privatelink zones behind Private Endpoints, and how to design zones you will not regret. Benoit G Wed, 02 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/dns-in-azure-part-1-fundamentals/ https://benoit-gaumard.io/articles/dns-in-azure-part-1-fundamentals/ Part 1 of an eight-part series on private DNS in Azure: the vocabulary, the 168.63.129.16 platform IP, where a VM actually gets its resolver from, and why the default internal.cloudapp.net namespace runs out of road. Benoit G Tue, 01 Sep 2026 12:00:00 GMT Featured Azure DNS https://benoit-gaumard.io/articles/how-to-creat-a-new-article/ https://benoit-gaumard.io/articles/how-to-creat-a-new-article/ Everything you can use when writing a new article for /articles: frontmatter fields, headings, lists, callouts, code blocks, tables, images, and links. Benoit G Wed, 19 Aug 2026 12:00:00 GMT Documentation https://benoit-gaumard.io/articles/connect-github-and-azure-for-deployment-using-oidc/ https://benoit-gaumard.io/articles/connect-github-and-azure-for-deployment-using-oidc/ Stop storing long-lived Azure credentials in GitHub secrets. Set up OpenID Connect federation so GitHub Actions can authenticate to Azure with short-lived tokens. Benoit G Fri, 14 Aug 2026 12:00:00 GMT Azure GitHub https://benoit-gaumard.io/articles/what-is-an-azure-landing-zone/ https://benoit-gaumard.io/articles/what-is-an-azure-landing-zone/ A practical introduction to Azure landing zones: what they are, why they matter, and the building blocks every platform team should know. Benoit G Mon, 10 Aug 2026 12:00:00 GMT Azure Governance https://benoit-gaumard.io/articles/connect-azure-vm-using-native-rdp-client-through-bastion/ https://benoit-gaumard.io/articles/connect-azure-vm-using-native-rdp-client-through-bastion/ Step-by-step guide to connecting to an Azure VM with your native RDP client through Azure Bastion's native client support, including how to open the tunnel with the Azure CLI. Benoit G Fri, 06 Mar 2026 12:00:00 GMT Azure Bastion https://benoit-gaumard.io/articles/how-to-delegate-a-domain-to-azure-dns/ https://benoit-gaumard.io/articles/how-to-delegate-a-domain-to-azure-dns/ Prepare an Azure public DNS zone and its records before changing registrar name servers, using OVH as the example, then verify delegation and plan rollback. Benoit G Tue, 16 Dec 2025 12:00:00 GMT Azure https://benoit-gaumard.io/articles/display-latest-commits-with-git-graph/ https://benoit-gaumard.io/articles/display-latest-commits-with-git-graph/ A stylish one-liner to showcase the latest commits from a repository directly in the terminal. Benoit G Wed, 26 Feb 2025 12:00:00 GMT Git https://benoit-gaumard.io/articles/github-contribution-workflow/ https://benoit-gaumard.io/articles/github-contribution-workflow/ The end-to-end workflow for contributing to a GitHub project: fork, branch, commit, push, pull request, code review, and merge. Benoit G Wed, 26 Feb 2025 12:00:00 GMT GitHub https://benoit-gaumard.io/articles/app-service-php-access-to-azure-sql-database-with-managed-identity/ https://benoit-gaumard.io/articles/app-service-php-access-to-azure-sql-database-with-managed-identity/ Connect a PHP app running on Azure App Service to Azure SQL Database using a system-assigned managed identity, with no stored username or password. Benoit G Wed, 12 Feb 2025 12:00:00 GMT Azure https://benoit-gaumard.io/articles/allow-icmp-ping-on-an-azure-vm/ https://benoit-gaumard.io/articles/allow-icmp-ping-on-an-azure-vm/ Allow an ICMPv4 echo request in a Windows VM's guest firewall, then separately verify the Azure network path and test the response. Benoit G Fri, 31 Jan 2025 12:00:00 GMT Azure https://benoit-gaumard.io/articles/network-security-perimeter/ https://benoit-gaumard.io/articles/network-security-perimeter/ Compare controls for PaaS public access and private connectivity, understand Network Security Perimeter objects, and prepare a scoped validation plan. Benoit G Fri, 31 Jan 2025 12:00:00 GMT Azure https://benoit-gaumard.io/articles/restrict-web-app-access-with-entra-id-authentication/ https://benoit-gaumard.io/articles/restrict-web-app-access-with-entra-id-authentication/ How to restrict access to an Azure Web App to specific users or security groups using Microsoft Entra ID, instead of allowing every user in the tenant. Benoit G Tue, 17 Dec 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/terraform-vs-bicep-the-match/ https://benoit-gaumard.io/articles/terraform-vs-bicep-the-match/ Compare Terraform and Bicep by scope, state, review workflow and operating cost, then choose a fit for your team instead of a universal winner. Benoit G Fri, 06 Dec 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/display-github-secrets-for-debug/ https://benoit-gaumard.io/articles/display-github-secrets-for-debug/ Check whether a GitHub Actions secret is available without printing it, review repository and environment scope, and use OIDC for Azure instead of long-lived credentials. Benoit G Mon, 02 Dec 2024 12:00:00 GMT GitHub https://benoit-gaumard.io/articles/remove-old-azure-resources-based-on-tags/ https://benoit-gaumard.io/articles/remove-old-azure-resources-based-on-tags/ Build a scoped, read-only TTL inventory before approving resource deletion, and separately investigate creator attribution without treating the last writer as the creator. Benoit G Wed, 13 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/search-azure-policy-aliases/ https://benoit-gaumard.io/articles/search-azure-policy-aliases/ A PowerShell script that lets you interactively search Azure Policy aliases by namespace using Out-GridView. Benoit G Wed, 13 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/azure-rest-apis-versions-and-lifecycle/ https://benoit-gaumard.io/articles/azure-rest-apis-versions-and-lifecycle/ How Azure REST API versions work, how to find them with PowerShell, and why the api-version parameter matters. Benoit G Wed, 06 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/call-azure-api-with-powershell/ https://benoit-gaumard.io/articles/call-azure-api-with-powershell/ Make a read-only Azure Resource Manager GET for a storage account using Azure PowerShell, with explicit context, replaceable parameters and response checks. Benoit G Wed, 06 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/clean-rbac-identity-not-found/ https://benoit-gaumard.io/articles/clean-rbac-identity-not-found/ Inventory unresolved Azure RBAC principals at an explicit scope, verify deletion independently, and preview removal before approving a change. Benoit G Wed, 06 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/dont-build-your-cloud-home-on-shaky-foundations/ https://benoit-gaumard.io/articles/dont-build-your-cloud-home-on-shaky-foundations/ A grouped Azure foundations checklist: decide ownership first, then governance, platform connectivity and ongoing operations before onboarding workloads. Benoit G Wed, 06 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/kql-query-collection/ https://benoit-gaumard.io/articles/kql-query-collection/ A growing collection of Kusto Query Language (KQL) queries for Azure Resource Graph, covering AKS, disks, networking, policies, RBAC, subscriptions, and tags. Benoit G Wed, 06 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/azure-subscription-switcher/ https://benoit-gaumard.io/articles/azure-subscription-switcher/ A PowerShell script to quickly switch between Azure subscriptions by index, with an optional Out-GridView interface. Benoit G Tue, 05 Nov 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/draw-io-vscode-extension-a-must-have-for-your-diagrams/ https://benoit-gaumard.io/articles/draw-io-vscode-extension-a-must-have-for-your-diagrams/ Install the unofficial Draw.io integration, choose an editable file format and create your first diagram alongside source code in desktop VS Code. Benoit G Tue, 05 Nov 2024 12:00:00 GMT Tools https://benoit-gaumard.io/articles/cyber-attacks-live-maps/ https://benoit-gaumard.io/articles/cyber-attacks-live-maps/ A directory of vendor threat visualisations, with their different scopes and limits: useful for exploration, not an exhaustive map of attacks or attribution. Benoit G Sun, 03 Nov 2024 12:00:00 GMT Tools https://benoit-gaumard.io/articles/how-to-host-your-hugo-website-on-github-pages/ https://benoit-gaumard.io/articles/how-to-host-your-hugo-website-on-github-pages/ Prepare a Hugo source repository, select GitHub Actions as the Pages source, build a pinned Hugo version and verify the deployed site. Benoit G Sun, 03 Nov 2024 12:00:00 GMT Hugo https://benoit-gaumard.io/articles/from-wordpress-to-hugo/ https://benoit-gaumard.io/articles/from-wordpress-to-hugo/ A decision-focused comparison of WordPress and Hugo: editing workflow, dynamic features, hosting and maintenance trade-offs, without unrecorded migration claims. Benoit G Wed, 16 Oct 2024 12:00:00 GMT Hugo https://benoit-gaumard.io/articles/how-to-embed-a-github-script-in-an-article/ https://benoit-gaumard.io/articles/how-to-embed-a-github-script-in-an-article/ Distinguish a source link from build-time inclusion and browser fetching, and publish a readable static script snapshot with honest provenance. Benoit G Wed, 16 Oct 2024 12:00:00 GMT GitHub https://benoit-gaumard.io/articles/azure-terraform-entra-id-authentication/ https://benoit-gaumard.io/articles/azure-terraform-entra-id-authentication/ How to disable storage account key-based authentication and use Entra ID authentication for the Terraform azurerm remote backend. Benoit G Wed, 11 Sep 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/optimize-and-reduce-costs-in-azure/ https://benoit-gaumard.io/articles/optimize-and-reduce-costs-in-azure/ Prioritise Azure cost work by effort, reversibility and commitment: establish a baseline, review usage, improve governance, then evaluate financial commitments. Benoit G Wed, 11 Sep 2024 12:00:00 GMT Azure https://benoit-gaumard.io/articles/set-up-your-first-terraform-environment-on-windows/ https://benoit-gaumard.io/articles/set-up-your-first-terraform-environment-on-windows/ Step-by-step guide to setting up your first Terraform environment on Windows: install the CLI, configure a remote state backend in Azure Storage, and run your first plan and apply. Benoit G Wed, 11 Sep 2024 12:00:00 GMT Azure Tools https://benoit-gaumard.io/articles/git-basics/ https://benoit-gaumard.io/articles/git-basics/ Find Git commands by task: setup, cloning, the daily change cycle, synchronisation, branches and diagnosis. Each example explains its effect. Benoit G Wed, 28 Feb 2024 12:00:00 GMT Git https://benoit-gaumard.io/articles/github-branch-naming-convention/ https://benoit-gaumard.io/articles/github-branch-naming-convention/ A suggested team convention, not a GitHub requirement: readable branch names with a purpose, ticket identifier and short description. Benoit G Mon, 26 Feb 2024 12:00:00 GMT GitHub https://benoit-gaumard.io/articles/github-commit-naming-convention/ https://benoit-gaumard.io/articles/github-commit-naming-convention/ A practical commit message convention for GitHub projects, based on Conventional Commits: format, common types, and writing clear messages. Benoit G Mon, 26 Feb 2024 12:00:00 GMT GitHub