| 10 min read
A Gateway Pattern for Safe AI Agent Actions
An architecture for letting a language model act on real systems without trusting it: a separate gateway holding the credential, a guard re-read at the moment of every write, limits in the layer that enforces them, and an agent that cannot lift its own restraint.
AI & Knowledge Platforms
Read more →
| 12 min read
Azure Standard Service Endpoints in 2026 and Where They Fit
Standard service endpoints add a network identifier and Network Security Perimeter integration to classic service endpoints. They primarily solve scale and central access management rather than providing Private Link style isolation. Where they sit against endpoint policies, NSG service tags, ASGs and Private Link.
Azure Architecture
Read more →
| 5 min read
From Governator to Cloudivence: When an Internal Azure Tool Becomes a Product
Governator remains the internal assessment engine, while Cloudivence becomes GenioCT's customer-facing cloud cost and governance product. Why we are separating the engine from the product, and what comes next.
Cloud Economics & Strategy
Read more →
| 10 min read
Your Azure Budget Can Change Overnight. Your 2027 Planning Shouldn't.
Microsoft's January 2027 local currency update and the February 2027 regional price increase for VMs and Storage change Azure budgets. Price exposure, forecasting and scenario based planning.
Cloud Economics & Strategy
Read more →
| 14 min read
Which Azure Bastion SKU Do You Need in 2026?
Azure Bastion now ships in four SKUs, and Microsoft's own guidance points two different ways. Here is what forces each step up, what each tier costs per month, and why the choice is harder to reverse than it looks.
Security & Compliance
Read more →
| 10 min read
Governator Has Grown Beyond Compliance, and the Data Model Is Why
Governator was built to turn fragmented Azure signals into CyFun and NIS2 evidence. The mapping turned out to be the less valuable half. This is what the model underneath it made possible, and why FinOps, identity and security now sit on the same foundation.
Security & Compliance
Read more →
| 10 min read
Does Your Organisation Need Azure Local? A CIO Decision Guide
A CIO-level guide to Azure Local: when it is preferable to a normal Azure region, what L1, L2, and L3 mean, what it costs to operate, and which questions to answer before buying hardware.
Azure Architecture
Read more →
| 14 min read
Azure Arc in 2026 and Where It Stops
Azure Arc projects servers, Kubernetes clusters, and data services from anywhere into the Azure management plane. After six years of production use, here is what it actually solves, where it falls short, and how to use it without overestimating its reach.
Azure Architecture
Read more →
| 12 min read
Azure Local in 2026 and Which Tier Fits Which Workload
Azure Local now ships in three priced tiers, from connected hyperconverged clusters to a fully disconnected private cloud with its own local control plane. What each tier costs in hardware, licensing, and operator time, and which workloads genuinely belong on each.
Azure Architecture
Read more →
| 10 min read
APIM as an AI Gateway in 2026: Where It Does Not Help
Part 2 of 2. What APIM's AI gateway does not solve: prompt injection, business authorisation, model quality, private networking. Plus the features to use carefully and four architecture patterns with a decision table.
Series AI & Knowledge Platforms
Read more →
| 9 min read
APIM as an AI Gateway in 2026: Where It Helps
Part 1 of 2. Azure API Management now understands LLM traffic: token limits per consumer, token metrics, model backend pools, MCP governance. The five enterprise problems the AI gateway genuinely solves, and the moment it starts earning its place.
Series AI & Knowledge Platforms
Read more →
| 12 min read
Azure OpenAI to Microsoft Foundry: When to Upgrade and What to Fix First
Microsoft is upgrading Azure OpenAI resources to Foundry, in place and increasingly automatically. What the upgrade changes, what it silently widens, when deferring is the right call, and how to run it without breaking private networking or governance.
AI & Knowledge Platforms
Read more →
| 6 min read
The Missing Layer Between Cloud Architecture and Audit Evidence
A technically correct landing zone can still fall apart the first time someone asks 'show me.' Why the trail from business risk to control to proof belongs inside the architecture, not bolted on the week before an audit.
Azure Architecture
Read more →
| 11 min read
APIM v2 Migration Playbook: Moving from Classic to Standard v2 or Premium v2
A field playbook for migrating Azure API Management from classic Developer, Standard, or Premium to the v2 tiers: what carries over, what breaks, how to preserve subscription keys, the order to run the cutover in, and when staying on classic is the right call.
Platform Engineering
Read more →
| 11 min read
Azure Container Apps Express in 2026 and Where Its Preview Gap Still Sends You Back
Azure Container Apps Express hit public preview at Build 2026 with subsecond cold starts and no environment to provision. The preview feature gap is large, and so is the region constraint. Here is what Express actually changes inside the ACA family, and where it still sends you back to a standard environment.
Azure Architecture
Read more →
| 10 min read
Cloud Sovereignty in 2026 and Why It Is a Workload Classification Problem
Cloud sovereignty in 2026 means SEAL levels and 48 EU procurement criteria beyond region selection. The architect's job is workload classification across five distinct concerns.
Azure Architecture
Read more →
| 11 min read
AKS in 2026 and When It Still Wins
AKS has matured beyond recognition since its 2018 GA. Automatic upgrades, Workload Identity, Cilium, managed observability, and the new AKS Automatic tier have changed the operational picture. Here is when AKS is still the right call and when simpler platforms do the job better.
Azure Architecture
Read more →
| 8 min read
The DNS Problems That Break Your Private Link Connectivity
Private Link is easy to deploy. Getting DNS right across hub-spoke, hybrid, and multi-subscription environments is where it breaks. Seven failure modes.
Azure Architecture
Read more →
| 10 min read
NIS2 Belgium After 18 April: From Basic Readiness to Continuous Azure Evidence
The 18 April 2026 NIS2 checkpoint has passed for Belgian essential entities. The next challenge for Azure-heavy organisations is continuous evidence rather than another readiness questionnaire.
Security & Compliance
Read more →
| 8 min read
Your Service Principals Are a Bigger Blast Radius Than Your VMs
In most Azure tenants, real exposure is a forgotten service principal with Owner scope, an expired secret, no human owner. Four risk patterns mapped to NIS2.
Field lesson Security & Compliance
Read more →
| 8 min read
Azure Front Door in 2026 and the Standard vs Premium Decision
Front Door Standard vs Premium, Private Link to origin, the App Gateway overlap question, and what changed since Microsoft stopped new classic profiles. The enterprise decision guide.
Azure Architecture
Read more →
| 12 min read
How to Prepare for an NIS2 Audit on Azure in 12 Weeks
The 12-week NIS2 readiness plan we run with Azure clients. Article 21 mapping, gap closure, evidence assembly, and pre-audit dry run, week by week, with the Azure controls and pitfalls at each stage.
Security & Compliance
Read more →
| 12 min read
When Azure Functions Can Replace Entra Application Proxy and When They Cannot
For a narrower class of internal apps and APIs, you can avoid Entra Application Proxy connector VMs with a cloud-native proxy pattern using Azure Functions, Easy Auth, and VNet integration. Here is the decision framework.
Security & Compliance
Read more →
| 12 min read
Defender for Cloud in 2026 and What to Enable, Tune, and Skip
Defender for Cloud has grown into a sprawling product. Here is a practical guide to which plans are worth the money, which recommendations matter, and how to avoid the noise.
Security & Compliance
Read more →
| 14 min read
Enterprise AI on Azure in 2026: What Changed
Three years after Azure OpenAI went GA, the enterprise AI platform looks very different. Microsoft Foundry, GPT-5, the Responses API, agentic retrieval, and model-agnostic PTU reservations have changed the design decisions. Here is what matters now.
AI & Knowledge Platforms
Read more →
| 7 min read
Why Your Azure Monitor Workbook Shows No Data Even With the Right Permissions
The hidden access control trap in Azure Monitor Workbooks. Resource-context vs workspace-context queries, why Monitoring Reader is not always enough, and the fix that takes five minutes.
Field lesson Security & Compliance
Read more →
| 7 min read
Palo Alto Cloud NGFW for Azure in 2026 and When It Beats Azure Firewall Premium
Cloud NGFW has matured from an early ISV experiment into a credible managed firewall for Azure. How it compares to Azure Firewall Premium, what the real costs are, and a decision framework for enterprises choosing between them.
Security & Compliance
Read more →
| 9 min read
Azure Firewall in 2026 and When Standard, Premium, or an NVA Is the Right Call
Azure Firewall now has Basic, Standard, and Premium SKUs. Premium adds TLS inspection, IDPS, and URL filtering for regulated workloads. Here is the real enterprise decision guide for 2026.
Azure Architecture
Read more →
| 11 min read
Shared vs Separate Azure Hubs for Regulated Workloads Under NIS2 and DORA
Should production and non-production share a hub in regulated Azure environments? A decision framework grounded in NIS2 operational resilience requirements and DORA environment separation obligations.
Security & Compliance
Read more →
| 7 min read
Your Azure Bill Is Higher Because Your Partner Isn't Managing Anything
Microsoft's Partner Earned Credit can reduce net Azure costs when your partner has the right access and operational role. Most enterprises never see that benefit because the setup is wrong. Here is how to check and fix it.
Cloud Economics & Strategy
Read more →
| 8 min read
Azure Functions Flex Consumption with Locked Storage and the Gotchas That Break Deployments
How to deploy Azure Functions Flex Consumption to secured storage accounts. One Deploy, managed identity, the AzureWebJobsStorage format that matters, and Terraform workarounds.
Field lesson Security & Compliance
Read more →
| 12 min read
Azure WAF False Positives and the Rules That Break Legitimate Traffic
The CRS rules that trigger most often on real Azure web applications. How to identify, confirm, and safely exclude false positives without weakening your WAF.
Security & Compliance
Read more →
| 12 min read
RAG on Azure for Internal Knowledge Platforms
An architecture guide for building Retrieval-Augmented Generation on Azure. Document ingestion, AI Search, permission trimming, grounding, and the production challenges that tutorials skip.
AI & Knowledge Platforms
Read more →
| 11 min read
Azure Policy Guardrails That Developers Don't Hate
Practical Azure Policy examples that enforce governance without blocking delivery. Tag enforcement, SKU restrictions, network controls, and diagnostic settings that work with developer workflows.
Platform Engineering
Read more →
| 11 min read
Azure Landing Zones in 2026: What Matters Now
Landing zones are easy to deploy. Operating and evolving them is the real challenge. Policy hygiene, subscription vending, identity changes, and the day-2 problems that mature Azure environments face.
Azure Architecture
Read more →
| 13 min read
Microsoft Sentinel in 2026 and How to Control Ingestion Costs
Sentinel's biggest problem in enterprise Azure is not capability but cost. Data Collection Rules, Basic Logs, commitment tiers, and what to onboard first.
Security & Compliance
Read more →
| 12 min read
YAML-Driven Terraform: Building a Self-Service Infrastructure Catalog
How to turn your Terraform codebase into a self-service platform. A YAML-driven approach that lets teams provision cloud resources without writing HCL. And keeps your platform team sane.
Platform Engineering
Read more →
| 17 min read
Azure APIM v2 vs Classic: What Changed and What Breaks
Azure API Management is moving to a new platform. The StandardV2 and BasicV2 tiers bring real improvements, but also breaking changes that catch teams off guard. Here is what you need to know before migrating.
Platform Engineering
Read more →
| 12 min read
Why Every Azure Enterprise Needs a WAF Analysis Methodology
Azure WAF protects your web applications, but without a structured analysis methodology, you are flying blind. Learn how to turn WAF from a checkbox into a security asset.
Security & Compliance
Read more →
| 12 min read
What an Azure Landing Zone Audit Finds in Practice
The patterns we see when reviewing enterprise Azure environments. Management group chaos, unenforced policies, DNS problems, identity gaps, and cost tagging failures.
Field lesson Azure Architecture
Read more →
| 8 min read
Why Internal Developer Platforms Fail on Azure
The patterns behind failed platform engineering initiatives. Too many tools, no paved path, no product ownership, inconsistent modules, and missing policy guardrails.
Platform Engineering
Read more →
| 9 min read
Your Developers Don't Need More Tools. They Need a Paved Path.
The platform engineering problem is not tool count. It's the lack of opinionated defaults, clear ownership, and a measurable self-service path through the tools you already have.
Platform Engineering
Read more →
| 10 min read
APIM vs Azure Front Door vs Application Gateway and When to Use Each
The real decision guide for Azure's overlapping edge services. When to use API Management, Front Door, Application Gateway, or a combination.
Azure Architecture
Read more →
| 11 min read
Why Your Azure Bill Is High Even When Your Resources Are Right-Sized
The cost problems that rightsizing and reserved instances don't fix. Partner configuration errors, log ingestion sprawl, unused private endpoints, egress surprises, and diagnostic settings nobody audits.
Cloud Economics & Strategy
Read more →
| 9 min read
When Your Platform Team Can't Agree on the Stack
A real story from an enterprise platform team split over infrastructure tooling. The technical debate was the easy part. The human side, sunk cost, identity, and fear of starting over, is where it gets hard.
Field lesson Platform Engineering
Read more →
| 9 min read
Dapr Graduates CNCF and What It Means for Distributed Application Building Blocks
Dapr graduated from CNCF in November 2024. The building-block model for distributed applications is now production-mature. Here is when Dapr earns its place on Azure, when native SDKs are still the better answer, and how Container Apps and AKS host it differently.
Azure Architecture
Read more →
| 10 min read
Your Board Is Asking About NIS2. Here Is What You Need to Do
NIS2 and DORA are now enforceable. Belgium's CyFun self-assessment deadline is April 2026. What CTOs and IT directors at Belgian and EU enterprises need to understand, and where the compliance gaps are showing up.
Updated 2026 Security & Compliance
Read more →
| 6 min read
Terraform AzureRM 4.0: What Breaks and How to Migrate
The AzureRM provider 4.0 just dropped with breaking changes to resource naming, attribute defaults, and provider configuration. After migrating several production codebases, this is what you need to know.
Updated 2026 Platform Engineering
Read more →
| 9 min read
The Multi-Cloud Trap and the Vendor Lock-In Myth
Most enterprises go multi-cloud out of fear rather than strategy. The result is double the complexity, double the skills gap, and rarely any actual portability. Here is what to do instead.
Cloud Economics & Strategy
Read more →
| 8 min read
Build vs Buy Your Platform Team
A breakdown of when to hire cloud engineers in-house versus engaging a consultancy for your platform team. Real costs, real timelines, and the hybrid model that actually works for most enterprises.
Cloud Economics & Strategy
Read more →
| 9 min read
Azure Verified Modules: Microsoft's Answer to the Terraform Module Mess
Azure Verified Modules provide Microsoft-maintained, tested, and standardized Terraform and Bicep modules for Azure resources. After using them in production, this is what works, what doesn't, and when to use your own modules instead.
Updated 2026 Platform Engineering
Read more →
| 8 min read
Bicep vs Terraform, Why We Default to Terraform (and When Bicep Wins)
After running both Bicep and Terraform in production for the same enterprise, here is where each one earns its place. Terraform is our default, Bicep has its place, and badly written Terraform is worse than either.
Updated 2026 Platform Engineering
Read more →
| 9 min read
Palo Alto Cloud NGFW on Azure and What a PoC Revealed About the Managed Firewall
We ran a proof of concept for Palo Alto Cloud NGFW alongside VM-Series in an enterprise Azure hub-spoke environment. The managed firewall works, but the operational details matter more than the feature sheet suggests.
Field lesson Security & Compliance
Read more →
| 10 min read
KEDA Graduates CNCF and What It Means for Event-Driven Kubernetes Autoscaling
KEDA graduated from CNCF in August 2023. Event-driven autoscaling is now a stable, multi-vendor foundation that Container Apps, AKS, and any Kubernetes platform can rely on. Here is when KEDA earns its place, which scalers carry real operational weight, and where default HPA already does the job.
Azure Architecture
Read more →
| 5 min read
Azure AD Is Now Entra ID: What Changed and What Didn't
Microsoft renamed Azure Active Directory to Microsoft Entra ID in July 2023. A reference for anyone who still meets the old name in a runbook or a script: what the rename touched, what it never touched, and which pieces have since been retired outright.
Updated 2026 Security & Compliance
Read more →
| 8 min read
The Costs Your Cloud Migration Business Case Didn't Include
Enterprise cloud migrations routinely blow past their budgets by 20-30%. The reason isn't compute pricing. It's the platform teams, dual-run periods, licensing traps, and retraining costs that never made it into the original spreadsheet.
Cloud Economics & Strategy
Read more →
| 10 min read
Architecting for Azure OpenAI: Enterprise Patterns for Production
Azure OpenAI Service is now generally available. Every Azure architecture now needs an AI strategy. Here are the patterns for network isolation, token management, and responsible deployment that we use in practice.
Updated 2026 AI & Knowledge Platforms
Read more →
| 10 min read
Azure DNS Private Resolver: The End of Custom DNS VMs in Your Hub
Azure DNS Private Resolver is a managed service that replaces the custom DNS forwarder VMs that every enterprise hub-spoke architecture has been running. After migrating several environments, this is how it works and what to watch for.
Updated 2026 Azure Architecture
Read more →
| 11 min read
Container Apps vs AKS vs App Service: A Decision Framework
Azure Container Apps just went GA. With three container hosting options on Azure, here is a practical decision framework for architects who are tired of over-engineering container platforms.
Updated 2026 Azure Architecture
Read more →
| 6 min read
GitHub Actions for Azure: When It Makes Sense to Leave Azure Pipelines
GitHub Actions now has first-class Azure integration. If your code lives in GitHub, your CI/CD probably should too. A practical comparison with Azure Pipelines and the migration patterns that work.
Platform Engineering
Read more →
| 8 min read
Defender for Cloud: Microsoft's Multi-Cloud Security Posture Play
Microsoft just unified Azure Security Center and Azure Defender into Defender for Cloud with multi-cloud support for AWS and GCP. Here is what changed and what it means for your security architecture.
Updated 2026 Security & Compliance
Read more →
| 8 min read
I Hacked My Own Web App on Kubernetes
A step-by-step walkthrough of auditing a live Kubernetes web app, from XSS exploitation through a WAF in DetectionOnly mode, to exposed Prometheus metrics and missing authentication. Practical fixes included.
Field lesson Security & Compliance
Read more →
| 7 min read
Azure Static Web Apps: The Jamstack Platform Azure Was Missing
Azure Static Web Apps just went GA with built-in CI/CD, serverless API backends, authentication, and global distribution. For static sites and SPAs on Azure, this changes the deployment story entirely.
Azure Architecture
Read more →
| 8 min read
Azure Arc: Extending Azure Management to Your On-Premises Infrastructure
Azure Arc brings Azure Policy, monitoring, and security to servers and Kubernetes clusters anywhere. Here is what it does, where it fits, and the practical considerations for hybrid architectures.
Azure Architecture
Read more →
| 8 min read
Azure Landing Zones: What I Wish I Had Known Before Deploying Enterprise-Scale
Microsoft's Enterprise-Scale architecture provides a production-ready Azure foundation. After implementing it for multiple organisations, here are the lessons that the documentation does not cover.
Foundational Azure Architecture
Read more →
| 13 min read
Azure Private Link: How It Changed the Enterprise PaaS Playbook
Azure Private Link brings PaaS services into your private network. Here is how it works, the DNS complexity it introduces, and the architecture patterns every enterprise needs.
Foundational Azure Architecture
Read more →
| 11 min read
Azure Bastion: Why Your VMs Don't Need Public IPs Anymore
Azure Bastion provides secure RDP and SSH access to your VMs directly from the Azure portal, without public IPs, jump boxes, or VPN. After rolling it out across multiple environments, this is what we learned.
Foundational Azure Architecture
Read more →
| 8 min read
Azure Sentinel: What Cloud-Native SIEM Means for Your Security Architecture
Microsoft's new cloud-native SIEM changes how enterprises design security operations. Here is what Sentinel does differently, how to architect around it, and when it replaces your existing SIEM.
Foundational Security & Compliance
Read more →
| 11 min read
Azure Front Door: What Happens Between the Edge and Your Origin
Front Door's routing methods, health probe behaviour, domain validation, certificates and caching, with the numbers that decide how it behaves in production. The tier and cost decision is covered in a separate 2026 article.
Updated 2026 Azure Architecture
Read more →
| 5 min read
Azure Firewall: When Cloud-Native Network Security Finally Makes Sense
Azure Firewall is now generally available. Here is what it means for enterprise hub-spoke architectures, when it replaces NVAs, and the design patterns that work in practice.
Foundational Azure Architecture
Read more →
| 7 min read
Azure DevOps: Five Services, and Why VSTS Was Split Up
Azure DevOps is five services you can adopt separately: Boards, Repos, Pipelines, Test Plans and Artifacts. What the 2018 split from VSTS changed about adoption and pricing, and what has held since.
Platform Engineering
Read more →
| 5 min read
Zero-Credential Architectures: How Managed Identity Changes Everything
Azure Managed Identity eliminates the need for credentials in your code. Here is how it works, when to use system-assigned vs user-assigned, and the architecture patterns that make secrets a thing of the past.
Foundational Security & Compliance
Read more →
| 7 min read
AKS Just Went GA: What Enterprise Teams Need to Know Before Going All-In
Azure Kubernetes Service is now generally available. Before you migrate everything to AKS, here are the architecture decisions, networking gotchas, and operational realities that the quickstart guides skip.
Azure Architecture
Read more →
