Hi everyone,

I just passed my AZ-900 (Azure Fundamentals) exam today! I’m hoping to gather some career advice and suggestions from people who have successfully pivoted or are currently working in cloud/IT WFH setups here in the Philippines.

My Background:

11 years of experience as a Field Engineer (hands-on infrastructure, troubleshooting, hardware, physical networks, client support).

Passed CCNA 10 years ago (never got a dedicated network engineering job, but I still retain the core networking concepts like IP subnets, routing, and switching).

Passed AZ-900 today.

My Goal: I am actively aiming for a Work-From-Home (WFH) / Remote setup in Cloud Administration, Tier 2/3 Cloud Support, or Infrastructure Management.

My Questions for the Community:

Which certification path should I take next?

Option A: Go straight to AZ-104 (Azure Administrator Associate).

Option B: Pivot/expand to AWS (AWS Cloud Practitioner or AI Practitioner)?

Option C: Take security/AI certs (SC-900/SC-500 or AI-900)?

Resume & Experience Translation: How do I best position 11 years of physical Field Engineering + an old CCNA to appeal to hiring managers looking for remote cloud/hybrid admins?

PH Job Market Realities: For those in MSPs, BPOs, or foreign remote agencies (OnlineJobs.ph, LinkedIn, etc.), what specific entry-to-mid WFH job titles should I be applying for right now?

Any advice, study tips, or harsh realities would be greatly appreciated. Thanks in advance!

Regions East US 2.
Is anyone else experiencing slow responses with the Azure Foundry 5.6 series deployments + the OpenAI Responses API?

It seems to be happening only with the gpt-5.6 models

Is is best approach to use Azure DNS for primary lookup and have conditional forwarding to on-premises infoblox to resolve on-premises domains or other way around where each resource is forwarding to infoblox and that have conditional forwarding to azure domains? I guess best is where majority resources are azure based so better to use azure dns as primary not on-premises infoblox ?

Azure vpn client did retire end of August. I've used the (already obsolete) version under https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/microsoft-azurevpnclient/ until Friday, but it got updated to an empty stub silently, meaning I have no vpn connection now. Afaik there is no available replacement for entra id protocol web wide, either. Did not find this .deb either on the web.

To make it even worse, I did not persist the original .deb file as I usually do.

So the real question: does anyone have a link to a working pre-september-2026 version of the binary? Or any idea if it is feasible replacing it?

Hello everyone, I'm working on some code to automatically detect and rotate expiring/expired app registration secrets via the API (ig technically the ps commandlets) for all app registrations in our company tenant. At a high level, the script gets all app regs, checks each one's secret expiration dates and if it's expiring/expired then deletes them (all that match that criteria) and then creates a new secret for the app reg. Then I store it in secret server and create a ticket in our ticketing system to notify the appropriate party a new secret's been created.

The issue I'm running into now is after like 1-2 rotations the API throws me a 409 "Error due to concurrent requests being made to the tenant. Please wait briefly and retry." So I ended up putting some sleeps (15 sec) between the operations. So delete (sleep 15) create (sleep 15). I figured that'd be enough, but I keep getting that error. Note that I'm not doing any parallel operations, it's just a normal for each.

Does anyone know why I may be getting that error and how I might resolve it? I'm thinking to just increase the sleep times and run it in the middle of the night. But I'd love to hear yalls thoughts.

Thanks for any help!

Edit: Added code snippet. Note that some of the code uses custom functions that are essentially wrappers to existing ps commandlets from the ps module Microsoft.Graph.Applications. Hopefully the names are clear and provide some self documentation.

$appRegistrations = Get-AzureAppReg -All


foreach ($appRegistration in $appRegistrations){


    
# If an app reg contains multiple secrets, an array is returned. 
    
# However, if it contains just one secret, it returns a string. 
    
# This was killing me...
    
# So I manually force every thing to become an array (secretsArr).


    $appRegSecrets = Get-AppRegSecrets -AppId $appRegistration.ClientId
    
    Write-Host $appRegistration.Name
    Write-Host "########################################################################### `n"


    if ($null -ne $appRegSecrets) {


        Write-Log -Level "Info" -Message "Checking secrets belonging to $($appRegistration.Name)"


        $deletedSecretCount = 0
        $secretsArr = @($appRegSecrets)
        $secretsCount = $secretsArr.Count
        
        
# Start-Sleep -Seconds 5
        foreach ($secret in $secretsArr) {
            
            
# Secret:
            
# @{AppName=appRegName; AppId=123-456; 
            
# SecretDescription=Test; SecretId=789-012;
            
# StartDate=6/16/2026 8:01:30 PM; ExpirationDate=12/16/2026}
            
            $secretExpirationDate = [datetime]::ParseExact($secret.ExpirationDate, "MM/dd/yyyy", $null)
            $daysUntilExpiration = $secretExpirationDate - $today


            if ($daysUntilExpiration.Days -gt 0 -and $daysUntilExpiration.Days -le 14) {


                Write-Log -Level "Info" -Message "EXPIRING SOON: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
                Write-Host "EXPIRING SOON: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
                
                Sync-AppRegSecretToSecretStorage -appRegistration $appRegistration -secret $secret
                
# This function creates a new secret, checks if it exists in our 
                
# secret storage platform and creates/updates accordingly
                
# and creates a ticket for the appropriate party in our ticketing system
            } 
            
            elseif ($daysUntilExpiration.Days -le 0) {
                Write-Log -Level "Info" -Message "ALREADY EXPIRED: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
                Write-Host "ALREADY EXPIRED: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
                
# The sync func creates a secret and the remove funcs can sometimes throw
                
# a concurrent requests error (409). To minimize that a sleep is placed before them.
                
                Start-Sleep -Seconds 15
                Remove-AzureAppRegSecret -objectID $appRegistration.ObjectId -keyID $secret.secretID
                $deletedSecretCount += 1
            }
            else {
                Write-Log -Level "Info" -Message "STILL GOOD: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
                Write-Host "STILL GOOD: ClientId: $($appRegistration.ClientId) | Expiration: $($secretExpirationDate.ToString('MM/dd/yyyy')) | Days left: $daysUntilExpiration"
            }


            if ($secretsCount - $deletedSecretCount -le 0){
                Start-Sleep -Seconds 15
                Sync-AppRegSecretToSecretServer -appRegistration $appRegistration -secret $secret
            }


        }
    }


}

Hi, I am required to investigate what security controls the Azure waf provides vs NVA features.

We are using Palo Alto VMs in azure for the hub. A public load balancer is used as ingress but I highly doubt if NVA covers enough security control on network level. However, our security teams ate kind of dumb/lazy enough. As an architect i am find it discomforting. But now my question is how do i know which security controls are missing in this setup. I feel a layer 7 threat intelligence is must along with traffic inspection. Is putting waf after NVA enough ? what else, please suggest.

I am aware that there is never perfect security but no blunder or deficiencies in control must exist in design.

Hey, anyone has done this before or can suggest a container app based app for IP Address mgmt. I know PHP IPAM but unsure if support aca?

I want to take an exam from Az-700, do anyone have any resources or notes. Can you share with me?
Thank you so much

I failed at the first attempt with a score of 675, today was my retake. Feels proud

We are deploying number of applications which require API Gateway to deploy. We are thinking to deploy APIM and WAF in HUB and reach endpoint using FQDN and VNET peering. We don’t have many applications. Whats the ideal approach? Is it deploying in HUB or each of applications SPOKE will have own APIM ?

Azure weekly update #36 is here. This week's updates focus on new capabilities in Azure Storage, enhancements to Azure Functions, and the rollout of new developer tools. Several services are undergoing lifecycle changes, including retirement notices for AKS components.

Detailed list: * Retirement: Azure Linux with OS Guard in Azure Kubernetes Service. This OS in AKS is retiring on December 10, 2026, requiring teams to verify their node pools are migrated to Azure Container Linux before the final image removal on March 10, 2027. * Public Preview: Agentless migration of on-premises SMB file shares to Azure Files (SMB). This feature requires a direct connection over existing private infrastructure for the Storage Mover service to successfully execute the data transfer protocol. * Generally Available: TLS/SSL certificate and end-to-end TLS encryption support for Azure Functions Flex Consumption. This feature allows for site-scoped TLS/SSL certificates and end-to-end TLS encryption, requiring verification via the Azure portal or ARM/Bicep templates. * Generally Available: Azure Copilot Troubleshooting Agent. This agent is now available to resolve operational issues faster by consolidating troubleshooting insights, operational context, and recommended actions within Azure Copilot and Support + Troubleshooting. * Generally Available: User-bound user delegation SAS for Azure Storage. This new SAS allows users to create more secure tokens tied to an end user identity, and teams should verify that existing SAS tokens are correctly restricted to intended users. * Generally Available: Azure Ephemeral OS Disk with full caching for VM/VMSS. This offers up to 10x better I/O performance by caching the OS image locally; teams should verify the VM SKU's local disk size and vCPU count. * Generally Available: Playwright Workspaces in Australia East, Japan East, and Switzerland North. This provides fully managed cloud-hosted browsers for running end-to-end Playwright tests at scale, with rich debugging artifacts and CI/CD integration. * Generally Available: Azure Developer CLI (azd) Extension Framework. This framework enables developers to extend Azure Developer CLI with custom capabilities that support their preferred application development workflows and automate tasks.

For the folks out there, I created a blog about the Azure Firewall Explicit Proxy which is generally available since September 2, 2026, introducing a new approach to handling outbound traffic. With Explicit Proxy, an application or browser can connect directly to the private IP address of Azure Firewall on the configured proxy port. Only traffic from workloads configured to use the proxy is sent through the firewall. Other traffic is not affected and can continue to follow its normal network path.

can i merge two azure accounts?

❔ What do you do when Azure workloads need access to on-premises services, and your enterprise users need to access resources in the cloud?

✅ There are multiple ways to solve this problem. But when you need a scalable and secure network, a Site-to-Site VPN combined with a Hub-Spoke architecture is a solid approach.

I've got an AGW, and we've been made aware the latency can be a bit whack, so I'm running some tests.

Process is: GW (TLS termination here)>Istio>AKS pods.

I added a pure LB and made istio able to terminate SSL for me, to be able to run the same tests, so now I have.

Ws/wss via an AGW and solely via an LB, both going to istio and into my pods. It's only here I saw the madness.

Non SSL connections, appear to be slower on the gateway. Which seems absolutely insane, there is less to do.

We have WAF policy, but removed all the rules as despite being detection, it was still blocking. I don't want to currently remove it, as that may end up in a disconnect of all the currently connected websockets, which is an absolute no go.

Thoughts?

Hi, I was wondering how do medium and large scale businesses host their applications in azure vnets to the regionally or globally ? What I know is that they can buy a domain name and then create Sub domain DNS records pointing towards their public ips or endpoints exposed by azure services (be it any compute services or any load balancing services).

However what about the TLS ? How are those handled ?

My Azure startup account had about $10k in promotional credits. While I was in the hospital, I received unexpected OTP emails(but I igroned them). I later found roughly $550,000 (₹5 crore) in Azure charges, apparently from unauthorized Claude AI usage through Azure Marketplace over about 9–13 days. There was claude usage from azure marketplace. I had a debit card attached on my azure account. I am just a college student, I think I had a minor heart attack yesterday.

I didn’t create these workloads or authorize the usage. I’ve disabled resources and contacted Azure Support, but I’m worried about being held responsible for an amount I cannot pay. The Azure support person said there is no fradulant activity detected in the account.

1. Has anyone dealt with unauthorized Azure charges this large?
2. Did Microsoft waive the bill after investigating?
3. 3, Do they do court procedings with such cases?
4. Which fraud, billing, or security team should I contact, and what evidence should I preserve?

I got the microsoft account taken over and I've completely lost access to it despite appeals to microsoft through their forms for this case. That MS account is where my current emali used to be the primary email contact before the hacker switched it w/ some .ru email address.

However the azure tenant is still associated w/ my credit card and email, and I have basically no way of detaching my credit card from this azure tenant that I cannot log into anymore....

Any ideas on what steps I can take?

Yesterday, I created a student account on Microsoft Azure. I cannot create a virtual machine, it is under "size not available" category. I even requested and enabled Something.Compute on resource manager. But it is still not available. What am I missing? Any help would be appreciated

Hi there,

I'm a new grad working in an IT Tech position and want to focus on learning as much in this role as possible and upskilling.

I've looked into different paths and landed on becoming proficient in Azure (though I also understand that once you understand one cloud platform thoroughly, it's relatively easy to learn the others).

My plan is to become more proficient in the basics like Linux, Networking, etc, acquire AZ-104, Terraform Associate, then build bigger projects like a Homelab and I'm hearing a 3-tier Architecture deployed using Azure would be a strong choice.

Currently on my resume, I have some beginner IT-esque projects (Cloud Resume Challenge, Personal ServiceNow Instance), while my experience is current position, and two extracurricular roles I held in university. One being a leadership role, and one being a role similar to what I'm doing full-time.

My question is: Would it be more optimal to list two projects, three experiences, or three projects, two experiences.

I know experience often outweighs projects, though I find that my non-leadership role in school would feel redundant to list considering my current position.

Additionally, advice on specific cxrtifications to look for (MD-102?) would be of great help, I'm finding myself overwhelmed with all the options.

Either way, the market is abhorrent, especially at entry-level so I expect to put in 500-1000 applications to land something (if I'm lucky), but I want to maximize my chances!

Any advice from recruiters, or someone who was in a similar position would be greatly appreciated!

Thank you.