Writeups from the engineers shipping the code.
Production-grade patterns, post-mortems, and migration playbooks. Real numbers from real engagements, written so a senior engineer at your shop can apply them in a week.
Defender for Cloud Now Covers Serverless Containers: ACA and ACI Posture
Defender CSPM's Serverless Containers component now reaches Azure Container Apps, closing a posture gap we kept hitting on client estates. Here's what changed and what it costs.
Azure WAF Exceptions for Application Gateway and Front Door Go GA
WAF exceptions are now GA on Azure Application Gateway and Front Door. Here is how they differ from exclusions and Allow rules, and how to scope them correctly.
Defender for Cloud's Serverless Containers Posture Finally Covers ACA
Defender CSPM now brings Azure Container Apps into Serverless Containers Posture alongside ACI, closing a real gap in multi-cloud container coverage.
A Terraform Azure Example That Covers State, Providers, and Drift
A working Terraform Azure example with remote state, provider choice, and the drift traps that bite teams after the first apply.
DeepSeek V4 Flash Pricing on Azure AI Foundry: Read the Meter, Not Just the Rate Card
A $1,900 billing dispute shows DeepSeek V4 Flash's cached-token meter diverging sharply from Microsoft's published rate. Here's what the thread says and how to guard against it.
Terraform in Azure DevOps: Pipeline State, Drift, and What Actually Breaks
Running Terraform through Azure DevOps requires more than a YAML wrapper around plan and apply. This field note covers backend config, workload identity, and the pipeline patterns we use in production.
Kimi K2 Thinking: Evaluating a Trillion-Parameter Reasoning Model
Kimi K2 Thinking is an open-source trillion-parameter reasoning model from Moonshot AI. Here is how we assess it and wire it into agentic pipelines before trusting it with production workloads.
Azure Landing Zone Accelerator: What It Deploys and Where It Hurts
The Azure Landing Zone Accelerator gives you a CAF-aligned multi-subscription scaffold in one shot. Here is what it actually creates, where it breaks, and how to extend it safely.
Microsoft Purview Login: The Two-Plane Auth Problem and How to Solve It
Getting into purview.microsoft.com is half the fight. Covers Entra ID RBAC, Collection roles, service principal auth, and Conditional Access gaps that silently block catalog access.
DeepSeek V4 Flash 0731: What We Know and How to Evaluate It
DeepSeek V4 Flash 0731 landed mid-summer as the lighter sibling to V4 Pro. Here is how to evaluate it before betting a production workload on it.
Microsoft Purview Pricing: Two Bills, One Platform, No Clear Map
Microsoft Purview bundles two historically separate products with different billing models. Here is how to read both bills before you commit.
Claude Code MCP: Wiring External Tools Into Your Engineering Loop
Model Context Protocol turns Claude Code into a multi-tool agent that can query APIs, databases, and CI systems. Here is how to register and secure MCP servers in production.
What Microsoft Purview Actually Is, and What It Is Not
Microsoft Purview covers two distinct product families under one brand. Understanding the split before you buy or deploy saves months of rework.
Gemini 3.1 Pro: Evaluation Notes Before You Commit to Production
The Gemini 3 family has expanded fast across Flash, Pro, and Deep Think tiers. Here is how we evaluate the Pro variant before routing production traffic to it on Vertex AI.
Microsoft Purview Message Encryption: What Actually Works in Production
Purview Message Encryption replaces classic OME with sensitivity-label-driven controls. Here is how to configure it, audit it, and stop it from breaking partner mail flows.
AI Agent Platforms for Engineering Teams: Infrastructure Over Hype
Most teams pick a coding agent and miss the platform layer. Here is how we scope, wire, and cost-model the infrastructure that makes agents survive a real codebase.
MiniMax M2.5: 80.2% SWE-bench Verified and How to Actually Test It
MiniMax M2.5 posts 80.2% on SWE-bench Verified, putting it in contention for agentic coding pipelines. Here is how to evaluate it against your real workloads before committing.
MiniMax M2.1 for Coding and Complex Tasks: An Honest Field Evaluation
MiniMax M2.1 targets multi-language programming and real-world reasoning. Here is how to evaluate it honestly and where it fits in an agent stack.
Microsoft Purview DLP: From Policy Noise to Detection That Holds
Most Purview DLP deployments generate alert volume without detection value. Here is how we scope, tune, and wire signals into Sentinel so they mean something.
Defender for Cloud Pricing: What the Azure Portal Doesn't Tell You
Defender for Servers Plan 2 is about $14.60 per server a month and Containers $6.87 per vCore. 2026 list prices per plan, and where the bill balloons.
Microsoft Defender for Cloud: From Licensed to Operational
Most Azure tenants have Defender for Cloud enabled but not working. Here is how we close that gap and get real signal into Defender XDR and Sentinel.
Microsoft Purview Information Protection: What Actually Ships vs. What Demos
A field guide to deploying Purview sensitivity labels and auto-labeling at scale. Covers label taxonomy, DLP tuning, Sentinel correlation, and the gaps Microsoft won't put in a slide deck.
Defender for Cloud Apps: What Actually Works in Production
A field engineer's view of MDCA deployment, session policy pitfalls, and KQL detections that catch what the defaults miss. Real config, real numbers.
Azure Log Analytics Workspace: What Nobody Warns You About
LAW is not just a data sink. How you design tables, DCRs, and retention tiers determines whether you get actionable signal or a five-figure monthly bill.
Azure Landing Zone Architecture: What We Actually Deploy
Most teams treat Azure landing zones as a checkbox. This field note covers the hierarchy, policy, and network decisions that determine whether your zone holds up under production load.
Azure Log Analytics Workspace Pricing: What Actually Drives Your Bill
Log Analytics Workspace billing has three independent meters running at once. Knowing which one dominates your spend is the first step to controlling it.
Azure Sentinel and GitHub: Detection-as-Code That Actually Ships
Wire GitHub audit logs into Microsoft Sentinel and manage your KQL analytics rules as versioned Bicep, deployed via GitHub Actions. No more portal drift.
Microsoft Sentinel Certification: What SC-200 Tests vs. What You Need
SC-200 is the exam that actually validates Sentinel depth, but passing it and operating a production workspace are different skills. Here is what the gap looks like.
KQL Query Examples for Threat Detection in Microsoft Sentinel
Production-tested KQL patterns for Sentinel detection engineering: join cost, time-series baselining, lateral movement detection, and where AI-to-KQL tooling actually helps.
Azure Sentinel Training That Actually Produces Detection Engineers
Most Sentinel training stops at dashboards and query basics. Here is the path that turns analysts into engineers who write, tune, and own detections at scale.
Microsoft Sentinel SIEM: What We've Learned Deploying It in Production
Microsoft Sentinel (formerly Azure Sentinel) is a capable cloud-native SIEM, but ingestion costs and workspace design decisions made early will determine whether it stays affordable. Here's what to get right upfront.
What Is Microsoft Sentinel: A SIEM You Actually Operate in Production
Microsoft Sentinel is a cloud-native SIEM and SOAR built on Log Analytics. Here is what it costs, how it ingests data, and where it breaks in the real world.
Microsoft Purview Compliance Portal: What Actually Works in Production
The Purview compliance portal moved to purview.microsoft.com. Where DLP, eDiscovery and audit now live, the licensing walls, and what works in production.
Azure Log Analytics Workspace: Design Decisions That Matter at Scale
A Log Analytics Workspace is the foundation of every Azure monitoring and SIEM deployment. Get the workspace topology and cost controls wrong early and you pay for it for years.
Microsoft Sentinel Training: What Actually Matters in the Field
Most Sentinel courses teach the portal tour. This field note covers what engineers need to operate Sentinel at production scale: KQL, rule testing, cost control, and detection gaps.
Microsoft Sentinel Pricing in 2026: What You Actually Pay and How to Cut It
Sentinel costs $4.30/GB pay-as-you-go in East US. Commitment tiers cut that to $2.05 to $3.23. Free sources, the $0.15/GB data lake, and a KQL cost query.
Terraform Azure Storage Accounts: Footguns and Production Config
The azurerm_storage_account resource ships with permissive defaults on every security-relevant attribute. Here is how we configure it correctly before production.
Azure Sentinel Connectors: What Actually Works in Production
Getting data into Microsoft Sentinel is where most SIEM rollouts quietly fail. This field note covers connector types, AMA migration pitfalls, and DCR routing that holds up under real ingestion load.
Microsoft Sentinel leaves the Azure portal on March 31, 2027: what breaks and what to do first
Microsoft moved the Sentinel Azure portal retirement from July 2026 to March 31, 2027. What changes in the Defender portal, what breaks, and the order to fix it.
Migrating Azure Sentinel off MMA: a field guide for production environments
MMA retires August 2024. Here's the AMA + DCR/DCE pattern we used to move fourteen custom connectors with zero ingestion gaps and half the operating cost.
Six AI-agent and RAG patterns we keep yanking out of production
Vector retrieval that returns garbage, prompt injection by way of a CSV upload, runaway token bills. Patterns to avoid, with the fix that actually shipped.