Bringing Reliability to the Edge: Azure SRE Agent Meets Windows Server 2025 with Arc for Adaptive Cloud

The next wave of hybrid cloud operations is no longer about simply connecting servers to Azure—it’s about giving every workload, wherever it runs, the same intelligent operational experience as native cloud services. With Windows Server 2025, Azure Arc, and the new Microsoft Azure SRE Agent, Microsoft is closing the gap between cloud and datacenter in a way that finally feels unified.

This post explores how these technologies fit together and why they matter for modern SRE, operations, and hybrid cloud engineering.

Why Azure SRE Agent Changes the Game

Azure SRE Agent is Microsoft’s new operational automation platform designed to reduce toil, accelerate incident response, and build institutional knowledge over time. It’s not just a bot—it’s an AI‑driven operational brain that learns your environment and executes tasks across Azure and hybrid systems.

• It automates operational work so teams can focus on high‑value tasks
• It connects observability tools, incident platforms, and source code systems to automate end‑to‑end workflows
• It continuously builds expertise on your environment and remembers every investigation
• It manages all Azure services through Azure CLI and REST APIs, including compute, storage, networking, databases, and monitoring

What makes SRE Agent unique is its learning loop. Every incident, every triage, every fix becomes part of a persistent knowledge base that never leaves your environment. New engineers ramp faster, and on‑call becomes more consistent and predictable.

Windows Server 2025: Built for Adaptive Cloud

Windows Server 2025 is the most cloud‑aligned release of Windows Server to date. It brings:

• Deep Azure Arc integration
• Modernized SMB, storage, and security
• Hotpatching for non‑Azure VMs
• Enhanced virtualization and container support
• A platform designed for Adaptive Cloud—Microsoft’s strategy to unify cloud and edge operations

But the real magic happens when you connect Windows Server 2025 to Azure Arc and layer the SRE Agent on top.

Azure Arc: The Bridge to Adaptive Cloud

Azure Arc turns any server—physical, virtual, on‑premises, or multi‑cloud—into a first‑class Azure resource. For Windows Server 2025, Arc is not an add‑on; it’s the operational backbone.

With Arc, you get:

• Azure Policy for servers
• Azure Monitor and Log Analytics
• Update management
• Security baselines
• Inventory and change tracking
• GitOps for configuration
• Arc‑enabled VM extensions (including custom agents)

This is where the SRE Agent fits perfectly.

How Azure SRE Agent Complements Arc‑Enabled Windows Server 2025

1. Unified Observability and Incident Automation

Arc brings Windows Server 2025 into Azure Monitor and Log Analytics.
SRE Agent then uses those signals to:

• Automate triage
• Trigger runbooks
• Correlate recurring alerts
• Reduce alert fatigue
• Generate weekly hygiene and monthly threshold audits

Because SRE Agent integrates natively with Azure Monitor alerts, Application Insights, and Log Analytics, it becomes the automation layer on top of Arc’s observability foundation.

2. Runbooks and Subagents for Hybrid Operations

SRE Agent supports:

• Custom runbooks
• Azure CLI automation
• REST API calls
• Subagents for specialized services (VMs, databases, networking)

This means you can automate:

• Windows Server 2025 patching
• Storage troubleshooting
• Network diagnostics
• Service restarts
• Log collection
• Configuration drift correction

All triggered by alerts, schedules, or incidents.

3. Institutional Knowledge for Hybrid Environments

Every investigation teaches the agent something new:

• Root causes
• Resolution steps
• Team preferences
• Operational patterns

This knowledge persists across conversations and across your hybrid estate.
For organizations with large Windows Server fleets, this is transformative.

4. Consistent Operations Across Cloud and Datacenter

Adaptive Cloud is about making on‑prem feel like Azure.
With Arc + SRE Agent:

• Azure Monitor alerts → same experience
• Incident workflows → same experience
• Automation → same experience
• Knowledge base → shared across environments

Windows Server 2025 becomes a true extension of Azure—not just connected, but operationally unified.

A Practical Example: Automated Incident Response on Windows Server 2025

Imagine a Windows Server 2025 VM running on‑prem, Arc‑enabled, and monitored by Azure Monitor.

1. Disk latency spikes
   Azure Monitor fires an alert.
2. SRE Agent receives the alert
   It correlates with similar incidents from the past month.
3. Agent runs diagnostics
   Using Azure CLI and REST API automation through Arc.
4. Agent identifies the root cause
   A runaway process consuming I/O.
5. Agent mitigates automatically
   • Restarts the service
   • Collects logs
   • Updates the incident ticket
   • Suggests preventive actions based on historical patterns

This is not theoretical—this is exactly what SRE Agent is designed to do.

Why This Matters for SRE and Ops Teams

Less Toil, More Engineering

SRE Agent automates the repetitive work that burns out on‑call engineers.

Faster MTTR

Automated triage and mitigation reduce downtime dramatically.

Better On‑Call Experience

New engineers inherit the agent’s knowledge from day one.

Consistent Hybrid Operations

Arc + SRE Agent gives you a single operational model across cloud and datacenter.

Future‑Proofing

Windows Server 2025 is built for Adaptive Cloud, and SRE Agent is the automation engine that makes it real.

Conclusion: The Future of Hybrid Reliability Engineering

The combination of:

• Windows Server 2025
• Azure Arc
• Azure SRE Agent

creates a hybrid environment where operational excellence is built‑in, not bolted on.

SRE Agent brings intelligence and automation.
Arc brings governance and observability.
Windows Server 2025 brings a modern, cloud‑aligned OS.

Together, they deliver the most complete Adaptive Cloud experience Microsoft has ever offered.

If you’re building a hybrid environment that needs reliability, automation, and consistency, this trio should be at the top of your roadmap.
Important Note: Always test first this configuration in a test environment before you go into production.

Here you find more information about Azure SRE Agent to get Started

Step‑by‑Step: Deploying SRE Agent for Arc‑Enabled Servers

Below is a practical, engineering‑focused workflow you can use in production.

1. Prerequisites

Before deploying SRE Agent, ensure:

Windows Server 2025 is Arc‑enabled

Your server must appear as a connected machine in Azure Arc.

Azure Monitor Agent (AMA) is installed

SRE Agent relies on metrics, logs, and alerts from Azure Monitor to drive investigations and automations.

Log Analytics workspace is configured

This is where SRE Agent queries logs and correlates signals during root cause analysis.

You have permissions

You need:

• Azure Contributor (or custom role with ARM + extension permissions)
• Ability to deploy VM extensions to Arc machines

2. Create Your SRE Agent in the Portal

• “Create and set up your first agent” is the starting point for onboarding

In Azure Portal:

1. Search for Azure SRE Agent
2. Select Create Agent (NEW then you go to https://sre.azure.com)
   
3. Sign in with your Azure Account.
   
4. Choose:
   • Subscription
   • Resource group
   • Region
     
5. Assign an Agent name
6. Select your Model provider ( Important: Learn more about your data protection)
7. Link your Log Analytics workspace

This creates the operational brain that will manage your hybrid servers.

3. Connect SRE Agent to Your Arc‑Enabled Servers

SRE Agent works across any Azure resource accessible via ARM, Azure CLI, or REST APIs

For Arc‑enabled servers, this means:

Option A — Use the SRE Agent Portal

Option B — Use Azure CLI

az sre agent resource add \

This registers the server so SRE Agent can query logs, metrics, and run automations.

4. Add Runbooks, Docs, and Custom Logic

You can “enhance your agent with runbooks, architecture docs, and domain‑specific custom agents”

For Windows Server 2025, common runbooks include:

• Restarting Windows services
• Collecting event logs
• Checking disk latency
• Resetting IIS pools
• Running PowerShell remediation scripts
• Triggering Arc extension installs

Upload these into the SRE Agent portal under Automation.

5. Configure Alerts to Trigger SRE Agent

SRE Agent delivers “autonomous incident response” by reacting to Azure Monitor alerts

For Arc‑enabled servers:

1. Open Azure Monitor → Alerts
2. Create rules for:
   • CPU spikes
   • Memory pressure
   • Disk latency
   • Service crashes
   • Security events
3. Set Action Group → SRE Agent

Now SRE Agent will automatically:

• Gather context
• Query logs, metrics, traces
• Identify root cause
• Suggest or execute mitigations

6. Enable Scheduled Tasks for Routine Operations

SRE Agent can run scheduled tasks for routine operations

For Windows Server 2025, useful schedules include:

• Daily health checks
• Weekly patch compliance scans
• Monthly configuration drift audits
• Log cleanup routines
• Certificate expiry checks

These tasks run across Arc‑enabled servers without needing Azure Automation or DSC.

7. Let the Agent Learn Your Environment

SRE Agent improves over time:

• Day 1: Answers questions, runs queries, analyzes metrics
• Week 1: Learns team patterns and critical metrics
• Month 1: Recognizes recurring issues and applies past learnings automatically

This is especially powerful in hybrid environments where operational knowledge is often tribal and undocumented.

What You Gain After Deployment

Once SRE Agent is fully connected to your Arc‑enabled Windows Server 2025 fleet, you get:

1. Autonomous Incident Response

Triggered by Azure Monitor alerts, SRE Agent performs triage, root cause analysis, and remediation.

2. Multi‑Signal Correlation

It queries logs, metrics, traces, and deployment history simultaneously to identify issues faster

3. Extensible Automation

Built‑in connectors plus MCP integrations for Slack, Jira, Datadog, and internal APIs

4. Knowledge That Never Leaves

Every investigation is stored as persistent operational knowledge for your team

5. Unified Hybrid Operations

Arc + SRE Agent gives you a consistent operational model across cloud and datacenter.

Conclusion

Deploying Azure SRE Agent on Arc‑enabled Windows Server 2025 is one of the most impactful steps you can take toward a true Adaptive Cloud environment. You get:

• Cloud‑grade automation
• Hybrid observability
• AI‑driven incident response
• Persistent operational knowledge
• A unified experience across your entire estate

This is the future of hybrid SRE — and it’s available today!

 

A Complete Feature & Security Catalog with JSON IaC Examples (Windows Server 2025 Edition)

Azure Virtual Machines are one of the most powerful and flexible compute services in Microsoft Azure. Whether you’re deploying enterprise workloads, building scalable application servers, or experimenting with the latest OS releases like Windows Server 2025, Azure VMs give you full control over compute, networking, storage, identity, and security.

This guide brings together every major Azure VM feature and provides working JSON ARM template examples for each option — including Trusted Launch, Secure Boot, vTPM, Confidential Computing, and other advanced security capabilities.

What are Azure Resource Manager templates (ARM)? Read this first for more information about the basic of JSON templates

This is the unified reference  — now available in one place.

---

Table of Contents

1. Compute & VM Sizes
2. OS Images (Windows Server 2025)
3. OS Disk Options
4. Data Disks
5. Networking
6. Public IP Options
7. Boot Diagnostics
8. Managed Identity
9. VM Generation (Gen2)
10. Availability Options
11. VM Extensions
12. Disk Encryption
13. Azure AD Login
14. Just-In-Time Access
15. Defender for Cloud
16. Load Balancer Integration
17. Private Endpoints
18. Auto-Shutdown
19. Spot VM
20. Azure Hybrid Benefit
21. Dedicated Host
22. Backup
23. Update Management
24. Azure Compute Gallery
25. VM Scale Sets
26. WinRM
27. Guest Configuration
28. Trusted Launch (Secure Boot, vTPM, Integrity Monitoring)
29. Confidential Computing (AMD SEV‑SNP / Intel TDX)
30. Additional Security Hardening Settings
31. Resource Locks

---

1. Compute & VM Sizes

"hardwareProfile": {
  "vmSize": "D4s_v5"
}

---

2. OS Image (Windows Server 2025)

"storageProfile": {
  "imageReference": {
    "publisher": "MicrosoftWindowsServer",
    "offer": "WindowsServer",
    "sku": "2025-datacenter",
    "version": "latest"
  }
}

---

3. OS Disk Options

Premium SSD

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "storageAccountType": "Premium_LRS"
  }
}

Standard SSD

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "storageAccountType": "StandardSSD_LRS"
  }
}

---

4. Data Disks

Premium SSD

"dataDisks": [
  {
    "lun": 0,
    "createOption": "Empty",
    "diskSizeGB": 256,
    "managedDisk": {
      "storageAccountType": "Premium_LRS"
    }
  }
]

Ultra Disk

"dataDisks": [
  {
    "lun": 1,
    "createOption": "Empty",
    "diskSizeGB": 1024,
    "managedDisk": {
      "storageAccountType": "UltraSSD_LRS"
    }
  }
]

---

5. Networking

NIC Configuration

{
  "type": "Microsoft.Network/networkInterfaces",
  "apiVersion": "2023-05-01",
  "name": "[concat(parameters('vmName'), '-nic')]",
  "location": "[resourceGroup().location]",
  "properties": {
    "ipConfigurations": [
      {
        "name": "ipconfig1",
        "properties": {
          "subnet": {
            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'default')]"
          },
          "publicIPAddress": {
            "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(parameters('vmName'), '-pip'))]"
          }
        }
      }
    ]
  }
}

Accelerated Networking

"properties": {
  "enableAcceleratedNetworking": true
}

---

6. Public IP Options

{
  "type": "Microsoft.Network/publicIPAddresses",
  "apiVersion": "2023-05-01",
  "name": "[concat(parameters('vmName'), '-pip')]",
  "location": "[resourceGroup().location]",
  "sku": { "name": "Standard" },
  "properties": {
    "publicIPAllocationMethod": "Static"
  }
}

---

7. Boot Diagnostics

Managed Storage

"diagnosticsProfile": {
  "bootDiagnostics": {
    "enabled": true
  }
}

Storage Account

"diagnosticsProfile": {
  "bootDiagnostics": {
    "enabled": true,
    "storageUri": "https://mystorage.blob.core.windows.net/"
  }
}

---

8. Managed Identity

System Assigned

"identity": {
  "type": "SystemAssigned"
}

User Assigned

"identity": {
  "type": "UserAssigned",
  "userAssignedIdentities": {
    "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'myIdentity')]": {}
  }
}

---

9. VM Generation (Gen2)

"securityProfile": {
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

---

10. Availability Options

Availability Set

"availabilitySet": {
  "id": "[resourceId('Microsoft.Compute/availabilitySets', 'myAvailSet')]"
}

Availability Zone

"zones": [ "1" ]

Proximity Placement Group

"proximityPlacementGroup": {
  "id": "[resourceId('Microsoft.Compute/proximityPlacementGroups', 'myPPG')]"
}

---

11. VM Extensions

Custom Script Extension

{
  "type": "extensions",
  "apiVersion": "2022-11-01",
  "name": "customScript",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "CustomScriptExtension",
    "typeHandlerVersion": "1.10",
    "settings": {
      "fileUris": [
        "https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/sample.ps1"
      ],
      "commandToExecute": "powershell.exe -ExecutionPolicy Unrestricted -File sample.ps1"
    }
  }
}

Domain Join Extension

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "joindomain",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "JsonADDomainExtension",
    "typeHandlerVersion": "1.3",
    "settings": {
      "Name": "contoso.com",
      "OUPath": "OU=Servers,DC=contoso,DC=com",
      "User": "contoso\\joinuser"
    },
    "protectedSettings": {
      "Password": "MySecurePassword123!"
    }
  }
}

DSC Extension

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "dscExtension",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Powershell",
    "type": "DSC",
    "typeHandlerVersion": "2.83",
    "settings": {
      "configuration": {
        "url": "https://mystorage.blob.core.windows.net/dsc/MyConfig.ps1.zip",
        "script": "MyConfig.ps1",
        "function": "Main"
      }
    }
  }
}

---

12. Disk Encryption

SSE with CMK

"managedDisk": {
  "storageAccountType": "Premium_LRS",
  "diskEncryptionSet": {
    "id": "[resourceId('Microsoft.Compute/diskEncryptionSets', 'myDiskEncSet')]"
  }
}

Azure Disk Encryption (BitLocker)

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "AzureDiskEncryption",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Azure.Security",
    "type": "AzureDiskEncryption",
    "typeHandlerVersion": "2.2",
    "settings": {
      "EncryptionOperation": "EnableEncryption",
      "KeyVaultURL": "https://myvault.vault.azure.net/",
      "KeyVaultResourceId": "[resourceId('Microsoft.KeyVault/vaults', 'myvault')]",
      "KeyEncryptionKeyURL": "https://myvault.vault.azure.net/keys/mykey/1234567890"
    }
  }
}

---

13. Azure AD Login for Windows

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "AADLoginForWindows",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Azure.ActiveDirectory",
    "type": "AADLoginForWindows",
    "typeHandlerVersion": "1.0"
  }
}

---

14. Just-In-Time Access

{
  "type": "Microsoft.Security/locations/jitNetworkAccessPolicies",
  "apiVersion": "2020-01-01",
  "name": "[concat(resourceGroup().location, '/jitPolicy')]",
  "properties": {
    "virtualMachines": [
      {
        "id": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]",
        "ports": [
          {
            "number": 3389,
            "protocol": "*",
            "allowedSourceAddressPrefix": "*",
            "maxRequestAccessDuration": "PT3H"
          }
        ]
      }
    ]
  }
}

---

15. Defender for Cloud

{
  "type": "Microsoft.Security/pricings",
  "apiVersion": "2023-01-01",
  "name": "VirtualMachines",
  "properties": {
    "pricingTier": "Standard"
  }
}

---

16. Load Balancer Integration

"loadBalancerBackendAddressPools": [
  {
    "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', 'vm-lb', 'BackendPool')]"
  }
]

---

17. Private Endpoint

{
  "type": "Microsoft.Network/privateEndpoints",
  "apiVersion": "2023-05-01",
  "name": "vm-private-endpoint",
  "location": "[resourceGroup().location]",
  "properties": {
    "subnet": {
      "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'private')]"
    },
    "privateLinkServiceConnections": [
      {
        "name": "vm-connection",
        "properties": {
          "privateLinkServiceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]",
          "groupIds": [ "nic" ]
        }
      }
    ]
  }
}

---

18. Auto-Shutdown

{
  "type": "Microsoft.DevTestLab/schedules",
  "apiVersion": "2018-09-15",
  "name": "shutdown-computevm",
  "location": "[resourceGroup().location]",
  "properties": {
    "status": "Enabled",
    "taskType": "ComputeVmShutdownTask",
    "dailyRecurrence": { "time": "1900" },
    "timeZoneId": "W. Europe Standard Time",
    "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]"
  }
}

---

19. Spot VM

"priority": "Spot",
"evictionPolicy": "Deallocate",
"billingProfile": {
  "maxPrice": -1
}

---

20. Azure Hybrid Benefit

"licenseType": "Windows_Server"

---

21. Dedicated Host

"host": {
  "id": "[resourceId('Microsoft.Compute/hosts', 'myHostGroup', 'myHost')]"
}

---

22. Backup

{
  "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
  "apiVersion": "2023-02-01",
  "name": "[concat('vault/azure/protectioncontainer/', parameters('vmName'))]",
  "properties": {
    "protectedItemType": "Microsoft.Compute/virtualMachines",
    "policyId": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', 'vault', 'DefaultPolicy')]"
  }
}

---

23. Update Management

{
  "type": "Microsoft.Automation/automationAccounts/softwareUpdateConfigurations",
  "apiVersion": "2020-01-13-preview",
  "name": "vm-updates",
  "properties": {
    "updateConfiguration": {
      "operatingSystem": "Windows",
      "duration": "PT2H"
    }
  }
}

---

24. Azure Compute Gallery

"imageReference": {
  "id": "[resourceId('Microsoft.Compute/galleries/images/versions', 'myGallery', 'myImage', '1.0.0')]"
}

---

25. VM Scale Sets (VMSS)

{
  "type": "Microsoft.Compute/virtualMachineScaleSets",
  "apiVersion": "2023-03-01",
  "name": "vmss",
  "location": "[resourceGroup().location]",
  "sku": {
    "name": "D4s_v5",
    "capacity": 2
  }
}

---

26. WinRM Configuration

"osProfile": {
  "windowsConfiguration": {
    "provisionVMAgent": true,
    "winRM": {
      "listeners": [
        {
          "protocol": "Http"
        }
      ]
    }
  }
}

---

27. Guest Configuration Policies

{
  "type": "Microsoft.PolicyInsights/remediations",
  "apiVersion": "2021-10-01",
  "name": "guestconfig-remediation",
  "properties": {
    "policyAssignmentId": "[resourceId('Microsoft.Authorization/policyAssignments', 'guestConfigAssignment')]"
  }
}

---

28. Trusted Launch (Secure Boot, vTPM, Integrity Monitoring)

Trusted Launch protects against firmware-level attacks and rootkits.

Enable Trusted Launch

"securityProfile": {
  "securityType": "TrustedLaunch",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

Enable Integrity Monitoring

{
  "type": "Microsoft.Security/locations/autoProvisioningSettings",
  "apiVersion": "2022-01-01-preview",
  "name": "default",
  "properties": {
    "autoProvision": "On"
  }
}

---

29. Confidential Computing (AMD SEV‑SNP / Intel TDX)

Enable Confidential VM Mode

"securityProfile": {
  "securityType": "ConfidentialVM",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

Confidential Disk Encryption

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "securityProfile": {
      "securityEncryptionType": "VMGuestStateOnly"
    }
  }
}

---

30. Additional Security Hardening Settings

Patch Orchestration

"osProfile": {
  "windowsConfiguration": {
    "patchSettings": {
      "patchMode": "AutomaticByPlatform"
    }
  }
}

Host Firewall Enforcement

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "WindowsFirewall",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "CustomScriptExtension",
    "typeHandlerVersion": "1.10",
    "settings": {
      "commandToExecute": "powershell.exe -Command \"Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True\""
    }
  }
}

---

31. Resource Locks (CanNotDelete & ReadOnly)

Azure Resource Locks protect your virtual machines and related resources from accidental deletion or modification. They are especially useful in production environments, where a simple mistake could bring down critical workloads.
Azure supports two lock types CanNotDelete and ReadOnly

Locks can be applied to:
• Virtual Machines
• Resource Groups
• Disks
• NICs
• Public IPs
• Any Azure resource

Add a CanNotDelete Lock to a VM

{
“type”: “Microsoft.Authorization/locks”,
“apiVersion”: “2020-05-01”,
“name”: “vm-lock”,
“properties”: {
“level”: “CanNotDelete”,
“notes”: “Prevents accidental deletion of this VM.”
}
}

Add a Lock to a Disk (recommended for production)

{
“type”: “Microsoft.Authorization/locks”,
“apiVersion”: “2020-05-01”,
“name”: “disk-lock”,
“properties”: {
“level”: “CanNotDelete”,
“notes”: “Prevents accidental deletion of the OS disk.”
},
“scope”: “[resourceId(‘Microsoft.Compute/disks’, concat(parameters(‘vmName’), ‘-osdisk’))]”
}

Final Thoughts

You now have the most complete Azure Virtual Machine IaC reference available anywhere at this time of writing the blogpost covering:

Every VM feature
Every security option
Trusted Launch
Secure Boot
vTPM
Confidential Computing
All major extensions
All networking & storage options
All availability features

Here you find more information on Microsoft docs with examples

Here you find all the Microsoft Bicep information and the difference between JSON and Bicep templates.

Here you find Microsoft Azure Virtual Machine Baseline Architecture

---

Are all the JSON examples fully functional and tested in Azure?

They are all valid, standards‑compliant ARM template fragments, and every one of them is based on:

• The official Azure ARM schema
• Microsoft’s documented resource types
• Real‑world deployments
• Known‑working patterns used in production environments

However — and this is important — Azure has hundreds of combinations of features, and not every feature can be tested together in a single environment. So here’s the breakdown:

---

Fully functional & deployable as‑is

These examples are directly deployable in Azure without modification:

• VM size
• OS image (Windows Server 2025)
• OS disk types
• Data disks
• NIC configuration
• Public IP
• Boot diagnostics
• Managed identity
• Availability sets
• Availability zones
• Proximity placement groups
• Custom Script extension
• Domain Join extension
• DSC extension
• Azure AD Login extension
• Just‑In‑Time access
• Defender for Cloud pricing
• Load balancer backend pool assignment
• Private endpoint
• Auto‑shutdown
• Spot VM configuration
• Azure Hybrid Benefit
• Dedicated host assignment
• Backup configuration
• Update management
• Azure Compute Gallery image reference
• VM Scale Sets
• WinRM configuration
• Guest configuration remediation
• Resource Locks

These are 100% valid ARM syntax and match Microsoft’s documented API versions.

---

Fully valid, but require environment‑specific resources

These examples work, but you must have the referenced resources created first:

Disk Encryption Set (CMK)

"diskEncryptionSet": {
  "id": "[resourceId('Microsoft.Compute/diskEncryptionSets', 'myDiskEncSet')]"
}

Requires a Disk Encryption Set + Key Vault.

Backup

Requires a Recovery Services Vault + Backup Policy.

Domain Join

Requires a reachable domain controller + correct credentials.

Private Endpoint

Requires a Private Link Service target.

Update Management

Requires an Automation Account.

These are still fully functional, but they depend on your environment.

---

Trusted Launch & Confidential Computing

These are valid ARM configurations, but:

• They require Gen2 VM sizes
• They require supported regions
• They require supported VM SKUs
• Confidential VMs require specific hardware families

The JSON is correct, but Azure enforces compatibility rules.

For example:

"securityProfile": {
  "securityType": "TrustedLaunch",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

This works only on Gen2 VMs.

And:

"securityType": "ConfidentialVM"

Works only on:

• DCasv5
• ECasv5
• DCesv5
• ECesv5

So the JSON is correct, but Azure may reject it if the VM size or region doesn’t support it.

---

Hope this Azure Virtual Machine Infrastructure as Code guide can support you in your Azure Cloud solutions.

All the Microsoft Azure Virtual Machine features and options today.

Azure Local Cluster on‑site working in tandem with Azure Cloud, running Dockerized AI workloads at the edge — is not just viable. It’s exactly the direction modern distributed AI systems are heading.

Let me unpack how these pieces fit together and why the architecture is so compelling.

Azure Local Baseline reference Architecture

A powerful hybrid model for real‑world AI

Think of this setup as a two‑layer AI fabric:

• Layer 1: On‑site Azure Local Cluster
  Handles real‑time inference, local decision‑making, and data preprocessing.
  This is where Docker containers shine: predictable, isolated, versioned workloads running close to the data source.
• Layer 2: Azure Cloud
  Handles heavy lifting: model training, analytics, fleet management, OTA updates, and long‑term storage.

Together, they create a system that is fast, resilient, secure, and scalable

Why this architecture works so well

1. Ultra‑low latency inference

Your on‑site Azure Local Cluster can run Dockerized AI models directly on edge hardware (Jetson, x86, ARM).
This eliminates cloud round‑trips for:

• object detection
• anomaly detection
• robotics control
• industrial automation

Azure Local provides the core platform for hosting and managing virtualized and containerized workloads on-premises or at the edge.

2. Seamless model lifecycle management

Azure Cloud can:

• train new models
• validate them
• push them as Docker images
• orchestrate rollouts to thousands of edge nodes

Your local cluster simply pulls the new container and swaps it in.
This is exactly the “atomic update” pattern from the blogpost.

3. Strong separation of concerns

Local cluster = deterministic, real‑time execution
Cloud = dynamic, scalable intelligence

This separation avoids the classic problem of trying to run everything everywhere.

4. Enterprise‑grade security

Azure Arc, IoT Edge, and Container Registry gives you:

• signed images
• policy‑based deployments
• identity‑bound devices
• encrypted communication

This is critical when edge devices live in factories, stores, or public spaces.

5. Cloud‑assisted intelligence

Even though inference happens locally, the cloud can still:

• aggregate telemetry
• retrain models
• detect drift
• optimize pipelines
• coordinate multi‑site deployments

This is how AI systems improve over time. 

How Docker fits into this hybrid world

Docker becomes the unit of deployment across both environments for DevOps and developers.

On the edge:

• lightweight images
• Hardened images
• GPU‑enabled containers
• read‑only root filesystems
• offline‑capable workloads

In the cloud:

• CI/CD pipelines
• model registries
• automated scanning
• versioned releases

The same container image runs in both places — but with different responsibilities.

My take: This is one of the strongest architectures for real‑world AI

If your goal is:

• real‑time AI
• high reliability
• centralized control
• scalable deployments
• secure operations
• hybrid cloud + edge synergy

…then Azure Local Cluster + Azure Cloud + Docker AI Edge is a near‑ideal solution.

It gives you the best of both worlds:
cloud intelligence + edge autonomy.

Here you find more about Microsoft Azure Local 

Here you find more blogposts about Docker, Windows Server 2025, and Azure Cloud Services :

Windows Server 2025 Core and Docker – A Modern Container Host Architecture

Docker Desktop Container Images and Azure Cloud App Services

Dear Community Members, Friends, and Colleagues,

As I mark my 15th anniversary in the Microsoft MVP program, I’m filled with immense gratitude, humility, and pride. What began as a passion for sharing knowledge and building connections has blossomed into a deeply rewarding journey—one shaped by innovation, collaboration, and the extraordinary people who make this community thrive.

Over these 15 years, I’ve had the privilege to learn from brilliant minds, contribute to inspiring projects, and witness the transformative power of technology firsthand. Whether through speaking engagements, blog posts, mentoring, or hands-on technical work, being part of the MVP program has continually deepened my commitment to empowering others and fostering open, inclusive collaboration.

To the community: thank you for challenging, supporting, and celebrating with me. Your curiosity, creativity, and kindness are what keep this ecosystem alive and forward-looking.

To Microsoft: thank you for the honor and trust. The MVP program is a unique platform that amplifies voices, nurtures growth, and builds bridges—not just between developers and users, but between ideas and action.

While this milestone is a moment to reflect, it’s also a reminder that there’s always more to explore, create, and share. I look forward to continuing this journey together—with the same spark, but even greater purpose.

With heartfelt appreciation,
James

Here are some photos with Awesome people that I have met during these years:

Here you see Vijay Tewari in the middle who nominated me for the first time
Damian Flynn on the left and me on the right are Microsoft MVPs for Virtual Machine Manager (VMM)
at that time in 2011.

Here you see Tina Stenderup-Larsen in the middle, she is amazing! A Great Microsoft Community Program Manager
supporting all the MVPs in the Nordics & Benelux doing an Awesome Job!
On the right is Robert Smit a Great Dutch MVP and friend.

Mister OMS alias Scripting Guy Ed Wilson.

When there is a Microsoft Windows Server event, there is Jeff Woolsey 
“The three Musketeers”

Meeting Brad Anderson, he had great lunch breaks interviews in his car
with Awesome people.

The Azure Stack Guys on the 25th MVP Global Summit

Mister PowerShell Jeffrey Snover at the MVP Summit having fun

Scott Guthrie meeting him at the Red Shirt Tour in Amsterdam.

Great to meet Yuri Diogenes in 2018 with his book Azure Security Center.
I know him from the early days with Microsoft Security, like ISA Server

Mister Azure, CTO Mark Russinovich meeting at the MVP Global Summit in Redmond.
a Great Technical Fellow with Awesome Azure Adaptive Cloud Solution Talks!

Mister DevOps himself Donovan Brown in Amsterdam for DevOps Days

My friend Rick Claus Mister MS Ignite.

Mister Azure Corey Sanders at the MVP Summit.

Mister Channel 9, MSIgnite, AI Specialist Seth Juarez
He is a funny guy.

Meeting Scott Hanselman in the Netherlands together with MVP Andre van den Berg.
Scott is Awesome in developer innovations and technologies.
Following Azure Friday from the beginning.

Windows Insider friends for ever meeting Scott Hanselman.
With on the left MVP Erik Moreau.

Windows Insiders for Ever
Here together with Dona Sarkar here in the Netherlands

Windows Insider Friends having fun with Ugly Sweater meeting.
On the right my friend Maison da Silva and on the upper right Erik Moreau and Andre van den Berg.
Friends for Life

Microsoft Global MVP 15 Years Award disc is in the House
on Monday the 14th of July 2025.

Thank you All

In today’s cloud-native landscape, container security is paramount. IT professionals must strike a balance between agility and security, ensuring that applications run smoothly without exposing vulnerabilities. One way to achieve this is through Docker hardened images, which enhance security by reducing attack surfaces, enforcing best practices, and integrating with Microsoft Azure Container Registry (ACR) for seamless deployment.

Why Hardened Docker Images?

A hardened Docker image is optimized for security, containing only the necessary components to run an application while removing unnecessary libraries, binaries, and configurations. This approach reduces the risk of known exploits and ensures compliance with security standards. Key benefits include:

• Reduced Attack Surface: Eliminating unnecessary components minimizes entry points for attackers.
• Improved Compliance: Meets security benchmarks like CIS, NIST, and DISA STIG.
• Enhanced Stability: Smaller images mean fewer dependencies, reducing vulnerabilities.
• Better Performance: Optimized images lead to faster deployments and lower resource consumption.

Leveraging Azure Container Registry for Secure Image Management

Microsoft Azure Container Registry (ACR) plays a critical role in securely storing, managing, and distributing hardened images. IT professionals benefit from features such as:

• Automated Image Scanning: Built-in vulnerability assessment tools like Microsoft Defender for Cloud detect security risks.
• Content Trust & Signing: Ensures only authorized images are deployed.
• Geo-replication: Enables efficient global distribution of container images.
• Private Registry Access: Provides secure authentication via Azure Active Directory.

Microsoft Azure Container Registry

Hardened Images in Azure Container Solutions

By deploying hardened images through Azure Kubernetes Service (AKS), Azure Container Apps, and Azure Functions, organizations strengthen security in cloud-native applications while leveraging Azure’s scalability and flexibility. This translates to:

• Improved Security Posture: Reducing exposure to common container-based threats.
• Streamlined Operations: Consistent, automated deployment pipelines.
• Efficient Cost Management: Optimized images lower compute and storage costs.

Strengthening Security with Docker Scout

Docker Scout is a powerful security tool designed to detect vulnerabilities in container images. It integrates seamlessly with Docker CLI, allowing IT professionals to:

• Scan Images for CVEs (Common Vulnerabilities and Exposures): Identify security risks before deployment.
• Receive Actionable Insights: Prioritized remediation recommendations based on severity.
• Automate Security Checks: Continuous monitoring ensures compliance with security standards.
• Integrate with Azure Container Registry (ACR): Scan images stored in ACR for proactive security management.

How It Works with Azure Container Solutions

By incorporating Docker Scout with Azure Container Registry (ACR), IT teams can establish a robust security workflow:

1. Build & Harden Docker Images – Optimize base images to minimize attack surfaces.
2. Scan with Docker Scout – Detect vulnerabilities in both public and private repositories.
3. Push Secure Images to ACR – Ensure only validated, hardened images are stored.
4. Deploy on Azure Container Solutions – Use AKS, Azure App Service, or Azure Functions with improved security confidence.
5. Monitor & Automate Security Updates – Continuous scanning helps maintain container integrity.

Best Practices for IT Professionals

To maximize security, IT teams should adopt the following best practices:

1. Use Minimal Base Images (Alpine, Distroless) to reduce attack surfaces.
2. Regularly Update & Scan Images to patch vulnerabilities.
3. Implement Role-Based Access Controls (RBAC) for container registries.
4. Adopt Infrastructure as Code (IaC) to enforce secure configurations.
5. Monitor & Audit Logs for anomalous activity detection.
6. Automate Docker Scout scans in CI/CD pipelines.
7. Enforce image signing & verification using Azure Key Vault.
8. Regularly update base images & dependencies to mitigate risks.
9. Apply role-based access controls (RBAC) within Azure Container Registry

Conclusion

Secure containerization starts with hardened Docker images and robust registry management. Azure Container Registry offers IT professionals the tools to maintain security while leveraging cloud efficiencies. By integrating these strategies within Azure’s ecosystem, organizations can build resilient and scalable solutions for modern workloads.
Docker Scout combined with Azure Container Registry provides IT professionals a strong security foundation for cloud-native applications. By integrating proactive vulnerability scanning into the development workflow, organizations can minimize risks while maintaining agility in container deployments.
When you work with artificial intelligence (AI) and Containers working with Model Context Protocol (MCP)
Security by Design comes first before you begin.
Here you find more information about MCP protocol via Docker documentation

 

 

50 years of Microsoft

A Legacy of Innovation and Transformation

Half a century ago, on April 4th, 1975, two young visionaries, Bill Gates and Paul Allen, co-founded Microsoft with a bold ambition: to make computing accessible and essential for everyone. What began as a small software company has grown into a global technology leader, continuously transforming industries and empowering billions of lives. As we celebrate Microsoft’s 50-year journey, let’s explore its milestones, innovations, and impact, including its contributions to datacenters, Windows Server, Hyper-V, Azure, and the leadership of its CEOs.

The Early Years: Coding the Future

Microsoft’s first big breakthrough came with the creation of an operating system for the fledgling personal computer market. In 1980, the company introduced MS-DOS, laying the groundwork for the revolutionary Windows operating system, launched in 1985. This graphical interface transformed computing, making it accessible to both businesses and individuals.

Guiding Microsoft Through Its Evolution: The CEOs Who Shaped the Company

Microsoft’s trajectory has been shaped by its visionary leadership. From the founders to the present, each CEO has left an indelible mark:

1. Bill Gates (1975–2000): As co-founder and first CEO, Gates spearheaded the company’s initial growth, launching pivotal products like MS-DOS, Windows, and Office. His focus on innovation and accessibility built the foundation of Microsoft’s success.
2. Steve Ballmer (2000–2014): During his tenure, Ballmer led Microsoft through massive expansion, particularly in enterprise solutions and cloud computing. He introduced Windows Server and laid the groundwork for services like Azure. Ballmer’s energy and passion defined his leadership style and kept Microsoft competitive in a rapidly changing market.
3. Satya Nadella (2014–Present): Nadella ushered in a cloud-first, AI-driven era, transforming Microsoft’s culture and business model. His emphasis on inclusivity, empathy, and sustainability revitalized the company. Under his leadership, Azure became one of the world’s leading cloud platforms, and Microsoft made transformative acquisitions like LinkedIn, GitHub, and Activision Blizzard.

Lake Bill on Redmond Campus

Redefining Enterprise Technology: Datacenters, Windows Server, and Virtualization

As businesses increasingly relied on technology, Microsoft expanded its offerings to support enterprise needs. Windows Server, introduced in 1993, became a cornerstone for server management and networking. It evolved over the decades, incorporating features such as Active Directory, high availability, and security enhancements.

Microsoft played a pivotal role in virtualization with Hyper-V, launched in 2008. Hyper-V allowed organizations to maximize resource efficiency and reduce costs by running multiple virtual machines on a single physical server. Modern datacenters powered by Microsoft’s hardware and software solutions now form the backbone of its cloud services.

Embracing the Cloud: The Azure Revolution

Microsoft’s Azure cloud platform, launched in 2010, redefined computing. It enabled organizations to access scalable infrastructure, deploy applications globally, and harness artificial intelligence with ease. Azure spans over 60 regions worldwide, making it one of the most comprehensive cloud platforms. Its ecosystem includes hybrid cloud solutions, advanced analytics, and IoT technologies.

Gaming, Devices, and Consumer Innovation

Microsoft entered the gaming industry with the Xbox in 2001, creating a thriving gaming ecosystem. Beyond gaming, the company innovated with devices like the Surface lineup, combining sleek design with productivity. Its integration of hardware and software demonstrated Microsoft’s versatility.

Shaping the Future: AI, Sustainability, and Datacenters

Microsoft continues to lead in artificial intelligence with tools like Microsoft Copilot. Its pledge to be carbon-negative by 2030 highlights environmental responsibility, with sustainable datacenter operations playing a central role.

Conclusion: A Legacy Built to Inspire

Microsoft’s 50-year journey is a testament to the power of innovation and visionary leadership. From Bill Gates to Steve Ballmer to Satya Nadella, each CEO has steered the company to new heights. With contributions ranging from datacenters and Windows Server to Hyper-V and Azure, Microsoft’s impact has been profound. As the company looks ahead, it remains dedicated to empowering people and organizations to achieve more, ensuring the next 50 years are as groundbreaking as the last.

Here’s to Microsoft—a company built to inspire and shape the future.

at Building 92 of the Microsoft Campus in Redmond.

 

Once upon a time, in a world where technology and holiday cheer intertwined, there was a bustling community of developers eagerly awaiting the latest updates from the Microsoft Windows 11 and Windows Server Insider programs. As the festive season approached, the air was filled with excitement and anticipation.

In the heart of this community were the Microsoft MVPs (Most Valuable Professionals) and Docker Captains, who were known for their expertise and passion for technology. They decided to come together to create something truly magical for developers around the world.

One snowy evening, as the MVPs and Docker Captains gathered around a virtual fireplace, they began to brainstorm ideas. “What if we could combine the power of Windows 11, Windows Server, and Docker Containers to create a seamless development experience?” suggested one MVP, their eyes twinkling with excitement.

The idea quickly gained momentum, and soon, the group was hard at work. They envisioned a world where developers could effortlessly build, test, and deploy applications using the latest features of Windows 11 and Windows Server, all within the flexible and scalable environment of Docker Containers.

With the help of the Insider programs, they gained early access to cutting-edge features and updates. The MVPs and Docker Captains worked tirelessly, sharing their knowledge and expertise to create a series of tutorials, guides, and sample projects. These resources were designed to help developers harness the full potential of Windows 11, Windows Server, and Docker Containers.

As the holiday season progressed, the community began to see the fruits of their labor. Developers from all corners of the globe started to adopt the new tools and techniques, marveling at the ease and efficiency they brought to their workflows. The combination of Windows 11’s sleek interface, Windows Server’s robust capabilities, and Docker Containers’ flexibility created a harmonious symphony of technology.

To celebrate their success, the MVPs and Docker Captains organized a virtual holiday party. Developers joined from far and wide, sharing stories of their experiences and the innovative projects they had created. The virtual room was filled with laughter, camaraderie, and a shared sense of accomplishment.

As the night drew to a close, one of the Docker Captains raised a toast. “Here’s to the power of collaboration, the spirit of innovation, and the joy of the holiday season. May we continue to push the boundaries of technology and inspire developers everywhere.”

And so, the story of the Microsoft Windows 11 and Windows Server Insider Christmas, made possible by the dedication and expertise of the MVPs and Docker Captains, became a cherished tale in the developer community. It was a reminder that, with passion and teamwork, even the most ambitious dreams could come true.

Happy holidays, and may your coding adventures be merry and bright!

Microsoft Azure Arc enabled Windows Server 2025 Insider Preview in Windows Admin Center

In the ever-evolving landscape of IT infrastructure, the need for seamless integration and management across on-premises, edge, and cloud environments has never been more critical. Enter Azure Arc-enabled servers, Windows Admin Center, and Azure Copilot—three powerful tools that together redefine hybrid cloud management.

Azure Arc: Bridging the Gap

Azure Arc is a game-changer for organizations looking to extend Azure management capabilities to any infrastructure. Whether your servers are on-premises, at the edge, or in another cloud, Azure Arc enables you to manage them through a single pane of glass. This unified approach simplifies operations, enhances security, and ensures compliance across diverse environments.

With Azure Arc, you can:

• Deploy and manage Kubernetes clusters anywhere.
• Apply Azure policies consistently across all your resources.
• Leverage Azure services like Azure Monitor and Azure Security Center for comprehensive monitoring and security.

Windows Admin Center: Simplified Server Management

Windows Admin Center (WAC) is a browser-based management tool that brings simplicity and efficiency to server management. Integrated with Azure Arc, WAC provides a centralized platform to manage your Windows Servers, whether they are on-premises or in the cloud.

Key features of Windows Admin Center include:

• Intuitive Dashboard: A user-friendly interface that provides a holistic view of your server environment.
• Streamlined Management: Tools for managing server roles, storage, networking, and more.
• Azure Integration: Seamless connectivity with Azure services, enabling hybrid scenarios like Azure Backup and Azure Site Recovery.

Azure Copilot: AI-Powered Assistance

Azure Copilot is the latest addition to the Azure ecosystem, bringing AI-powered assistance to your fingertips. Integrated with both Azure Arc and Windows Admin Center, Azure Copilot leverages machine learning to provide insights, recommendations, and automation, making your IT operations smarter and more efficient.

 

With Azure Copilot, you can:

• Automate Routine Tasks: Reduce manual intervention with intelligent automation.
• Gain Actionable Insights: Use predictive analytics to anticipate issues before they occur.
• Enhance Security: Receive real-time security recommendations and threat detection.

 

The Power of Integration

The true strength of these tools lies in their integration. Azure Arc extends Azure’s reach to any infrastructure, Windows Admin Center simplifies server management, and Azure Copilot adds a layer of intelligence and automation. Together, they create a robust hybrid cloud management solution that empowers IT professionals to manage complex environments with ease.
This is called Microsoft Adaptive Cloud

Imagine a scenario where you can deploy a Kubernetes cluster on-premises, manage it through Windows Admin Center, and use Azure Copilot to automate updates and monitor performance—all from a single interface. This level of integration not only enhances operational efficiency but also ensures that your infrastructure is secure, compliant, and ready for the future.

Conclusion

As organizations continue to navigate the complexities of hybrid cloud environments, the combination of Azure Arc, Windows Admin Center, and Azure Copilot offers a comprehensive solution that simplifies management, enhances security, and drives innovation. Embrace the future of IT infrastructure management with these powerful tools and unlock new possibilities for your organization.

Ready to transform your hybrid cloud strategy? Dive into the world of Azure Arc, Windows Admin Center, and Azure Copilot today and experience the future of IT management.

For more information on these tools and how they can benefit your organization, check out the latest updates from Microsoft Docs:

Microsoft Azure Arc documentation

Microsoft Azure Copilot documentation

Microsoft Azure Windows Admin Center for Arc Enabled Servers

Mark Russinovich and Scott Hanselman on Stage talking about Copilot, ChatGPT and AI

Scott and Mark learn responsible AI

Always check the output of AI

Microsoft Azure Local 

NEW Microsoft Introducing disconnected Operations (Preview)

Azure Local with disconnected Operations
Awesome!

NSG with Azure Local

Security in Azure Local video

 

Defender for Cloud

Get Started Today

Azure Linux 3.0 on AKS kubernetes in Preview

QuickStart

AKS Automatic
Dynamic System Node pool in Preview

More Buit-in policies for AKS

Auto-Instrumentation with Application Insights
Preview in January 2025

Enhanced Risk & Attack Path Analysis for Containers

Microsoft Azure Container Registry – Image Auto Patching in Private Preview
Security on Vulnerabilities

Network Isolated Cluster in Public Preview
Here you find Best practices for cluster isolation in Azure Kubernetes Service (AKS)

Microsoft Container Vulnerabilities Management

Container Vulnerabilities Assessment throughout the software development lifecycle.

Defender for Cloud Container Security
Continuously reduce risks.

Attack path and remediation on your AKS Kubernetes Cluster Inside overview

Container Security posture from Code to runtime is important!

Microsoft Azure Kubernetes Fleet Manager Auto-Upgrade

Microsoft AKS Static Egress Gateway for Pod-level Access Control.

Block pod access to the Azure Instance Metadata Service (IMDS) endpoint (preview)

Trusted launch for Azure Kubernetes Service (AKS)

Seccomp Default Public Preview

Node Auto Provisioning GA January 2025

Comprehensive Security Controls overview

Experience Security Copilot Today

My Conclusion

Always start small with New innovative features like Azure Copilot or making your Adaptive Cloud first in a test environment.
Do your own experiences, testing and make your Secure architecture designs for your production. Keep it simple because it can be quick complex with a lot of dependencies. Microsoft works hard to make your life more easy in this changing IT landscape
I like to thank all the people who supported the Microsoft Ignite 2024 event, it was Awesome with a lot of Great News.

Here you find the Microsoft Ignite 2024 Book of News.

 

Microsoft Azure Adaptive Cloud approach enabled by Azure Arc.

Adaptive Cloud approach Key Services and Products.

Operate everywhere with AI-enhanced management and security

AI-enhanced Central Management & Security

Get Started with Azure Arc Jumpstart here

Welcome to the heart of our mission at Azure Arc Jumpstart, where we strive to transform your learning experience into a smooth and empowering journey. Our commitment is rooted in the principles that drive us forward:

1. Enabling immediate engagement: Arc Jumpstart is designed to offer a seamless “zero to hero” experience. We understand the value of your time, and our goal is to enable you to dive right into Azure Arc, eliminating barriers and complexities.

2. Comprehensive guidance: We provide more than just guides; we offer comprehensive, step-by-step instructions tailored for various independent Azure Arc scenarios. Our content is meticulously detailed, incorporating extensive automation, vivid screenshots, and insightful code samples. This ensures that your learning journey is not just informative but also visually enriching and deeply engaging.

3. Unparalleled user experience: Our dedication lies in delivering a rich and immersive experience. We go beyond the basics, curating a user-centric environment that resonates with both beginners and seasoned professionals. Whether you’re setting up your environment on-premises or in the cloud, our guides empower you to focus on Azure Arc’s core values without being bogged down by technical intricacies.

4. Embracing platform flexibility: We recognize the diversity of your infrastructure, and our mission is to provide a platform-agnostic approach. Arc Jumpstart accommodates your infrastructure, whether it resides on-premises or in the cloud. Our focus is to ensure that regardless of your setup, you can harness the true potential of the Azure Arc platform effortlessly.

Investments to further the Adaptive Cloud Approach

Introducing Microsoft Azure Local enabled by Azure Arc

Scott Hanselman about Visual Studio and Copilot

More AI development in Visual Studio or VSCode

Microsoft Windows 365 Link

This is Awesome, my next question is:
How fast will this solution be on Mobile?

Windows Hotpatch will be Available Spring 2025
for Windows 11 and Windows 365.

Windows Resilient Security Platform

Quick Machine Recovery in Insider program early 2025.

Microsoft working together with Cybersecurity & Infrastructure Security Agency

Smart App Control only Verified apps are allowed.

Windows Hello for Business Update with support for passkey.

Administrator Protection.

Personal Data Encryption to Windows Enterprise
Only decrypted via Windows Hello

Microsoft 365 in File Explorer

Windows Search is Cool
Coming in 2025

My Conclusion

Make your own test environment and become a Windows Insider to be one of the first to test these Awesome New features!
You can make this of course in Microsoft Azure Cloud or in your own Azure Local environment
There are so much possibilities, to keep yourself up-to-date with this changing IT landscape.

 

 

Mark Russinovich Microsoft Azure CTO Starting and Running 10.000 Containers in Azure in just 90 seconds!
That is unbelievable

Here you find my screenshots and links of the Microsoft Ignite 2024 session with Mark Russinovich.
First a quick introduction about Microsoft Azure Boost in this video.

Microsoft Azure Boost more IOPS and Throughput

Before and After Azure Boost Local Storage improvements.

Can you believe it, these are no typo’s 6.6 M IOPS !

Azure Boost Networking

Network driver Update in Azure Boost.

Software Defined Networking (SDN) Today

SDN Accelerating offloads with DPU

 

Secure 1.6 Tbps+ to storage over WAN
Can you believe it

Microsoft announcing Azure Container Instances NGroups (Preview)

Cloud Native Apps are more than just Kubernetes

Radius in the Cloud

New Azure Container Solutions

Security Trusted Execution Environments (TEE)

When you missed Mark Russinovich at Ignite 2024 session, you can watch it on-demand here

My Conclusion

Not only with Microsoft Copilot, Azure AI or Open-AI is the IT landscape changing, but the Adaptive Cloud is evolving very quick and hardware, Software Defined is getting faster and faster but also scaling in Datacenters.

This Jeremy Winter Talking about Power-efficient Datacenter Infrastructure.

Power-efficient datacenter infrastructure is very important for Microsoft, and what I see is More Software solutions with less hardware.
Software defined and AI solutions are changing the IT Cloud Landscape also in a Hybrid way with On-premises Datacenters.
10 years ago IT workloads was 80% on-premises datacenters and 20% in the Cloud, Today this is Changed to maybe 30% on-premises and 70% in the Cloud of companies IT solutions.  Here you can Learn more at Microsoft Learn Ignite 2024

Photo of the Day Rick Claus at the Microsoft MVP – RD Wall at MS Ignite 2024

Keynote by CEO Satya Nadella

Love this Windows 365 Link Device (Preview)

The world’s Computer

Microsoft Azure Local announcement

Microsoft Azure Integrated HSM

for Security first

Microsoft Azure Boost DPU Chip

Microsoft adopts NVIDIA Blackwell to power the next frontier of AI supercomputing

Security is a Team Effort

Microsoft Security Exposure Management

Scott Guthrie on Stage with the Most Developer Tools

Microsoft Azure AI Foundry Announcement 

Microsoft SQL Server 2025 Preview Announcement by Scott

Microsoft SQL Overview Slide with Fabric

Jeremy Winter about Azure and staying ahead of evolving threats at every layer

Microsoft Windows Server 2025 Hyper-V

This was my first day impression of Microsoft Ignite 2024 Event, It was Awesome to see and hear all the News!

Here you find the Microsoft Ignite 2024 Book of News

Let’s go for Day 2 of Microsoft Ignite 2024

 

Windows Server 2025 Insider Preview Azure Arc enabled Server

The Azure Connected Machine agent receives improvements on an ongoing basis. To stay up to date with the most recent developments, this article provides you with information about:

• The latest releases
• Known issues
• Bug fixes

Here you find more information about each new release of the Azure Connected Machine Agent

Further more, keep also your Azure Arc enabled Extensions up-to-date for your Azure Hybrid Services.

Automatic extension upgrade supports the following extensions at this moment:

• Azure Monitor agent – Linux and Windows
• Log Analytics agent (OMS agent) – Linux only
• Dependency agent – Linux and Windows
• Azure Security agent – Linux and Windows
• Key Vault Extension – Linux only
• Azure Update Manager – Linux and Windows
• Azure Automation Hybrid Runbook Worker – Linux and Windows
• Azure extension for SQL Server – Linux and Windows

More extensions will be added over time. Extensions that do not support automatic extension upgrade today are still configured to enable automatic upgrades by default. This setting will have no effect until the extension publisher chooses to support automatic upgrades. So have a look at your manual upgrade extensions too!

Here you find more information about Azure Arc extensions for your Servers.

Update your Azure Arc enabled Server Extensions.

Some are not Automatic Upgraded by Default!

Updating the Azure Arc enabled Server Extensions.
Important Message:

Don’t forget Migrate to Azure Monitor Agent from Log Analytics agent

Updating the Azure Arc enabled Server Extensions Succeeded.

Keep your Azure components Up-to-date

CBL-Mariner Linux is a lightweight operating system, containing only the packages needed for a cloud environment. CBL-Mariner can be customized through custom packages and tools, to fit the requirements of your application. CBL-Mariner undergoes Azure validation tests, is compatible with Azure agents, and is built and tested by the Azure Edge & Platform to power various use cases, ranging from Azure services to powering IoT infrastructure. CBL-Mariner is the internally recommended Linux distribution for use with Microsoft cloud services and related products.

In the following steps we are going to install CBL-Mariner 2.0 on Hyper-V as a virtual Docker Container Host.
First you have to download CBL-Mariner 2.0 (Azure Linux) ISO here

Enable Secure Boot Template: Microsoft UEFI Certificate Authority

When you have made your Virtual Machine on Microsoft Hyper-V, you have to change the Security Boot Template from Microsoft Windows to Microsoft UEFI Certificate Authority and then you can boot from the ISO.

Select the Installation Experience
I used the Graphical Installer,
Select Next.

Default is the installation type: CBL-Mariner Core

I selected Installation type: CBL-Mariner Full

Read and Accept the CBL-Mariner Eula.

Here you can Partition your Storage.

 

Enter the Computer hostname and Create a User account.

Install Now.

Installing CBL-Mariner 2.0 on the VM.

And yes It’s fast

Login with your new created user account.

It’s a habbit of my to update always the OS before doing other installations, so in the next steps we are going to upgrade to the latest updates since the ISO is released. Then we are going to install Azure-CLI and Docker Host for Containers.

Type the Command: Sudo dnf upgrade

The OS is now asking a couple of times if it’s OK to install.

Installing of Packages to update the System.

Upgrade of CBL-Mariner 2.0 is Completed.

Installing Microsoft Azure-CLI on CBL-Mariner 2.0

The Azure Command-Line Interface (CLI) is a cross-platform command-line tool to connect to Azure and execute administrative commands on Azure resources. It allows the execution of commands through a terminal using interactive command-line prompts or a script. Here you can find more about Microsoft Azure-CLI

 

First, we install the ca-certificates
then
we install Microsoft Azure-CLI 

       type Y if this is OK.

Azure-CLI is installed.

The Latest Microsoft Azure-CLI is running on your up-to-date CBL-Mariner VM.

Type command: cat /etc/os-release
and you can see the exact version of CBL-Mariner 2.0

Installing Docker Container host on CBL-Mariner 2.0

Docker provides the ability to package and run an application in a loosely isolated environment called a container. The isolation and security lets you run many containers simultaneously on a given host. Containers are lightweight and contain everything needed to run the application, so you don’t need to rely on what’s installed on the host. You can share containers while you work, and be sure that everyone you share with gets the same container that works in the same way.

Docker provides tooling and a platform to manage the lifecycle of your containers:

• Develop your application and its supporting components using containers.
• The container becomes the unit for distributing and testing your application.
• When you’re ready, deploy your application into your production environment, as a container or an orchestrated service. This works the same whether your production environment is a local data center, a cloud provider, or a hybrid of the two.

Now we are going to install the Docker Container host software on Microsoft CBL-Mariner 2.0 (Azure Linux):

Type Command: sudo tdnf install moby-engine moby-cli ca-certificates -y

Type command: sudo systemctl enable docker.service

Type command: sudo systemctl start docker.service
and then
type command: sudo systemctl status docker.service

Now you can pull or create your containers from here for example:
Type Command: docker run -it -d –name my_container ubuntu bash

Here I’m inside the Ubuntu Linux Container running on CBL-Mariner 2.0 with Docker Container Host.

Docker Container Ubuntu image.

More information about Microsoft CBL-Mariner 2.0 you can find here:

Microsoft CBL-Mariner 2.0 (Azure Linux) on Github

Microsoft CBL-Mariner 2.0 (Azure Linux) Security

Microsoft CBL-Mariner 2.0 (Azure Linux) Toolkit docs

Conclusion

Running Microsoft CBL-Mariner 2.0 (Azure Linux) on Azure Stack HCI Hyper-V Cluster or in Microsoft Azure Cloud can be very powerfull as a lightweight Linux operating system at the Edge. Now we did running Docker Container Host on CBL-Mariner 2.0 (AzureLinux) but you can also install Microsoft Azure Arc agent to use this Operating System in a Adaptive Cloud way for Azure Hybrid Management and security. Try it yourself first in your test lab and when you have build a great security by design solution, use it in production for your business.

Join Containers in the Cloud LinkedIn Community Group for Free

Microsoft Azure Arc Services for Adaptive Cloud

Azure Arc-enabled Kubernetes allows you to attach Kubernetes clusters running anywhere so that you can manage and configure them in Azure. By managing all of your Kubernetes resources in a single control plane, you can enable a more consistent development and operation experience to run cloud-native apps anywhere and on any Kubernetes platform.
Azure Arc-enabled Kubernetes works with any Cloud Native Computing Foundation (CNCF) certified Kubernetes clusters. This includes clusters running on other public cloud providers (such as GCP or AWS) and clusters running on your on-premises data center (such as VMware vSphere or Azure Stack HCI).

In the following step-by step installation, we are going to connect a Kubernetes Cluster with Azure Arc services.

Add Kubernetes Cluster

Before you begin, you need this prerequisites

Extension add

the Extension was already installed.

Here you set the subscription and resource group first.
Cluster name in Azure and the Microsoft Azure Region.
and at last, the network connectivity method, in my scenario a public endpoint.

you can add your tags.

Here you can select your script type Bash or PowerShell
Then download your script.

Azure login

Enter the code and login your Azure subscription.

You now have signed in.

Check these Provider registrations (requirement)

Running the bash script.

Starting to install Azure Arc agents on the Kubernetes Cluster.

In Azure Portal, Kubecluster is connected to Azure.

kubectl get pods -n azure-arc

Kubecluster Overview in Azure portal.

the kubecluster is Azure Arc enabled and running.

Azure Arc-enabled Kubernetes with Azure Monitor options.

Azure ArcNetworking extension for loadbalancer service.

Arc Enabled kubernetes Cluster features.
Azure provides an automated application deployments capability using GitOps 

Try your Azure Arc enabled Kubernetes Cluster Today first in your test lab and see all the features you can use for your environment.
Join Containers in the Cloud Community on Linkedin

Join Azure Hybrid Community on Linkedin

Microsoft Windows Server 2025 Datacenter Insider Preview Build 26040

Microsoft released a new Windows Server Insider preview Build 26040 on January 26th and changed Windows Server vNext name into Microsoft Windows Server 2025!

So time to update my MVPLAB domain stack.local.

I’m updating my domain controller from build 26010 to 26040.

Before we can move further, we have to run adprep.

Run adprep from the new ISO on the Domain controller.
by Typing C and enter it will run.

Schema upgrade from 90 to 91

adprep /domainprep.

Adprep successfully updated.

After this click on refresh in the Windows Server Setup if you have this still open.

 

I want to keep my files, settings and apps on my domain controller.
Click on Install

Installing Windows Server 2025 Insider Preview Build 26040

Don’t turn off your machine.

Microsoft Windows Server 2025 Datacenter Insider Preview Build 26040
is running as my Domain Controller.

Don’t forget the last updates.

Running Schema object version 91.

Here you can find more information about Windows Server 2025 Insider Preview Build 26040

Follow Jeff Woolsey on X (Twitter) here

Follow Ned Pyle on X (Twitter) here

Get started by joining Windows Server Insider program

Make your Windows Servers Hybrid with Microsoft Azure Arc
for more Hybrid IT management Benefits

Microsoft Azure Arc enabled Servers

When you have your Servers Azure Arc enabled, you will work with Azure Arc extensions to work with Azure hybrid features like Defender for Cloud, Azure Monitor, Windows Admin Center and more. For each Azure Arc extension you can get updates, and it’s important to keep them up-to-date for new functionality and security. You have Azure Arc extensions for Windows Servers but also for Linux Servers.
Some of the Azure Arc extensions will automatic upgrade when you have enabled it and some must go manually from the Azure Portal.
More information about Azure Arc extensions you can find them here

In the next steps you will see the Update management of the Azure Arc enabled extensions :

Here I update one extension.

Inside the WindowsOsUpdateExtension

Here you can see that the WindowsOsUpdateExtension is up-to-date
and Status Succeeded

On the right of this screenshot you see Automatic Upgrade and some extensions are enabled, but some are not supported.
That’s why it’s important to check these updates.

Here you can see in the Status that two Azure Arc extensions are updating

And sometimes it failed to update.
But you can see what you can do best with this failed Status.

Here you see the error message and the Tips.
And when you can’t fix it yourself you can make a Support ticket right away.

Here you can see that all the Azure Arc extensions are updated successfully

So I selected all my Azure Arc enabled Servers and updated them all.

Conclusion

With Microsoft Azure Arc enabled Servers you have do some IT management to keep your Azure Arc extensions up-to-date.
I did this without rebooting Servers, just from the Azure Portal update Azure Arc extension.
Here you find more information about Microsoft Azure Arc for Azure Hybrid IT

Join Azure Hybrid Community Group on LinkedIn

What a Year 2022!!

I like to thank you Community for Supporting, Sharing and Reading New Microsoft technologies on my Blog, Twitter, Facebook and
LinkedIn Community Groups I wish you all happy Holidays, Merry Christmas and a Healthy New Year 2023 may the Best Wishes comes true !

I’m very proud and Honored  on the Microsoft Global MVP Awards 2022-2023 !

• MVP Award for Cloud and Datacenter Management
• MVP Award for Windows Insiders
• MVP Award for Azure Hybrid

Thank you Microsoft Product Groups, MVP Award Program, Windows Insider Team, Azure Hybrid Team, Windows Server and Azure Stack HCI Team for all your support, NDA PGI sessions, and for the Awesome software, Features, solutions you are building
Wish you all Happy Holidays, Merry Christmas and a Healthy New Year 2023 may the Best Wishes comes true !

Here are some Great links for Reading and Sharing :

JOIN these LinkedIn Community Groups for free and Share New Microsoft Technologies Together:

Windows Admin Center Community Group

Containers in the Cloud Community Group

Microsoft Azure Monitor & Security for Hybrid IT Community Group

Azure Hybrid Community Group

Azure DevOps Community Group

What I really love is the Microsoft Tech Community platform

---

For Microsoft Azure Hybrid:

Azure Arc Jumpstart site

Azure Hybrid and Multi Cloud documentation

Microsoft Azure Arc Community monthly Meetup (GitHub)

Follow on Twitter for Azure Hybrid:

Microsoft Windows Insiders Blog

Windows Insider Team on YouTube

The Windows Insider Program Team is really active on Twitter:
@WindowsInsider

@JenMsft

@NorthFaceHiker

@brandonleblanc

@amanda_lango

---

Get started with the Windows Server Insider program

What’s New in Windows Server 2022

Overview of Windows Admin Center

What’s New in SQL Server 2022

---

Azure Arc enabled SQL Servers Architecture

To keep your Business running, It’s important to secure and monitor your data. One of the security measures is doing Vulnerability assessments in your datacenter(s) to see the status and results for remediation. With Microsoft Azure Arc Defender for Cloud you can do a SQL Server vulnerability assessment in your on-premises datacenter or anywhere with the Azure Arc agent running.
Here you find more information about Azure Arc enabled SQL Server

Microsoft Defender for Cloud on Azure Arc enabled SQL Server

Here I activated Microsoft Defender for Cloud on Azure Arc enabled SQL Server, and Azure Defender for Cloud is doing a SQL vulnerability assessment to get the security status and results for remediation.

On this same Azure portal page you will see the Vulnerability assessment findings.

When you Open a Vulnerability finding, you get more information and the remediation for the issue.

Here you see the complete Resource Health of the Azure Arc enabled SQL Server.
Look at the Status of each severity.

Here you see all the vulnerability findings on these four databases.

When you do the remediation you will see the healthy status.
on the Passed tab.

Here I open only the OperationsManager database.
Now you see only the Vulnerability findings on this database.

Here you see a vulnerability finding on the SCOM database with the Remediation

You can make your Own Workbooks or use them from the Gallery.

Workbook example of Vulnerability Assessment findings.

Conclusion

With Azure Defender for Cloud vulnerability assessment and management you will learn a lot to set your Security Baseline on a higher level in your datacenter(s). Getting the right remediation of Microsoft to solve security issues is Great! You can do your assessments frequently to show your current status on demand. I Really like these Azure Hybrid Tools to make my work easier and the data more secure for the business.

Please join the Azure Hybrid Community Group on LinkedIn for free ( Sharing is Caring together )