Azure storage and data transfer: where the quiet money goes
Storage looks cheap per gigabyte, so nobody audits it. Then redundancy, transactions, early-deletion penalties and cross-region transfer turn a small line into a large one.
Blog
Azure
Articles about Azure from the ConsultorIA blog: cloud, applied AI and security in production.
Azure Monitor bills you for the logs nobody reads
Log Analytics ingestion is the line that grows without anyone deciding it should. Six controls bring it down, and none of them mean losing the telemetry you actually use.
AKS spend: the node pool decisions that set your bill
The AKS control plane is nearly free, so everything you pay comes from node pools, and the defaults are expensive. Here is what we change, in the order that finds money fastest.
An Azure landing zone you can actually maintain
The Cloud Adoption Framework reference architecture is large and most teams deploy a fraction of it. Here is the subset that carries the weight: management groups, subscription boundaries and the policies that hold it together.
Conditional Access policies that hold, and the emergency account you must create first
Conditional Access is the strongest control in Entra ID and the easiest way to lock your entire organisation out of its own tenant. Here is the baseline set, and the order to deploy it in.
The Azure bill, in the order we take it apart
Azure has more discount mechanisms than any other cloud and they stack in a specific order. Get the order wrong and you commit to capacity a hybrid benefit would have made unnecessary.
Putting AKS into production: the decisions that are hard to change later
Network plugin, identity model, node pool layout and upgrade strategy are all chosen in the first hour and all painful to change afterwards. Here is what we pick and why.
Azure OpenAI in production: quotas, networking and the permission model
The model is the easy part. What decides whether an Azure OpenAI assistant reaches production is token quota per region, private networking and whether retrieval respects who is asking.
Defender for Cloud: what to enable, what to ignore and why secure score is not the goal
Defender has eight separately priced plans and a score that rewards volume over risk. Here is how we decide which plans earn their cost and how to triage the recommendations that matter.
Private endpoints, service endpoints and the DNS problem nobody warns you about
Locking down PaaS services in Azure is straightforward until the name resolution breaks in a way that only shows up from one subnet. Here is the model that works and how to lay out the hub.
Azure Policy as code: the deployment pattern that does not cause outages
Azure Policy is the strongest governance engine of the three big clouds and the easiest to misuse. Here is how we write, test and roll out policy so a Deny effect never surprises a deployment.
Azure SQL Database, Managed Instance or SQL on a VM: choosing without regret
The three options differ on features, cost and how much of your existing database you have to change. Here is the decision tree and the migration that keeps downtime short.
Bicep or Terraform for Azure: an honest comparison
Bicep is better at Azure than Terraform in several specific ways, and worse in several others. The right answer depends on whether Azure is your only cloud and who maintains the code.