CommPulse

Cloud platforms have made it much easier for teams to build and deploy applications quickly, but I feel the security review process has become more challenging as release cycles get faster. Azure provides a lot of tools for infrastructure security, monitoring, identity management, and compliance, but application-level issues can still be difficult to catch before they reach production. For teams running applications on Azure, what security checks are part of your deployment process before going live? Do you focus more on code reviews, automated testing, manual assessments, vulnerability scanning, or a combination of different approaches? I'm interested in hearing how different teams balance shipping quickly while still maintaining confidence in the security of their applications. submitted by /u/Minute-Vegetable-773 [link] [comments]

We are hardening our security policies and want to implement some password rotations. One account that came up with our security guy was our AD account that we have in the Microsoft Entra Connect Sync app. I understand that this account is for the app and the account syncing to the cloud is different. If we change the password in AD to the Entra sync account, is it as simple as just updating it in Entra Connect sync tool and then running a delta sync to see if it works? I have a small environment I plan on testing this with before we change the password to Azure connect for the larger wide org. submitted by /u/Available_Pack_2499 [link] [comments]

Hello fellow Admins, As budget season approaches, we are reconsidering Udemy as a company platform for additional learning. Personally, I find Udemy quite adequate, but wanting to hear what other people like for their help desks, admins, and others within your department. submitted by /u/Ironfox2151 [link] [comments]

So I'm having a battle with Gemini here and trying to work something out. I decided, since SMS MFA is soon to be done, I tried the new Windows passkey feature until I realized this has to target a phishing-resistant policy to work ideally. This worked great for our regular users that don't have our apps on personal device nor corporate phones (no MS Authenticator). Until the desk phone kicked out in my test. Now I can't sign in, of course. It looks like the Teams admin provision option uses device code flow, which is blocked as a recommended practice. Is there a way to slightly loosen that? Ideally, I would like the best of both worlds but I'm not figuring out the best path here. submitted by /u/scratchduffer [link] [comments]

This is probably one of the biggest issues I see when taking over from other MSPs both big and small. Why is it that when I join the public Wi-Fi I can ping every computer and server in the building lol? See normally I encounter businesses with one Wi-Fi and I understand how that doesn't translate to guests or customers being separate from the main network. Still not configured properly and still an issue, but I get it. But today for example. Did a network assessment for a healthcare office. They literally had 2 separate ssids. One labeled private one labeled public. They both connect you to the same subnet. And I can ping every computer and server in the building from the public. Like you went out of your way to make a separate public Wi-Fi but didn't actually make it separate. My guess is they either had issues with the VLAN so they said screw it and put it on the main. But even then, this is a unifi system, you could literally just check the box for isolation of devices and leave them on the LAN but at least they wouldn't be able to talk to other LAN devices. It's really sad that I see this so often. It's one of the first things I check when I walk in the door, I join the public or guest posted wifi and start pinging. What's even worse is I looked up this MSP. They are up and down the entire East coast USA. They also were billing them for advanced antivirus and security on all the machines but sentinel one was only installed on two of them. Smh. submitted by /u/Sea_Information6125 [link] [comments]

EIXO was created to address a common operational challenge: critical business areas working in isolation, with fragmented data and limited visibility across the organization. Built around the real operational needs of Jardim Espaço de Educação, the platform connects multiple domains within a single operating ecosystem: • School administration • People management • Finance • Supplies and inventory • Nutrition and kitchen operations • Operational intelligence and performance indicators EIXO is not designed as just another traditional ERP. Its architecture follows a distributed operating model in which each module preserves its specialization while sharing data and operational context across the organization. The goal is to reduce manual work, improve traceability, strengthen coordination, and turn operational data into faster and more consistent decisions. The project is being developed and documented publicly on GitHub: github.com/maykonlincolnusa/Eixo-jardim-ERP #SoftwareEngineering #SystemArchitecture #ERP #DigitalTransformation #DataEngineering #OperationalIntelligence #EducationTechnology #OpenSource submitted by /u/MaykonLincoln [link] [comments]

Been running some training jobs on TPU v5e and every time I tweak sequence length or batch size mid-experiment, I eat this huge AOT compile penalty before anything actually runs. Feels like the "cold start" tax is way worse than people talk about online. Is this just a TPU/XLA thing, or does anyone see similar pain on GPU with torch.compile when shapes aren't static? Curious what workarounds people use — bucketing sequence lengths, padding to fixed sizes, warm pools, anything. How many seconds/minutes are you losing per shape change in your actual workflows? submitted by /u/Comfortable_Nail6076 [link] [comments]

From a lot of discussions here, it seems that many production incidents eventually trace back to some kind of change—a deployment, configuration update, infrastructure modification, scaling event, etc. What I'm curious about is what happens after you've identified a likely change. What's usually the hardest part of confirming that it was actually responsible for the incident? For example: Do you rely mostly on logs, metrics, traces, or dashboards? Do you try to reproduce the issue? How do you separate correlation from actual causation? Have you ever spent hours investigating the "obvious" change only to discover the real cause was something else? I'm interested in how experienced AWS teams approach this in practice rather than any specific tools. Thanks! I'm trying to understand what the investigation process looks like in real production environments. submitted by /u/Narrow_Power [link] [comments]

https://preview.redd.it/9l7i8ay9flgh1.png?width=2032&format=png&auto=webp&s=4a4121044b80b22c3286cbfb10f1bc69eb4ea1ce submitted by /u/Upset_Hippo_5304 [link] [comments]

Hey! Quick background on me — graduated in 2020 from a tier 2 college, landed a third-party role at a Tier1 investment bank as an SRE, and ended up staying 5 years (got converted to full-time after the first 2). Got laid off in May 2025, honestly wasn’t mad about it since I wanted out anyway. Most of the work i did was on there in house tools and i felt there was no learning curve there That same month I interviewed for a “DevOps Engineer - Migration Specialist” role and got it. Felt good, got comfortable again. But once I actually joined, I realized it’s basically an L2 support role. Pay was decent though, so I told myself I’d stick around a year, upskill on the side, then jump ship. Except… I didn’t. The role’s been so low on mental engagement that I just coasted. Now it’s actually time to switch, and I’m stuck in this weird spot — feels like I need to relearn everything from scratch, but every time I try, it’s like “wait, I already know this?” Hard to tell if I’m actually behind or just psyching myself out. So — what’s a realistic (and ideally not soul-crushing) way to get back on track? Please give me suggestions for fast-track courses and small projects to build production skills again. Ps:- Used Ai to fix my crude version of this post submitted by /u/CuriousKiwi669 [link] [comments]

I was wondering if anyone has ever come across an issue on a windows server, for printing, where print jobs produce 0kb spl files and are then deleted. The server is 2019, with paper cut also installed, but tried a test queue without paper cut and it still produced 0kb files. Defender isn't showing anything suspicious, remove attack surface rules, issue persists. Tried rebuilding the print server and issue continues. Tried printing from edge, word, notepad from endpoint and stil 0kb. Tried different Kinolta Minolta drivers but didn't make a difference e.g. pcl3 pcl4 Postscript. I asked networking if any packet filtering was on the firewalls and they said it was all off. Any ideas anyone? submitted by /u/chronos_malkeri [link] [comments]

My subordinate is a Jr Sys Admin and I want to get him out to some good IT based conferences this year. We're a microsoft shop, no plans on changing our antivirus (sentinel one), and am avoiding cyber security based conferences since that's what his degree is in (wants to expand his knowledge on other subjects). Does anyone have any good recommendations please? submitted by /u/Swimming_Ad2923 [link] [comments]

Happy SYSADMIN day! deploy updates today to celebrate! submitted by /u/Resident-War8004 [link] [comments]

Little behind the scenes for all you IT newbies on this wonderful Friday. This is likely why your IT budget makes absolutely no sense and has nothing to do with the company's financial status, although the RAM shortage affects this heavily. But the story is from 2024. My last company was making record profits, over $20M more than the previous year (so about 40%) with $100M in the sales funnel for sold jobs. But the IT dept was approaching over-budget because our useless dumbass CIO filled out the budget wrong and forgot about a $9000 license renewal. So everything was on a spending freeze in IT solely and exclusively to make the numbers look good. After absolutely going off on everyone about how this makes no sense, is losing us productivity, delaying jobs, costing us income, causing outages, etc and we're single person owned and not publicly traded so who the fuck are making the numbers look pretty for, someone finally leaked me the truth. This was solely because the rich, retiree asshole board members got performance bonuses based on benchmarks and this was one of them. So if our dept went over budget, they lost part of their bonuses. They cared more about their income than the company's health. This is the owner, the former CEO, some of their friends, and some external 3rd party entities that I knew nothing about. I have an idea - revise the fucking budget at the Q1 mark. Budgets are a guess. You don't "go over budget" if shit got more expensive so you adjust your guess to spend more on the shit that got more expensive! That's just business. Adjust prices and margins accordingly. This was not a 10,000 person bloated company spread all over. It was about 290 people. So they added some emergency special budget special condition whatever spending, outside the budget, make the numbers look pretty thing and dropped some serious cash on all those laptops. Those laptops were $810 a piece btw in 2024 and are now like $1500+. So you're welcome, asshole who fired me 2 weeks after I asked for a raise then said this is unacceptable and I'll be looking for a new position until they reconsider because me rent went up 18% two years in a row. Btw them firing me without a replacement when I did all the server and VM host maintenance, security audits, hires and fires, backup management, all level 3 tickets, some networking, and basically maintained ALL systems (for $24/hr), the remaining staff member told me it ended up costing them around $800,000 in damages and losses and outages and delayed jobs when everything I maintained the the other staff refuses to cross train on all broke. Probably should have given me a raise and replaced the CIO since he was shit at his job (but was there for 30 years). Cheap, illogical, shitty companies run by greedy self-serving assholes are a trap and you need to get out as soon as possible because you'll run into stuff like this. And it goes 10x if you're publicly traded because then you REALLY need the numbers to look pretty or else. submitted by /u/CeC-P [link] [comments]

Studying for certs taught me facts. My first helpdesk job taught me judgment — the hard way. The five things no exam tested me on: Triage: which of these 6 tickets do you touch first, and can you defend why? Diagnose before you fix. "It's probably DNS" is a guess, not a diagnosis. Escalate without shame. Stuck 30+ min on a P1? Escalating IS the correct move. Communicate during incidents. Users are more likely forgive downtime, not silence. Cost awareness. Assigning an E3 license when F3 would do is also a mistake. Curious how others here practiced this stuff before their first job — homelab? Shadowing? Just getting yelled at until it stuck? submitted by /u/Osama2k [link] [comments]

Hi everyone, I'm hoping someone here has experienced something similar. A few days ago, my Google Cloud/Firebase project was suddenly suspended with the following message: "Immediate action required: Suspension of your Google Cloud Platform/API project because it was engaged in abusive activity consistent with hijacked resources." This project is a production application that has been running for about one year without any issues. The last release was around three months ago, and there were no recent deployments or major configuration changes before the suspension. After the suspension: -Google Cloud Console redirects me directly to the Request an Appeal page. -I can't access Cloud Logging, IAM, API usage, or any Google Cloud services. -Firebase now shows "Create Firestore Database" and "Create Storage" instead of my existing Firestore database and Storage bucket. -My application is completely offline because it cannot access Firestore. Something suspicious I found Before the suspension, I reviewed Firebase Users & Permissions and discovered an Editor account that my team never added. [email protected] We removed that account immediately after discovering it. Unexpected billing I also noticed something strange in Firebase Billing. There is approximately $25 charged for Agent Platform, but I have never intentionally used Agent Platform, never integrated it into my application, and never expected any billing for that service. I'm not sure whether this is related to the suspension or whether it could indicate unauthorized activity. Backup Fortunately, I have Firestore Disaster Recovery backups enabled, but because the project is suspended I can't access them either. Appeal I submitted my appeal today (Friday) and I'm currently waiting for Google's response. Questions -Has anyone had a project restored after receiving this exact "hijacked resources" suspension? -After restoration, did your Firestore database come back normally? -Were your Firestore Disaster Recovery backups still available? -Has anyone seen unexpected Agent Platform charges even though they never intentionally used it? -Once the project was restored, what were the first things you checked (IAM, Audit Logs, API keys, service accounts, billing, etc.)? -Is there anything else I should do while waiting for Google's response? This project contains production data, so I'm mainly worried about recovering access to Firestore and making sure the project is secure if Google restores it. Any advice or shared experiences would be greatly appreciated. submitted by /u/dasun_doloswala [link] [comments]

Hey all, My AI-200 exam is next week. Since it's a new certification, prep material is thin. Looking for help with: Study guides, courses, or practice questions that actually helped Exam tips, time management, question style, anything you wish you knew going in If you've taken it already: how close was it to the published skills outline Which domains felt heavier than expected (containers, vector databases, RAG patterns, etc.) Any input is appreciated, thanks. submitted by /u/sural_mk [link] [comments]

This week's Azure Update (31st July 2026) is up. 📽️ https://youtu.be/565Oh4RH_Nc 📄 https://www.linkedin.com/pulse/azure-weekly-update-31st-july-2026-john-savill-e9ttc Halo Campaign Evolved (01:10) - Bit of fun if you have time! AKS prepared image specification (01:33) - If you have more complex clusters that have to download large amounts of images at node provisioning the new prepared image specification enables preconfigured node images to be created that have the container images pre-cached and customizations pre-populated via initiation scripts. You create a Prepared Imaged Specification resource that defines all the content and configuration that is used to build new nodes. Fleet Manager max allowed failures (02:19) - You can optionally set a limit as a specific number or a percentage of allowed failures during update rollouts instead of the default halt after a single cluster failure. This give greater control of the balance between failure tolerance and success of deployments. This can be set at stage or group level. App routing with Gateway API (02:51) - The current Ingress NGINX project is being retired and instead you should move to the Gateway API for standard ingress and layer 7 traffic management. As part of this app routing is now available for the Gateway API on AKS. Automation PowerShell 7.6 (03:20) - Azure Automation runbooks and its runtime now support the latest PowerShell 7.6 APIM AI Gateway (03:31) - API Management which provides runtime capabilities for APIs now has the AI Gateway tier which provides capabilities specific for AI purposes, i.e. models, MCP servers and tools. It also enables you to turn REST API operations into an MCP Server in addition to federating multiple MCP Servers to appear a a single MCP Server. This is not just for Microsoft Foundry hosted but also AWS, Google, OpenAI and Anthropic. It bring full token-usage metrics through OpenTelemetry. Azure Firewall HTTP header insertion (04:23) - Azure Firewall can now add or modify the HTTP/HTTPS headers in requests. This is useful for a number of scenarios including where an application requires a specific header for access or identification including Azure Virtual Desktop, VDI, Entra tenant restrictions and other types of access control. For HTTPS you must be running the Premium SKU which has TLS inspection, otherwise only HTTP can be modified. NAT64 on NAT Gateway (05:00) - For Standardv2 SKUs of NAT Gateway (remember the v2 supports IPv6, zone redundancy and 100 Gbps bandwidth) now support NAT64 which lets IPv6 workloads talk to IPv4 Internet destinations. ANF SMB opportunistic locking (05:33) - Opportunistic locking, as the name suggests, allows an SMB client to request a lock on a file if there are no other clients with conflicting access. This then allows that client to cache the file and any reads/writes resulting in improved performance. If another client then needs access to the file that conflicts the server sends a break, the client with the lock flushes out the data and loses the lock. This is now available for new and existing volumes on Azure NetApp Files. Azure Monitor Log mirroring to Fabric (06:31) - You can now mirror data from a log analytics workspace which makes it available in OneLake without data duplication (so its more like a shortcut) since it just references the Azure Monitor data which is already in Delta Parquet format (the native OneLake structued data format). Zero data copy or sync required. PostgreSQL Flex in new region (07:26) - India South Central now has PostgreSQL flexible which is great news where you want that proximity, regional alignment. Claude Opus 5 available (07:42) - The new version of Opus which provides capability at about half the cost of Fable 5 and a step gain over Opus 4.8 especially around deep reasoning, long horizon tasks and other complex scenarios. This is now available in Foundry, M365 Copilot (apps, chat and cowork), Copilot Studio, GitHub Copilot and Azure Databricks. Kimi K3 via Fireworks AI (08:17) - The latest Moonshot open-weight model with 2.8 trillion parameters with 1 million-token context is available on Foundry via the Fireworks AI (which is an inference engine used to run open-source models running within Azure) as a data zone deployment type. GPT-transcribe and GPT-live-transcribe (08:46) - These are focused on very high accuracy automatic speech recognition (ASR) accepting audio input and outputting text. They have better background noise handling, whispering and low-volume speech, language switching, alphanumeric perception and more. The GPT-transcribe is focused on completed audio files such as meeting recordings, media files, voice mails. The Live version is a low-latency streaming version for real-time audio input with text output such as voice assistants, live captions etc. New India region (09:29) - The forth India region, India South Central is now GA. It has AZ support for strong in-region resilience for workloads. Azure Enclave (09:38) - This is a new solution that enables you to create a community which is a hub for networking, governance and monitoring which contains a collection of isolated networks which are the enclaves in which run secure workloads that live in workload resource groups. Through Azure Enclave you can manage the routing and connectivity for these isolated virtual networks via policy. Basically this solution makes it easier, faster and safer to deploy secure environments fully governed by policy to ensure consistency. This is key for various government and regulated scenarios. Key Vault symmetric keys (10:25) - The Premium SKU now supports symmetric keys (same key for both encrypt/decrypt) that use AES-based encryption and decryption operations. Azure Reservation exchange policy change (10:39) - Azure Reservations enable you to commit to a certain amount of a specific resource in a specific region for a 1 or multi year time for a discount. You can exchange this under certain conditions for alternate specifics. Azure Savings Plan instead cover all regions and a range of services to which that committed spend applies, i.e. way more flexibility even as your needs evolve, but typically less of a discount than a more granular reservation offers. From 1st of February 2027 you will no longer be able to exchange Azure Reservations for services covered under Azure Savings Plan. So if you have more dynamic workloads and have been relying on the exchange ability you should pivot to using Azure Savings Plans. submitted by /u/JohnSavill [link] [comments]

I started this position a little over a month ago. I had CDW do an assessment....most of our physical hosts have hardware that is end of life. Apparently the server guy who's been here 13 years sent an email a year ago pointing this out but, strangely, nothing came of it. So now I have a huge expense I'm looking at. I'm thinking of moving at least the HQ data center into Azure. I'd love to hear a wide variety of opinions about this, particularly from the security side. (New Manager here btw) submitted by /u/The-RogueOnion [link] [comments]

Needing to apply patches manually on some servers in our DMZ and it seems the update catalog isn't working. Been trying for almost 2 hours. Trying to search for a KB or anything just yields no results. submitted by /u/sylenth [link] [comments]