Archive
All posts
102 posts since 2023
2026
News | Azure Local 2610
Azure Local 2610 brings practical improvements to cluster servicing, security management and SAN deployments. Operators get combined OS and OEM updates, a clearer solution health summary and more …
Azure Virtual Desktop | Security Give Aways
Part I of a three-part series on securing Azure Virtual Desktop. The trust boundary, the attack chain, and the takeaways worth acting on before you touch a single setting.
Azure Virtual Desktop | Security Give Aways – Part II
Part II of the AVD security series – closing the identity and operating system gaps, from RBAC and Conditional Access through Trusted Launch, local admin, Defender and the image pipeline.
Azure Virtual Desktop | Security Give Aways – Part III
Part III of the AVD security series – the network path, the session boundary, profile data protection, and building detection that somebody actually reads.
Azure Virtual Desktop | Sessionhost monitoring 2.0
The 2024 post made sure the data was there. This one makes it useful. A free Azure Monitor workbook for AVD session hosts with seven tabs, a supplemental Data Collection Rule in Bicep, the KQL behind …
News | Azure Local 2609
Microsoft has shipped Azure Local 2609 (solution version 12.2609.1003.7, OS build 26100.33438). It is a maintenance release: reliability fixes, refreshed .NET and PowerShell, and new private path …
Azure Local | Day 2 Operations
Azure Local Day 2 operations: a free Azure Monitor workbook for CPU, memory, storage, host balance and VM density, plus the DCR and KQL to validate it.
Azure Local | Why 8 GB of RAM Isn’t Enough for Production
Azure Local automatically deploys the Azure Resource Bridge (ARB) with 8 GB of memory, but is that really enough for production? In this article, I explore the often-overlooked control plane VM at the …
News | Azure Local 2608
The August 2026 release of Azure Local (version 12.2608.1003.8) updates the platform base to OS build 26100.33296 and delivers practical administrative updates for day-two operations. Key capabilities …
News | Azure Local 2607
Azure Local 2607 focuses on operational excellence rather than new features. Microsoft has delivered fixes for VM lifecycle management, networking, Arc Resource Bridge deployments and large-scale …
Azure Local | Downloading Just the Update for Offline Installation
Running Azure Local at the edge or in a disconnected, sovereign site? Since version 2411.3 you can download just the solution update, not the whole OS, and install it offline. This walkthrough covers …
Tool | AVM Updater
Keeping Azure Verified Modules (AVM) up to date in Bicep and Terraform projects can be time-consuming and risky. AvmUpdater simplifies the process by automatically detecting new module versions, …
Azure Local | HomeLab – Troubleshoot Windows Update
This deep-dive shows how a misleading Azure Local health fault — “KeyVaultDoesNotExist” — can block cluster updates even when everything appears healthy. The issue isn’t a missing Key Vault, but …
News | Azure Local 2606
Azure Local’s June 2026 update (version 2606, build 12.2606.1003.205) is a maintenance release focused on reliability and bug fixes, moving the OS to build 26100.32995 and refreshing the .NET …
Azure Local | The Sovereign Cloud Reality Check
When Microsoft renamed Azure Stack HCI to Azure Local, the rebrand felt cosmetic. It was not. Azure Local has become the foundation of Microsoft’s Sovereign Cloud, with connected, hybrid, and fully …
Microsoft MVP
As of today I (Alex ter Neuzen) am a Microsoft MVP in the category Microsoft Azure. I have been writing these blogs lately and Microsoft gave me the…
News | Azure Local 2605
Azure Local 2605 is out (12.2605.1003.210, OS 26100.32860, released 28 May 2026). It closes out the unintended Azure Local VM deletion incident and unblocks Solution and SBE updates. Same-day hotfixes …
News | Azure Local Urgent Heads-Up
Azure Local moves fast, and most of the time that is a good thing. Every few weeks there is a new release, a new feature, a new way to make life on-prem feel a bit more like Azure. But once in a while …
Azure Local | HomeLab – Fixing a Failed Cluster Build
Validation passed. The build didn’t. Deploying Azure Local 2604 with Local Identity and Azure Key Vault through the portal looked straightforward — until step 0.16 hit a wall and refused to move. What …
Azure Local | HomeLab – Restore VM
When you restore a virtual machine on Azure Local using Azure Backup or Veeam, you get the Hyper-V workload back, but the Arc object is gone. Microsoft does not support ReHydration, meaning the VM …
Azure Local | HomeLab – Local Identity with Azure KeyVault
This setup is used to validate a new feature and is part of a dedicated test environment. Please note that this functionality is still in preview. More details…
Azure Local | HomeLab – Disaster Recovery
The Disaster Recovery capability for Azure Local is currently in preview, but it already offers enough functionality for meaningful evaluation and testing. Exploring this feature early provides …
News | Azure Local 2604
Azure Local 2604 lifts a lot of historical ceilings. SAN storage and disaggregated deployments go GA, breaking the 16 node limit and letting compute and storage scale independently. GPU acceleration …
Tool | Azure Landing Zone Documenter
Azure Landing Zones are the foundation of secure and scalable Azure platforms, but documentation often falls behind as environments evolve. Azure Landing Zone Documenter is an open‑source tool that …
Azure | Azure Landing Zone (test purposes)
An Azure Landing Zone provides a secure, scalable foundation for deploying workloads in Azure. In this post, we explore how a well‑designed landing zone helps organizations establish governance, …
Azure Local | HomeLab – Azure Backup
Azure Local brings cloud innovation closer to your datacenter, and pairing it with Azure Backup through a Recovery Services Vault delivers a robust, enterprise‑grade protection strategy. By …
News | Azure Local 2603
Azure Local 2603 continues Microsoft’s push toward a fully cloud‑consistent hybrid platform. With a new OS baseline aligned to Windows Server 2025, .NET 8.0 updates, and improved AKS support, this …
Azure Local | Bicep – Virtual Machines
Deploying virtual machines to Azure Local becomes far more reliable and repeatable when using Azure Bicep together with Azure DevOps. By defining your infrastructure as code and automating deployment …
Tool | Azure Local Documenter
Azure Local (formerly Azure Stack HCI) is often deployed for very good reasons: data sovereignty, low latency, regulatory requirements, or hybrid resilience. But once it’s live, a familiar…
Tool | Azure Virtual Desktop Documenter
As AVD environments grow, documentation often falls behind—becoming outdated, incomplete, or missing entirely. Documenter for Azure Virtual Desktop solves this by automatically inventorying your AVD …
Azure Local | HomeLab – Custom Image Automation
Using Azure Compute Gallery simplifies managing and distributing standardized VM images across hybrid environments. By leveraging centrally curated, versioned images, organizations can seamlessly copy …
Azure Local | DevOps – Custom Image Part II
This DevOps pipeline automates the full lifecycle of images in an Azure Local environment. It analyzes existing versions, applies retention rules, and identifies outdated images for cleanup. Temporary …
Azure Local | DevOps – Custom Image Part I
This DevOps pipeline automates the replication of images from the Azure Compute Gallery to Azure Local. It validates the environment, imports the latest image version, cleans up temporary resources, …
Azure Local | HomeLab – FSLogix
FSLogix simplifies user profile management for Azure Virtual Desktop by storing profiles in VHD(X) containers, ensuring fast logins and consistent experiences across sessions. By redirecting profiles …
Azure Local | HomeLab – Add Storage and SoFS
In this guide, we explore how to expand storage on your Azure Local home lab node and enable Scale-Out File Server (SOFS) for high availability. With SOFS, you can publish continuously available SMB …
Azure Local | HomeLab – Azure Virtual Desktop III
Deploying Azure Virtual Desktop session hosts to Azure Local delivers cloud‑native VDI performance with the advantage of local, on‑premises compute. By placing session hosts within Azure Local, …
Azure Local | HomeLab – Azure Virtual Desktop II
Configuring Azure Virtual Desktop for Azure Local brings cloud‑based flexibility together with on‑premises performance. By deploying session hosts in Azure Local, organizations can provide responsive, …
Azure Local | HomeLab – Azure Virtual Desktop
Azure Virtual Desktop on Azure Local brings enterprise‑grade performance closer to your users, and preparing RDP Shortpath is a key first step. By enabling direct UDP connectivity between endpoints …
Azure Local | HomeLab – Updating Images
Keeping Azure Local images up to date is essential for maintaining secure and reliable deployments. When the Azure portal shows a “New update available” notification, it indicates that a newer, …
Azure Local | PowerShell – Get Latest ISO image
A reliable PowerShell script can streamline the process of fetching the latest Azure Local ISO, ensuring your environment remains up to date with minimal effort. By automating version checks, …
Azure Local | HomeLab – Migrate from Hyper-V
Migrating Hyper‑V virtual machines to Azure Local opens the door to a modern, hybrid infrastructure while preserving the flexibility of your existing environment. This post walks through the full …
Azure Local | HomeLab – Windows Admin Center
Discover how to integrate Windows Admin Center (WAC) within Azure to manage your Azure Local environment efficiently. This blog explains why WAC in Azure is a game-changer for hybrid management, …
Azure Local | Bicep – Marketplace Images
Azure Local makes VM deployment feel “cloud-like,” but there’s an important difference to remember: before you can deploy a virtual machine, the image must first be created and…
Azure Local | Bicep – Logical Networks
When you deploy an Azure environment inside a complex enterprise landscape, the last thing you want is a build process that depends on manual steps, tribal knowledge, and…
Azure Local | Everything you need to know
Azure Local is designed to deliver the power of Microsoft Azure directly within your own data center. It combines the flexibility and scalability of the cloud with the control and compliance of …
Azure Local | Local Admin
In Azure Local deployments, the default local administrator account is automatically renamed during setup to enhance security and reduce exposure to common attack vectors. This change aligns with best …
Azure Local | HomeLab setup – Private Endpoints
Setting up Azure Local in a HomeLab offers a great hybrid experience, but it’s important to note that Private Endpoints are not fully supported. While Azure Local enables secure connectivity and local …
Azure Local | HomeLab setup – ARC Gateway
Azure Arc Gateway is a managed component that funnels Azure Connected Machine and Arc agent traffic through a centralized gateway, so on‑premises or edge machines only need to…
Azure Local | HomeLab – Firewall requirements
Azure Local brings cloud services into your data center, but secure connectivity depends on proper firewall configuration. Internal rules must allow Active Directory, DNS, and NTP traffic, while …
Azure Local | HomeLab setup – Part III
Building an Azure Local cluster is the foundation for high availability and scalability in your hybrid environment. The process involves deploying multiple nodes, configuring networking, and enabling …
Azure Local | HomeLab setup – Part II
Setting up an Azure Local node in Hyper‑V lets you build a safe, repeatable lab for hybrid management. Create a Windows Server VM, enable nested virtualization, install Azure Stack HCI bits, and …
Azure Local | HomeLab setup
Building a HomeLab with Hyper-V is a great way to explore virtualization and enterprise-grade technologies from the comfort of your home. This setup allows you to create virtual machines, test network …
Alex ter Neuzen
2024
Azure Virtual Desktop | Sessionhosts monitoring
August 31th 2024 the Log Analytics Agent will be deprecated. Replace it with the Azure Monitor Agent. Use this blog to get to know how and setup an Azure Policy to automate it for you.
Azure | Secure Azure Virtual Desktop with MFA !!UPDATE!!
Since my last post in 2023 there is something changed. You are able to set SSO for Entra ID to login to Azure Virtual Desktop. If you have a Conditional Access Policy which is targeted to Azure …
Azure Virtual Desktop | SSO for Entra Joined AVD
Everytime a user connects to a new sessionhost within Azure Virtual Deskop, it will need to provide consent. It’s annoying and frustrating for a user and only remembered for x amout of days. User a …
Azure Virtual Desktop | Intune – Set Timezone
Setting the correct timezone and formatting of time using Intune for Azure Virtual Desktop session hosts.
Azure Virtual Desktop | FSLogix App Masking with Entra Joined Devices IV
Using Local security groups with AzureAD members which are attached to app masking assignment rules. Get those users from a CSV and add them to the local groups.
Azure Virtual Desktop | FSLogix App Masking with Entra Joined Devices III
After the creating of the function app, we need to create the app masking rules and assignments. Create local groups and the rules to upload to the blob storage.
Azure Virtual Desktop | FSLogix App Masking with Entra Joined Devices II
Create an Azure Function to get all members of application security groups and upload csv’s with UPN’s to Azure Blob Storage.
Azure Virtual Desktop | FSLogix App Masking with Entra Joined Devices I
Using FSLogix AppMasking on Entra Joined Azure Virtual Desktop. Not supported, but hey there is a work around. Using Azure Function and some PowerShell, you can use AppMasking within Azure Virtual …
Azure Virtual Desktop | Add custom Language Pack to Golden Image
Adding a language to a golden image can be done different ways. You can do it by scripting which is provided by Microsoft or use a private repository. Spoiler alert: We show you how to add a language …
Azure Virtual Desktop | Schedule Image Builds
In previous posts we have seen how to create a vanilla image build. It’s recommended to keep your image as vanilla as possible. That means there are no…
Azure Virtual Desktop | Image Builder part III
Using the first and the second post, concludes how this all comes together with the ImageBuilder and its process. Finish the ImageBuild template and start building a GoldenImage
Azure Virtual Desktop | Image Builder part II
The second part of Azure Image Builder and how to setup a correct build for a GoldenImage. Preparations in Azure are needed.
Azure Virtual Desktop | Image Builder part I
Azure Virtual Desktop (AVD) is a desktop and app virtualization service running on the cloud. It’s the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session …
Azure Virtual Desktop | The complete setup guide
In the last few months it was a journey to get to know about all the inns and outs of azure virtual desktop. During my journey I have written blogs about it and share them with you.
2023
Microsoft Teams | Provisioning private channels
Creating a teams with a private channel causes that the drive for the private channel will not be available until you click the files tab. In automation this is not what you want, so let’s see how we …
Microsoft Teams | Create Channel from Microsoft Teams Form
As an admin you want control over the creation of Teams channels or folder structures. Not every user is capable to provision channels the correct way. Disable the default for users to create but …
BOOK | Exam Ref AZ-801
I’m thrilled to inform you that the last months I have been doing the Technical Review for Exam Ref AZ-801: Configuring Windows Server Hybrid Advanced Services. Configuring Windows…
M365 Tenant to Tenant | Avepoint
Tenant to Tenant migration are more common these days. Mergers and divestitures are struggling with multiple tenants. Using AvePoint Fly can be a solution to combine the tenants and have only one …
Azure Active Directory | Cloud-Only Administrative Accounts
Coming from an on-premises environment, it can be hard how to setup administrative accounts. On-premises was the default to have certain permissions. In Azure Active Directory that is a bit changed. …
M365 Tenant to Tenant | BitTitan
Tenant to Tenant migration are more common these days. Mergers and divestitures are struggling with multiple tenants. Using BitTitan can be a solution to combine the tenants and have only one …
Terraform | Azure Virtual Desktop
Azure Virtual Desktop deployment with Terraform enables organizations to automate the provisioning and management of virtual desktop infrastructure in Microsoft Azure. Terraform provides a declarative …
Microsoft Entra | Secure Azure AD Tenant
Securing your Azure Active Directory is more needed than ever. Microsoft Entra is the new Admin center for this. Learn how to set it up and secure your tenant more.
Azure | Get Notified when Break Glass account is used
A Break Glass Account is an emergency account that grants access to critical resources when regular credentials are unavailable. It plays a vital role in ensuring business continuity during a crisis …
Azure | Secure Azure Virtual Desktop with MFA
Learn how to secure your Azure Virtual Desktop with conditional access and Azure MFA. Protect your organization from potential security attacks. Take steps now to create a powerful remote work …
Azure | Deploy Azure Virtual Desktop
Using Azure Virtual Desktop as a replacement for Microsoft Remote Desktop Services. Get to know how to setup and the benefits about the new CLOUD solution.
E-Mail | MTA-STS
Secure email transmission is vital for everyone, and MTA-STS is here to solve the problem. Learn what MTA-STS is, how it works, and why domain should implement it now!
E-Mail | Security setup DMARC
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a method of email authentication that builds upon the DKIM and SPF (Sender Policy Framework) protocols. DMARC allows domain …
E-Mail | Security setup DKIM
DKIM (DomainKeys Identified Mail) is a method of email authentication that uses public key cryptography to verify that an email message was sent by the legitimate sender and has not been modified in …
E-Mail | Security setup SPF
SPF (Sender Policy Framework) records is a standard to help your battle against spam. It is an email authentication standard that protects senders and recipients from spam, spoofing and phishing. By …
Graph API | Function to retrieve data until all is retrieved
Graph API will only result the first 999 results with an odata.nextlink parameter. In this function we will use this parameter to add the rest of the “next page” untill all is retrieved.
Terraform | Deploy Virtual Machines to AWS
Before we used Terraform to deploy virtual machines with needed resources to Azure. Now we are using Terraform to accomplish the same to AWS. A Blogpost about the ins and outs.
Terraform | Deploy Virtual Machines to Azure
Before we used Azure Bicep to deploy virtual machines with needed resources to Azure. Now we are using Terraform to accomplish the same. A Blogpost about the ins and outs.
Azure Bicep | Deploy Virtual Machines
Using Azure Bicep will give you the the control of deployment of resources in Azure. Every time deploying the bicep will check if the desired state still is available or needs to be changed. Using it …
Azure Active Directory Assessment | Part VI
In this part we are going to get all RBAC roles for Azure Active Directory and their members. Some identities are Eligible and some are Active. An overview of the status is needed to see if there is …
Azure Active Directory Assessment | Part V
In this part we will get an export of the Conditional Access Policies and App Regsitrations and Enterprise Applications with there API permissions. Also the client secret or certificate information …
Azure Active Directory Assessment | Part IV
In this part we will take a look how to retrieve the licenses and organization information. We are going to use this information to write a small report at the end of the assessment.
Azure Active Directory Assessment | Part III
Starting the assessment is to get all the users, groups and devices and their attributes.
Azure Active Directory Assessment | Part II
To start the assessment, there is a need of an app registration with the correct permissions. Creating it through portal and with PowerShell and saving the connection details to an XML file.
Azure Active Directory Assessment | Part I
With the use of Azure Active Directory and multiple administrator, the chance that it is going to be messy is big. To check if everything is correct created and managed, you can do an assessment.
Active Directory | Setup Test Domain Controller
Using Azure Active Directory in a production environment is not a place to play around and to test. For that you can setup a new domain controller with some fictive users and groups. Let’s set it up …
Azure Active Directory | Cross tenant synchronization
These days are more and more companies working in Azure Active Directory. They are using Azure AD Connect to synchronize those accounts from on-premises Active Directory to Azure Active Directory. …
M365 Migration | Exchange Inventory v2
Being able to do a proper Exchange migration (on-premises to online or online to online), you will need a good inventory. Now we improved the scripting to speed it up.
Azure Active Directory | Authentication Policies
SSPR and MFA policies are changing. Security levels must increase. Microsoft has announced that legacy multifactor authentication and self-service password reset policies will be deprecated in January …
M365 Cross Tenant Migration | Part V
After the migration, the SMTP domain needs to be moved. Disable all the references to the domain and remove from source tenant. Add the domain to the target tenant and add the original primary smtp …
M365 Migration | Exchange Inventory
Being able to do a proper Exchange migration (on-premises to online or online to online), you will need a good inventory. Let’s get some information from Exchange.
M365 Cross Tenant Migration | Part IV
Migrating users can be done with the migration endpoint. Distribution lists are not supported to be migrated, so you need to do it manually.
M365 Migration | Exchange Unattended App Registration
Creating an app registration and saving that information can be risky. Just creating through powershell with a generated password and saving encrypted to XML is a solution…
M365 Cross Tenant Migration | Part III
Creating migration batches for the users that are created for migration.
M365 Cross Tenant Migration | Part II
Preparing users that needs to be migrated between tenants. In the target tenant you need to create mail users with specific information from the source tenant.
M365 Cross Tenant Migration | Part I
At the 1st. of November 2022 Microsoft released the Cross Tenant User Data Migration option in M365. Giving administrators to consolidate multiple tenants to a single tenant.