We saved 1006 meatballs!

On 12 February 2026, my client organized a hackathon themed around FinOps. The goal was to come up with innovative solutions to optimize cloud costs for non-production environments.

Big spenders

During the hackathon, we discovered that our non-production environments were running 24/7, which was a significant contributor to our cloud costs. We also identified three major Azure resources that were particularly expensive:

• Azure App Service
• Azure SQL Database
• Log analytics workspaces

Azure App Service

Nobody is using the app service on Development at night, so let’s save money. We have scripted to downscale the app service plans and turn off app services at night.

To achieve direct results during this hackathon we minified the scope to only the acceptance environment and the second (shadow) region. We only needed this region when we are doing failover testing, wich was already implemented in a pipeline. This meant that we could turn off the app services in this region for the rest of the time, which resulted in significant cost savings, by our calculations we saved 1006 meatballs!

Azure SQL Database

We have not done something for our Azure SQL Databases yet, but we discovered that we could potentially save money by switching from DTU based to vCore based pricing. This would allow us to scale down the databases during non-working hours and scale them up when needed. We will explore this option further in the future.

Log analytics workspaces

We investigated our log analytics workspaces and found that there was already ahead of the hackathon a big ingestion spike was resolved. I would like to reccomend companies to set alerting on the price of their log analytics workspaces, so that they can quickly identify and resolve any unexpected cost spikes.

Also if you are an engineer and looking to save some money on your application insights. I blogged about this topic before:

• Learn how to verify the biggest costs of your Log Analytics workspace.
• Duplicate logging in Azure Log Analytics / Application Insights.

Learnings

I learned three key lessons from this hackathon:

1. Non-production environments can be a significant cost driver: It’s important to regularly review and optimize non-production environments to avoid unnecessary costs. If nobody is using the resources, isn’t it a waste of money and energy to keep them running?
2. You think you are doing well, but there is always room for improvement: Even though we had already implemented some cost-saving measures, we still found significant opportunities for further optimization.
3. Quantifying costs by using a relatable metric (like meatballs) can help to communicate the impact of cost-saving measures in a more engaging way.

5 lenses of FinOps

The FinOps Framework also has an assesment tool and it has 5 lenses to look at your FinOps maturity:

1. Knowledge: Do teams know what they are spending in the cloud?
2. Process: Is there a process in place to manage cloud costs?
3. Metrics: Are there metrics in place to track cloud costs and identify areas for optimization?
4. Adoption: Is the mindset of cost optimization adopted across the organization?
5. Automation: Are there automated processes in place to optimize cloud costs?

See https://www.finops.org/wg/finops-assessment/ for the full assesment tool and more details on the 5 lenses. They apply a scoring system to assess the maturity of an organization’s FinOps practices across these lenses.

In our presentation at the end of the day we shared our findings using these 5 lenses, which helped to structure our learnings and recommendations for future improvements.

Cleanup Friday

Let’s take this habit of cleaning up non-production environments to the next level.

I think it will be perfect to establish a “Cleanup Friday” routine. Clean your desk, clean your cloud environment. Every Friday, we can dedicate time to review and clean up our non-production resources. This can include:

• Deleting unused resources
• Automating scaling down resources that are not needed at full capacity
• Reviewing and optimizing resource configurations for cost savings

The day after I think i also saved an extra 214 monthly meatballs by deleting proof of concept resources nobody looked at for months.

Let’s make Cleanup Friday a tradition!

References

• https://www.finops.org/framework/

The price of the client’s meatball in their cafetaria is €2,33. I can recommend the meatballs, however they are hybrid balls, so half meat half vegan. Still delicious though, but honerable mention to the other half of the meatball, the vegan part.

Azure overwrites deployments

Azure Resource Manager (ARM) is the control plane of Azure that executes all deployments, regardless of whether you use Bicep or ARM templates to describe your desired state. When you deploy with the same name, ARM treats it as an update to the existing deployment. This means that if you use a static name for your deployments, each new deployment will overwrite the previous one. This can lead to confusion and makes it difficult to track changes over time.

You may encounter a limit on the number of deployments you can have in a resource group. This limit is 800 deployments. When you reached this limit before 2020, you had to delete old deployments manually. However, since 2020, Azure automatically cleans up old deployments, so this is less of a concern now.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-history-deletions?tabs=azure-powershell

Concurrent deployments with the same name

A common issue occurs when two deployments with the same name execute simultaneously. This often happens unintentionally when multiple modules within a larger deployment receive the same deployment name. The deployment will fail with an error indicating a conflict, though the exact error message can vary. To avoid this, ensure that each module deployment receives a unique name, especially when deploying multiple instances of the same module in parallel.

Constraints

When naming your deployments, keep in mind the following constraints:

• Deployment names must be unique within a resource group.
• Deployment names can contain alphanumeric characters, hyphens, and underscores.
• Deployment names cannot exceed 64 characters in length.

When using modules you want to ensure the deployment names are also unique within the scope of the module deployment.

Naming strategy

To avoid overwriting deployments and to keep track of changes, it’s a good practice to use a unique naming strategy for each deployment. Here are some common approaches:

1. Timestamp: Append a timestamp to the deployment name. This ensures that each deployment has a unique name based on the date and time it was created. Example: myDeployment_20231119T075428
2. Versioning: Use a version number in the deployment name. This can be:
   • Build number from your CI/CD pipeline (e.g., myDeployment_12345)
   • Semantic version when using tools like GitVersion (e.g., myDeployment_1.2.3)
   • Git commit hash for traceability to source code (e.g., myDeployment_a1b2c3d)
   • PR number when deploying from pull requests (e.g., myDeployment_PR-123)
3. Combination: Combine both timestamp and versioning for even more clarity. Example: myDeployment_v1_20231119T075428
4. Unique Identifiers: Use GUIDs or other unique identifiers to ensure uniqueness. Example: myDeployment_123e4567-e89b-12d3-a456-426614174000

Naming starts in your CI CD pipeline

When deploying from a CI/CD pipeline, you can generate a unique deployment name using the pipeline’s built-in variables. For example, in Azure DevOps, you can use the build ID or timestamp to create a unique name.

1
2
3
4
5

steps:
  - task: AzureResourceManagerTemplateDeployment@3
    inputs:
     deploymentName: '$(Build.BuildId)'
     # Other deployment inputs

Or using the Azure CLI in yaml:

1
2
3
4
5
6

steps:
  - script: |
      az deployment group create
        --resource-group myResourceGroup
        --template-file main.bicep
        --name "$(Date:yyyyMMddTHHmmss)"

Or using the build number:

1
2
3
4
5
6

steps:
  - script: |
      az deployment group create
        --resource-group myResourceGroup
        --template-file main.bicep
        --name "$(Build.BuildId)"

In Github Actions, you can use the github.run_id or github.run_number to create a unique deployment name.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to Azure
        run: |
          az deployment group create
            --resource-group myResourceGroup
            --template-file main.bicep
            --name "${{ github.run_id }}"

Bicep sample for timestamp naming

The utcNow() function in Bicep can only be used as a default value for parameters, and must be provided at deployment time. You cannot use it directly in variable assignments or resource names. Here’s how you can use it to create unique module deployment names:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// main.bicep
param timestamp string = utcNow('yyyyMMddTHHmmss')

module storage 'modules/storage.bicep' = {
  name: 'storage-${timestamp}'
  params: {
    storageAccountName: 'mystorageacct'
  }
}

module keyvault 'modules/keyvault.bicep' = {
  name: 'keyvault-${timestamp}'
  params: {
    vaultName: 'mykeyvault'
  }
}

User defined function for naming

You can create a user-defined function in Bicep to generate a unique deployment name based on your preferred strategy.

This example function creates a prefixed name and ensures it does not exceed 64 characters: If the name exceeds 64 characters, the deployment will still fail, but you can adjust the logic as needed.

1
2
3

@export()
@description('Returns a module name with a prefix and ensures the name is at most 64 characters')
func prefixedName(suffix string) string => length('${az.deployment().name}-${suffix}') > 64 ? substring('${az.deployment().name}-${suffix}', 0, 64) : '${az.deployment().name}-${suffix}'

So to fix this, we want a suffix that ensures the name is unique and fits within the constraints. When the base name exceeds the max length, we truncate it to fit.

1
2
3
4
5
6
7

@export()
@description('Returns a module name with a prefix and ensures the name is at most 64 characters')
func prefixedName(suffix string) string {
  var baseName = '${az.deployment().name}-${suffix}'
  var maxLength = 64
  return length(baseName) > maxLength ? substring(baseName, 0, maxLength) : baseName
}

Conclusion and discussion

Make sure deployment names are unique. Module names no longer need to be unique, but using unique names can be preferred when you want to easily see which build belongs to which deployment. Using timestamps or build IDs from your CI/CD pipeline can help ensure uniqueness and avoid overwriting deployments.

Let’s be happy to know you don’t hit the deployment limit anymore 🎉.

“I can’t believe how much you get done, and running your family with children.” - a few colleagues

In this article I want to tell you about the workflows and habits that got me started with podcasting and how to keep blogging regularly. I will also share some of my personal goals for 2026 and new workflows I have or will adopt.

Everytime you do something often, it is good to invest in optimizing the workflow. In some books like Tiny Habits and Atomic Habits they say small changes can lead to great things over time. Also there is a thing called ‘de drempel’ in Dutch, which means ’the threshold’. The idea is that when you lower the threshold to start something, you are more likely to start doing it. This is why it for me it is important that if I want to blog, it should be as easy as possible to just start.

Also i tend to focus on doing things fast and ask for feedback as soon as I can. This means that my current workflow is writing a post pushing it to a test environment and asking for feedback.

In 2025 I also used my blog to write the information what i also were using for presenting. this way I could reuse content and be certain that the content was available for people after the presentations.

It looks like I have a lot of workflows going on, but in reality I focus on one at the time. Setting my own goals and deadlines helps me to focus on one thing at the time. Setting concrete goals continually lets me learn and feel what I am capable of.

Workflows

Let’s talk about workflows. I have optimized my workflows for podcasting and blogging. It is just like Agile, start with something small and improve it over time. And focussing on the most important parts first. In this article I will share with you some cool workflows on different thinks I work on.

Podcast

To get started with podcasting Peter and I discussed how to start and what tools to use. Peter tended to act a lot more like Eric, hold back and rethink everthing. I was more of a Ryan “let’s just do it” kind of person. I want to share with you how we set up our podcasting workflow.

Read about Eric and Ryan in my blog post: Meet Ryan and Eric

Recording

We wanted to keep things simple and use tools we already had. So we used what we had available:

• Microphones: Two sets of Rode Wireless GO II
• Recording Software: Rode Connect

Editing

For editing, we decided to use Audacity, a free and open-source audio editing software. It offers all the basic features we needed to clean up our recordings, add intros/outros, and adjust audio levels. But to edit a full episode using audacity is still quite a bit of work. That is why we we looked into alternatives.

AI-Powered Transcription

To streamline the editing process, we explored AI-powered transcription services. To do this i created a .NET console application that used Whisper.Net to transcribe our recordings. This allowed us to quickly identify sections that needed editing without having to listen to the entire recording.

See the code on GitHub: https://github.com/martdegraaf/TranscribePodcast

The output was good enough but not good enough to use for a workflow within Audacity.

Online AI powered services

We also experimented with online AI-powered services that offer podcast editing features. These platforms can automatically remove filler words, background noise, and even suggest improvements to the audio quality. This significantly reduced the time we spent on manual editing.

The tools we used for this were:

• Auphonic: For automatic audio post-production.
• Trebble.fm: For AI-driven podcast editing and enhancements.

Podcast naming

We prioritized recording over naming our podcast. So we decided to come up with a name after recording the first episode. We decided to name our podast “Oogkleppen” which translates to “Blinders” in English. The name reflects our focus on discussing topics from a unique perspective, challenging conventional wisdom, and exploring new ideas.

Podcast Intro

To create a catchy intro for our podcast, we searched for royalty-free music online. We searched on https://pixabay.com/ and editted music in our spoken intro and field tested it with some friends and colleagues. The feedback was positive, and we felt the intro set the right tone for our podcast.

Blogging

After optimizing our podcasting workflow, I decided to optimize my blogging workflow as well. I mainly blog in markdown in Visual Studio Code. To streamline the process of creating new blog posts, I created a custom task in VS Code.

By using the tasks.json file I automated the process of creating a new blog post file using the hugo cli, so I only have to provide the post name and it will create the file and open it in VS Code.

So my new workflow for creating a new blog post is:

1. Use the command palette in VS Code Ctrl+Shift+P and select “Run Task”
2. Select “Hugo: New code post”
3. Enter the post name (e.g., “my-new-post”)
4. Start writing the blog post in the newly created markdown file.
5. Branch and commit your changes as usual.
6. Push and create a PR to merge my new blog post.

This will setup a test environment in Azure Static Web Apps and allow me to preview the blog post before merging it to main.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "Hugo: New code post",
      "type": "shell",
      "command": "hugo new --kind code-post posts/${input:postName}; code ${workspaceFolder}/src/blog/content/posts/${input:postName}/index.md",
      "options": {
        "cwd": "${workspaceFolder}/src/blog"
      },
      "presentation": {
        "reveal": "always",
        "panel": "shared"
      },
      "problemMatcher": []
    }
  ],
  "inputs": [
    {
      "id": "postName",
      "type": "promptString",
      "description": "Post name (e.g., my-new-post)",
      "default": "new-post"
    }
  ]
}

This post was made using this workflow and i can tell you it works great! After creating the post I also wanted to be up to date with hugo and my theme. So I Updated Hugo to the latest version and my theme to the latest version as well, this took me longer than expected but now everything is up to date.

I have many uncommitted open changes in this repository because i tend to expiriment a lot with new ideas. I fixed some issues with the latest hugo version locally but did not commit these changes, it took me 2 hours to debug and find out what was wrong. The lesson for me is to commit things more quickly and make PR’s small. Updating a theme should be a seperate pull request if you would be normally working in a team. Why would I do this differently for my own blog?

Blocking YouTube

We have kids at home. And they love YouTube. But I tell them the so-called ‘Shorts’ are videos that make them dumb. So to help them focus on better content I have blocked YouTube on our home network using AdGuard within home assistant. This helped us as parents to have more control over what content our kids can access.

Basically we as parents have been framing short videos as ‘dumb videos’ or ‘videos that make you dumb’

Our current workflow was to navigate to AdGuard, go to Filters > Block Services and search youtube in the list and disable it. But, we all know, that blocking youtube completely is not always desired. That is why I want to improve this workflow.

I wanted to have this in our dashboard with a toggle switch. So I searched for solutions and found out that AdGuard has an API that can be used to toggle services. see: https://community.home-assistant.io/t/toggling-adguard-services-from-ha-dashboard/719007

Consuming Blog posts and podcasts

For the setup of our podcast we needed to make it available for multiple platforms. Such as Spotify and Apple podcasts. Most other platforms work with RSS Feeds. So when we make the RSS Feed from Spotify available other third party platforms can also use it.

Consuming podcasts

Earlier I just used Spotify to listen to podcasts. Annoying because when you listen to music via Spotify it is difficult to find and continue the right podcast while in car. Or just always.

I can recommend listening to the podcasts: Darknet Diaries and How to take over the World. If you are Dutch, take our podcast Oogkleppen! 😉

My colleague Peter recommended using Antennapod on Android. Jan uses Pocket Casts on iOS. I installed both apps on Android, i am going to test both, and let you know. A big plus would be if a Android Auto integration is available.

Consuming blog posts

I earlier just checked content reguraly but from now on will organise blogs via Readly. RSS feeds mostly are available via /index.xml on most blogs. Some are available via /feed or /feed.rss. With Readly I can organise blogs into categories and read them when I want to.

After typing this i went on and tested my own blog to see if the feed is working. But i saw many improvements. I also tested it in Inoreader and discovered that my blog images are not showing up in the feed. So I have fixed that as well. Also my relative images in blog text were not showing up correctly so i made sure they are now absolute urls.

Making the right tactical switch

I am using a Dygma Defy keyboard for my daily work. It is a split keyboard that allows me to type more ergonomically. The keyboard has hot swappable switches. And i used the keyboard a year using linear switches. As of 2026 I have switched my right half to tactile switches. Let’s see what half i am most comfortable with.

Checkout this video about the switch choice: https://www.youtube.com/watch?v=noUj7uUyIk4

I was using Gateron G Pro 2.0 Yellow (linear) switches. I have just installed Kailh Silent Brown switches on the right half of my keyboard.

Conclusion

There will be more workflows to talk about, I am curious what workflows you have optimized. Please share them with me on LinkedIn or in the comments below.

I want you to know I started podcasting last year and the first episode went live on January 1st, 2026! 🎉 The podcast is called Oogkleppen and is recorded in Dutch.

Wrapping up 2025

I want to share some numbers here to give some insights in my 2025.

• Blog posts: 10
• Blog post as draft: 3
• Spoken on stage: 8
• Active Microsoft certifications: 5

If you think, how can this Mart do this much? Stay tuned for my next blog post in this series about my workflows for blogging, speaking and more.

Books

I read multiple books in 2025. The most impactful book was “Verbaal meesterschap” by Remco Claassen. It helped me to develop my Web Application Firewall session. I used magic tricks during the talk to engage the audience. I recommend reading this book if you want to improve your speaking skills.

The company i work for 4Dotnet celebrated its 20th anniversary in 2025. I have been working there for 5 years now. We went on a trip to Lisbon with the team. Some of the cover images of the blog posts were taken there.

Setting goals for 2026

As we step into 2026, it’s a great time to set some personal and professional goals. Here are a few goals I have set for myself this year:

• Speaking: give 6 talks, develop 1 new talk, speak at 2 new events (never spoken at before).
• Podcast: release 6 episodes, have 6 guests, decide if Peter and I want to continue.
• Health : Lose some kg, strength training 2x/week.
• Blog: Publish 12 blog posts, every last Friday of the month at 16:00.

Anti-goal 2026: Only “Fun” or “Promised”

In 2026, I commit to only engaging in activities that I either genuinely enjoy (≥7/10 energy) or have explicitly promised (clear agreement/expectation). Anything outside of that: don’t do it or renegotiate.

Review

I reviewed my goals with a peer and he asked me what my personal goals were for 2026 especially for my family. I tought about this throughly and decided to book a vacation with my family for our wedding anniversary. Thanks Peter for the great question!

All the pancakes in the world

Let us be better in 2026 by optimizing our workflows and embracing new technologies. Whether it’s podcasting or blogging, finding efficient ways to create and share content can lead to greater productivity and enjoyment. I wish you all the pancakes in the world in 2026! 🥞🎉

For my presentation “Visual Studio Code: One Tool to Rule Them All?” I created two fictional characters: Ryan and Eric. Both are software developers, but they take very different approaches to their work.

A colleague of mine suggested I write a blog post to introduce them properly. Everyone who heard my story about them immediately recognized these two archetypes. Even presenters who spoke after my session started using Ryan and Eric in their talks. So let’s give them the spotlight they deserve, right?

Meet Ryan

Have you met Ryan? Ryan is a young developer, fresh out of college. He has a couple of core qualities: he learns fast, is curious and loves new technologies. Ryan probably has more unfinished projects on his laptop than finished ones.

🤖 The images of Ryan and Eric are AI-generated using Sora, by providing my own image as input and describing the character traits.

Ryan is the kind of person who uses hip IDEs like Visual Studio Code, because it is lightweight and fast. Ideally Ryan would like to use his phone to code on the go, while watching his favorite series on Netflix.

“Move fast and fix things later.” - Ryan

When you have a Ryan on your team, you will notice that he will run before thinking his actions through. He will push fast to production, only to find out later that something is broken. But hey, at least he tried, right? And if he is just as fast to fix it again, everything is fine.

Meet Eric

Eric is a seasoned developer with years of experience. He is pragmatic, values stability and prefers to stick to tried-and-true tools. Eric will start Notepad++ to quickly format his XML or JSON or compare files. He has been using and running projects in Visual Studio for years. He jokes that you cannot write any good code in Visual Studio Code, because where is the “Play” button to start the project? Not to mention how do you debug without it?

When you have an Eric on your team, you will notice that he will take his time to think things through. He will criticize decisions beforehand knowing that changing things later will be costly. Why change when you have worked this way for years?

“If it ain’t broke, don’t fix it.” - Eric

A conversation between Ryan and Eric

If Ryan and Eric were to have a conversation, it might go something like this:

Having multiple PR’s open

Context: Eric leans back.

Writing an ADR

Context: A new framework is being discussed. Ryan is already prototyping.

Setting up SQL Server

Context: Eric is setting up his new development machine and needs SQL Server.

Ryan and Eric

These two fictional characters represent two very different behavior patterns in software development teams. Ryan pushes for speed and experimentation; Eric optimizes for stability and predictability. Most of us have both inside us, and the trick is to know when to lean into which.

Let’s introduce an example I myself encounter often: My colleague acts like Eric. He locks his computer using Ctrl+Alt+Del and selects ‘Lock’ from the menu. I think he should use Ryan to optimize his workflow. I, on the other hand, use Windows+L to lock my computer instantly. The same pattern shows up in formatting code, switching screens, or running builds: you can click your way through, or you can invest in shortcuts and automation. Ryan would use Windows+P to extend his screen while Eric would right click on his desktop and select ‘Display settings’ to do the same.

The tension between Ryan and Eric is useful. Ryan pulls the team toward new tools and faster workflows; Eric stops us from breaking production every week. Healthy teams make space for both.

Conclusion and discussion

Ryan and Eric are two fictional characters that represent two extremely different behavior patterns in software development teams. You can act like Ryan or Eric, but you should use both to balance innovation and stability. I hope Ryan and Eric will return in future blog posts as well. If you want to refer to them, you are welcome to do so. Please link back to this post.

Let’s set the mode accordingly:

1

var mode = DeadlineIsToday ? Ryan : Eric;

What about you? Are you more like Ryan or Eric? Or do you have another archetype in mind? Let me know in the comments!

Further reading

I wrote an Ryan-like article before read it here: Mart’s Cheatsheet

You can monitor your WAF using Azure Monitor. In this blog post, I will share my insights on how to set up monitoring for your WAF using workbooks.

Set up Azure Workbook

You can use the Azure WAF Monitor Workbook to monitor your WAF. This workbook provides insights into the WAF logs and helps you identify potential issues.

Get the workbook here: https://github.com/Azure/Azure-Network-Security/tree/master/Azure%20WAF/Workbook%20-%20WAF%20Monitor%20Workbook

You can deploy the workbook using the ‘Deploy to Azure’ button in the GitHub repository.

You can use this as a base for your custom Workbook.

Further Reading

• Troubleshoot your Application gateway’s WAF. (see Troubleshoot Application Gateway in Production)

Tuesday

My Tuesday started with a carpool with my colleague. We drove to Utrecht but came stuck in traffic unfortunately missed the opening keynote. For this day my tactic was to avoid AI talks, and choose on the last second what session to attend.

How building a portable escape room made me a better developer by William Brander

Session abstract: “I built a portable IoT escape room, and it changed how I think about development! In this session, we’ll uncover unexpected parallels between escape rooms and architecting resilient, scalable systems. Let me share the lessons learned, and how they translate into invaluable guidance for Domain-Driven Design (DDD), modularity, communication, scalability and fault tolerance. Doors will be unlocked at the end - even if the audience can’t solve the puzzles.”

• Key takeaways:
  • Monitoring distributed systems can be devided into 3 piramids: Monitoring Area, Conitoring Concern and Interaction Type.
    • Monitoring Area
      • Infrastructure
      • Application
      • Capability
    • Monitoring Area
      • Health
      • Performance
      • Capacity
    • Interaction Type
      • Passive
      • Reactive
      • Proactive
  • If you build systems with joy, it will be reflected in the end product.
  • William showed us his remote escape room, which was really cool.

Creating an observable cloud platform and application landscape with Azure by Alex Thissen

Session abstract: “In this session you will learn how to build and create a cloud platform for your applications that offers observability and monitoring capabilities. You are going to be introduced to the Azure resources for monitoring and operations and learn how to architect the landscape for multiple applications and business domains. Also, we will have a look at instrumenting applications with OpenTelemetry and the various patterns and practices to collect, filter and combine telemetry signals into an observable backplane. Combined with the Azure resources, the outcome is an environment that is capable to host, monitor and operate observable applications. You will see how this can help you in everyday situations in getting insights into and gaining control over your cloud-native applications running in Azure.”

• Key takeaways:
  • Alex explained perfectly what the difference is between Azure monitor and a log analytics workspace.
    • Azure Monitor is the overall service that provides a unified monitoring solution for your applications and resources in Azure. It collects, analyzes, and acts on telemetry data from various sources to help you understand the performance and health of your applications. It is managed by Azure.
    • Log Analytics Workspace is a specific component within Azure Monitor that serves as a centralized repository for storing and analyzing log data. It allows you to run queries, create visualizations, and set up alerts based on the collected log data.
  • Alex tought the eye opener was that you can view your application insights and log analytics workspace in the Azure Data Explorer. I am not really sure why this is a big advantage, but I will explore this further.
  • Alex explained that the log Analytics workspace should be a shared resource for multiple applications. This could even be in the hub environment of a landing zone.
  • There is also an Kusto Explorer available at https://aka.ms/kustoexplorer which is a desktop application to query Kusto databases. I have to try this out.
  • Alex showed a new feature Health Monitoring in Azure. This is a feature to monitor the health of your applications. It is possible to build a Health Model to show the health if dependencies are not healthy.

Delivering on Identity Solutions - practical guidance and pitfalls to avoid by Michele Leroux Bustamante

Session abstract: “Identity is a critical part to any solution - whether that solution is deployed on premises or to a cloud provider. The challenge most organizations have is lack of deep expertise with identity protocols, authentication techniques and standards, associated use cases and solution design, user management and user self-service lifecycles and the recommended best practices and necessary threat modeling to deliver a solution to production. Even when using a hosted identity provider, you are not excused from understanding how applications integrate with that provider and participate in the holistic solution, and you typically also need to build significant custom work around the user lifecycle which should also follow recommended best practices that aren’t always obvious. In this session, Michele will share recommended best practices for identity solution design and delivery, drawing examples from experience with actual customer solutions with varying requirements. The goal is to educate you on common and practical ways to approach the identity solution design while adhering to recommended best practices. You’ll get an overview of critical protocol flows, the evolving preference for SPA / BFF patterns for application integration, the challenges that arise when you let identity become “too custom” and how this impacts your choice of identity platform framework or vendor.”

• Key takeaways:
  • Every flow is deprecated except the authorization code flow with PKCE. So you should use Backends for Frontends (BFF) architecture.
  • Use no tokens in the browser. Store them in a secure cookie or use session storage.
  • Some banks do actually have access token valid for 30 days for some reason. Michele does not bank there :).
  • When you combine social with enterprise logins you have to be carefull with account linking. You don’t want that a user can link his social account to an enterprise account without verification.
  • She explained Gateway federation, wich i am familiar with. This makes use of Home realm discovery.
  • Buying some tool like Auth0 is not enough, you still have to understand identity.

Top 5 techniques for building the worst microservice system ever by William Brander

Session abstract: “Microservices come with promises of scalability, reliability, and autonomy. But if everything is so rosy, how come the only success stories we hear about are at places like Netflix or Uber? I’ve spent countless hours working on all kinds of microservice systems to come up with the definitive top 5 tips to ensure your microservices become complete disasters. Join me on a tour of insanity through some of the worst ways to make distributed mistakes.” - Key takeaways: - I think i identify with Dough the dog in the Pixar movie Up, because i am just as destracted as he is. - Five techniques to build a bad microservice architecture: 1. Put an HTTP call in front of everything 2. Do a big bang rewrite 3. Don’t use off the shelf frameworks 4. Use Nouns instead of Verbs for service boundaries 5. Conflate the logical with deployment boundaries - He explained that you should avoid these anti patterns to build a successful microservice architecture.

C# 11 + .NET 7 by Stefan Pölz

Session abstract: “Although we are capable of overloading operators for owned types with traditional C#, we cannot define generic mathematical algorithms that may be consumed by multiple types of the .NET ecosystem. Previewed in .NET 6, November 2022 marked the release of Generic Math in .NET 7. New language features of C# 11 enable both Microsoft’s BCL team and the community to ship powerful mathematical operations in data types and generic interfaces. These result in algorithms that supersede repetitive concepts, such as System.Math and System.MathF. Alongside exploring these additions to .NET, we’ll assemble our own custom type with calculations that utilizes Generic Math.”

• Key takeaways:
  • Stefan explained all types have interfaces for math operations now. For example IAdditionOperators<TSelf, TOther, TResult>.
  • https://github.com/Flash0ver
  • Cool example is that he could calculate with custom types like Bytes Gigabytes and Terabyte, all in one type.

What’s new in C# 13, 14, and beyond? by Bart de Smet

Session abstract: “Come and catch up on the most recent C# language evolution and a peek into the future. We’ll start this talk by looking at various enhancements to existing language features, such as params collections, improvements to the lock statement, null-conditional assignment, the new field keyword, and various restrictions that have been lifted around the use of ref structs. Next, we’ll have an in-depth overview of the new extension member support, finally enabling extension properties and indexers. To finish the talk, we’ll look at brand new features slated for upcoming versions, such as dictionary expressions, union types, and more.”

• Key takeaways:
  • the extension members are coming to C# 13. This makes it possible to add methods to existing types without modifying their source code.
  • Some things are improved to get a Span in a params array.
  • Null-conditional assignment in C# 14: customer?.Order = GetOrder();

https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-13

https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-14

Wednesday

Wednesday was starting early, we had to vote for the Dutch elections first before going to the conference center. After that I attended the following sessions.

Kafka for .NET Developers by Ian Cooper

Session abstract: “Kafka is a low-latency streaming solution with a rich ecosystem of tools such as Kafka Connect and Flink, but is less well-known to .NET developers. In this session we will introduce Kafka, explaining the mysteries of records, offsets, SerDes and schema registries, in-sync replicas, partitions and tools like Connect and Flink. There will be code, as we work with examples in .NET of using as a messaging solution in your applications. By the end of this session you should feel comfortable with the concepts required to use Kafka as a .NET developer.”

• Key takeaways:
  • Kafka is async messaging system with topics and partitions.
  • If your code fails, it can reprocess messages from a specific offset. If it keeps failing, you can move the offset forward to skip bad messages, but according to Ian, you should have gotten a queue instead of Kafka then.
  • Every partition can be consumed by only one consumer in a consumer group. This has it’s own offset.
  • There is something called Kraft. Zookeeper was something old. Kraft can elect the leader nodes itself.
  • There is a setting called: EnableAutoOffsetStore which can be set to false to manage offsets yourself. Otherwise the offset is stored after each message is read. This can lead to message loss if your processing fails after reading the message but before processing it.
  • There is something called sticky partitions. This makes sure that messages with the same key always go to the same partition. This is usefull for ordering of messages.
  • Messages in Kafka are mostly in Avro, JSON or Protobuf format.

Scaling Azure Container Apps: maximize performance and minimize costs by Anthony Chu

Session abstract: “Azure Container Apps is a fully managed serverless container platform that allows you to run containerized workloads at scale. By using the correct scaling strategies and pricing plans, you can maximize performance and minimize costs of your Azure Container Apps workloads. In this session, we’ll show you how to scale container apps and jobs on Azure Container Apps using its built-in KEDA scalers. Whether you’re running a small app or a large-scale microservice application, we’ll show you how to build and scale your containerized workloads on Azure Container Apps to maximize performance and minimize costs.”

• Key takeaways:
  • You can create container apps with dedicated GPU support now.
  • You can use KEDA scalers to scale your container apps based on anything. For example eventhubs blobs service bus via Managed Identity.
  • On top of KEDA Azure Container Apps can scale based on HTTP request.

Debugging Like a Coach: Fixing Team Bugs Before They Crash the Game by Amber Vanderburg

Session abstract: “Every developer knows how to debug bad code—but how good are you at debugging a bad team dynamic? In sports, coaches analyze real-time data, player behavior, and performance breakdowns to fix issues before they cause the game. Yet in tech, we often let misaligned teams, inefficient workflows, and poor communication go unchecked—until we hit a major release failure or a full-on team meltdown. This session will show you how to apply the coaching mindset to engineering leadership, using game film analysis, real-time feedback loops, and proactive team debugging to prevent small misalignments from becoming full-blown disasters. You’ll learn how to spot early warning signs of dysfunction, use data-driven decision-making to optimize team performance, and run post-mortems that actually lead to change (not just another boring meeting). If you can debug a program, you can debug a team—let’s break down the playbook. Learning Objectives: -Identify the “silent bugs” in tech teams—bottlenecks, misalignment, and ineffective communication—that hurt performance but often go unnoticed. -Use data-driven coaching techniques from pro sports (real-time analytics, film reviews, and performance tracking) to improve engineering team efficiency. -Learn how to run engineering retrospectives like a game tape review—breaking down past plays to improve future execution. -Apply in-the-moment coaching strategies to fix issues before they derail sprints—just like a coach making mid-game adjustments. -Develop a “team debugging” toolkit that ensures every project iteration is smoother, faster, and more efficient than the last. Bonus: We’ll do a live debugging session—not of code, but of common team dysfunctions—and break down exactly how to fix them.”

• Key takeaways:
  • Books:
    • 5 Dysfunctions of a team
    • Crucial conversations
    • Only the paranoid survive
  • There is a difference between a personal need and a practical need. Get rid of the personal need first to make it easier to handle the practical need.
  • Use sentices like “Help me understand…” to get more information.
  • To make desicions in a team use ELMO (Enough, let’s move on). And time box the discussion.
  • You should ‘map your script’. Write down what you want to say and what the other person would say. This helps you to prepare for difficult conversations. Flip the script by changing your perspective.
  • If you want to change behavior give feedback with this format: | What behaviour unwanted happened | Why | | What alternative behaviour wanted is expected| Why | | Clarify expectations |

Avoiding common pitfalls with async/await by Stephen Cleary

Session abstract: “Did you know that most async/await mistakes are the result of misconceptions? Join this talk to discover how to detect common async/await mistakes, and how to fix them! We’ll be covering What You Need To Know about async/await in C#, including several different correct conceptual models of async/await that you can switch between at will. We will take a look at the common async pitfalls, best practices, and guidelines along with a careful examination of when to ignore the best practices. We’ll be including some semi-advanced topics (specifically ValueTasks and Channels) to round out techniques for modern asynchronous development. While this talk is geared towards developers who already use async and await, it would also be appropriate for those who do not (yet). Feel free to bring questions!” - Key takeaways: - USE ASYNC and AWAIT keywords always. Dont run in to deadlocks. - Avoid async void methods, except for event handlers in UI code. - Avoid using Task.Run in ASP.NET code. It does not help you except in UI code. - https://stephencleary.com - Task represents a methods execution. It as a completion, results and exceptions. - Async wraps the Task. - await unwraps the Task. - Don’t run async code in constructors

All-Time Sportiest Hacks by Eric de Maar

Session abstract: “In the high-stakes world of professional sports; data is the new gold, and hackers know it. From stolen medical records of star athletes to espionage between rival teams, the digital frontier has become as contested as the playing field itself. In this special talk, Eric de Maar, the creator of Hack the Bank, takes you on a thrilling journey through the most shocking sports-related hacks of all time. Discover how attackers infiltrated supposedly secure networks, manipulated sensitive information for competitive advantage and exposed organisations for corruption. You’ll gain a front-row seat to tales of cyber sabotage that influenced World Cups and Olympics. Prepare to be challenged and inspired, because in the sport of security, every second counts.”

• Key takeaways:
  • FIA got hacked because of broken register form, which allowed role attributes.
  • You should bring your adapter when you are speaking at conferences.

Influencing

I wanted to go to the influencing session but it was a “Stairs session”, as in a full room. Thats why i decided to explore some stands instead.

Ending keynote - Robert Doornbos

Amazing keynote about racing and many insights in the racing world. I learned about the value of teamwork, preparation, and focus. And also the real value of a formula 1 car, which is $12 to $16 million. I have watched the last couple of seasons and getting the insights from Robert was really cool.

Conclusion and key learnings

I have learned a lot during Techorama 2025. I even won a Lego set of the Red Bull signed by Robert Doornbos.

You implemented an Application Gateway with Web Application Firewall (WAF) in front of your web applications in Azure. Everything seems to be working fine, but suddenly you notice some issues. Maybe some users report that they cannot access the application, or you see unusual traffic patterns in your logs. In this blog, we will discuss how to troubleshoot common issues with Application Gateway in production.

Mr Havinga

Imagine you are Mr. Havinga, a normal Dutch person. You want to buy a new phone, but when you try to access the online store, you get a 403 Forbidden error. You are blocked! The firewall blocked you because the request matched a WAF rule. HAVING is a SQL keyword the WAF triggered a SQL Injection rule. What if this would happen if you do this during more general processes like paying your taxes or applying for a loan? It is extremely important to identify false positives and tune your WAF rules accordingly to prevent blocking legitimate traffic.

403 Forbidden

When users report that they receive a 403 Forbidden error when trying to access the application, it is often due to WAF rules blocking legitimate traffic. You should be aware that the WAF is a different layer than your application.

Application Insights doesn’t know

When a request is blocked by the WAF, it may not be logged in Application Insights. This can make it difficult to troubleshoot issues, as you won’t see any telemetry for the blocked requests. To get around this, you can enable diagnostic logging for your Application Gateway. This will log all requests, including those blocked by the WAF, to your Log Analytics workspace. You will need to search on the log analytics workspace and not in the application insights resource to get a full picture of the situation.

You can enable diagnostic logging in the Azure portal by navigating to your Application Gateway, selecting “Diagnostics settings,” and configuring a new diagnostic setting to send logs to your Log Analytics workspace.

Watch out for generalisation

In a project there was builtin that when the frontend received a 403 on any request it would redirect to the login page. It was extremely frustrating because the page it happened on was anonymous. After investigation we found out that the WAF was blocking some requests because of false positives. The redirection to the login page made it seem like an authentication issue, while it was actually a WAF issue.

If you have this aswell, you can edit the code to show a specific error message when a 403 is received from the Application. Here is an example of how to do this in bicep for the WAF policy. Let’s make it more fun by changing the status code to 418 (I’m a teapot) instead of the standard 403.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

resource applicationGatewayWAFPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2024-10-01' = {
  name: 'WafPolicy'
  location: 'West Europe'
  properties: {
    managedRules: {
      managedRuleSets: [
        //trimmed
      ]
    }
    policySettings: {
      customBlockResponseStatusCode: 418
      customBlockResponseBody: base64('Oops! Your request was blocked by the WAF. But don\'t worry, I\'m just a teapot!')
      mode: 'Prevention'
    }
  }
}

Investigate in your log analytics workspace

First, check the logs in your Log Analytics workspace. Look for entries that indicate blocked requests. You can filter the logs by status code 403 to see which requests were blocked.

AzureDiagnostics
| where Category == "ApplicationGatewayFirewallLog"
| where action_s == "Blocked" or action_s == "Matched"
| order by TimeGenerated

It is important to know that the WAF logs are logging Matches and Blocked actions together and will Block if the after ‘Inbound Anomaly Score Exceeded (Total Score: 5)’.

Identify the blocking rule

Once you have identified the blocked requests, look for the ruleId_s field in the logs. This field indicates which WAF rule blocked the request. You can then look up this rule in the OWASP ModSecurity Core Rule Set to understand why it was triggered.

To know more about the specific rule that was triggered, you can see the list on Microsoft Docs.

Create an exclusion rule

If you determine that the blocking rule is causing false positives, you can create an exclusion rule in your WAF policy. This allows you to exclude specific requests from being evaluated by certain rules.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

resource applicationGatewayWAFPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2024-10-01' = {
  name: 'WafPolicy'
  location: 'West Europe'
  tags: {
    Environment: 'Dev'
    'hidden-title': 'Smart Web Application Firewall'
  }
  properties: {
    managedRules: {
      managedRuleSets: [
        {
          ruleGroupOverrides: []
          ruleSetType: 'OWASP'
          ruleSetVersion: '3.2'
        }
        {
          ruleGroupOverrides: []
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '0.1'
        }
      ]
      exclusions: [
        {
          exclusionManagedRuleSets: [
            {
              ruleSetType: 'OWASP'
              ruleSetVersion: '3.2'
              ruleGroups: [
                {
                  ruleGroupName: 'REQUEST-942-APPLICATION-ATTACK-SQLI'
                  rules: [
                    {
                      ruleId: '942230'
                    }
                  ]
                }
              ]
            }
          ]
          matchVariable: 'RequestArgNames'
          selector: 'email'
          selectorMatchOperator: 'Contains'
        }
        {
          exclusionManagedRuleSets: [
            {
              ruleGroups: [
                {
                  ruleGroupName: 'REQUEST-942-APPLICATION-ATTACK-SQLI'
                  rules: [
                    {
                      ruleId: '942450'
                    }
                  ]
                }
                {
                  ruleGroupName: 'REQUEST-932-APPLICATION-ATTACK-RCE'
                  rules: [
                    {
                      ruleId: '932150'
                    }
                  ]
                }
              ]
              ruleSetType: 'OWASP'
              ruleSetVersion: '3.2'
            }
          ]
          matchVariable: 'RequestCookieNames'
          selector: 'ai_session'
          selectorMatchOperator: 'StartsWith'
        }
      ]
    }
    customRules: []
    policySettings: {
      mode: 'Prevention' // 'Detection' or 'Prevention'
      state: 'Enabled'
      customBlockResponseBody: 
    }
  }
}

Conclusion

By identifying false positives and creating exclusion rules, you can ensure that legitimate traffic is not blocked while still protecting your applications from threats. This is also the reason why I always recommend starting with a WAF in detection mode first, to monitor and tune the rules before enforcing them via prevention mode.

More reading

• https://alanta.nl/posts/2021/04/manage-waf-rules-for-appgateway
• https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview

How secure are your web applications? Deploy an Azure Application Gateway with Web Application Firewall (WAF). This is a powerful tool to protect your applications while ensuring seamless performance. Let’s dive in and explore how you can get started!

Why deploy an Application Gateway?

Have you ever heard about the OWASP Top 10? It is a list of the most common web application security risks. Could you even name all ten risks? If not, you are not alone. But you want to protect against these risks, right? An Application Gateway with Web Application Firewall (WAF) can help you with that. It is a managed service that provides a web application firewall to protect your web applications from common threats and vulnerabilities.

Alternatives

An alternative is using the Azure FrontDoor service. Or look outside of Azure, but I will not discuss those options in this blog. Frontdoor has some additional features like CDN and global load balancing.

How to migrate to an Application Gateway?

Let’s say you have a web application running on Azure App Service. You want to migrate this application to use an Application Gateway with WAF. Here are the steps you need to take:

1. Create a Key Vault to store the SSL/TLS certificates.
2. Create a Vnet and subnet for the Application Gateway.
3. Create a Public IP Address for the Application Gateway.
4. Create a new Application Gateway with WAF enabled.
5. Configure the backend pool to point to your Azure App Service.
6. Create a new routing rule to forward traffic to the backend pool.
7. Update your DNS settings to point to the Application Gateway.

I assume you have a Key Vault and know how to provide it with an SSL/TLS certificate. Let’s combine the 2,3, 4, and 5 steps in a Bicep deployment.

Deploy Application gateway using bicep

Let’s deploy an Application Gateway with a backend pool pointing to an Azure App Service.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

param location string = resourceGroup().location
param region string
param environment string
param tags object

resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-09-01' = {
  name: 'vnet-${region}-${environment}'
  location: location
  tags: tags
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'snet-agw'
        properties: {
          addressPrefix: '10.0.1.0/24'
          privateEndpointNetworkPolicies: 'Disabled'
          privateLinkServiceNetworkPolicies: 'Disabled'
        }
      }
      { // Sample for if your backends are in Azure Container apps
        name: 'snet-containerapp'
        properties: {
          addressPrefix: '10.0.2.0/23'
          delegations: [
            {
              name: 'Microsoft.App/environments'
              properties: {
                serviceName: 'Microsoft.App/environments'
              }
            }
          ]
        }
      }
    ]
  }
}

module keyvault 'br/public:avm/res/key-vault/vault:0.13.3' = {
  name: '${deployment().name}-kv'
  scope: resourceGroup()
  params: {
    name: 'kv-${region}-${environment}'
    // Other parameters...
  }
}

module wafPolicy 'br/public:avm/res/network/application-gateway-web-application-firewall-policy:0.2.0' = {
  name: 'applicationGatewayWebApplicationFirewallPolicyDeployment'
  params: {
    // Required parameters
    managedRules: {
      managedRuleSets: [
        {
          ruleGroupOverrides: []
          ruleSetType: 'OWASP'
          ruleSetVersion: '3.2'
        }
        {
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '0.1'
        }
      ]
    }
    name: 'mycoolwaf'
    // Non-required parameters
    location: location
    policySettings: {
      fileUploadLimitInMb: 10
      jsChallengeCookieExpirationInMins: 60
      mode: 'Detection' // 'Detection' or 'Prevention'
      state: 'Enabled'
    }
  }
}

module publicIp 'br/public:avm/res/network/public-ip-address:0.6.0' = {
  name: '${deployment().name}-pip'
  scope: resourceGroup()
  params: {
    name: 'pip-ag-${region}-${environment}'
    // Other parameters...
  }
}

var gatewayId = resourceId('Microsoft.Network/applicationGateways/probes', 'ag-${region}-${environment}')
module appGateway 'br/public:avm/res/network/application-gateway:0.7.1' = {
  name: '${deployment().name}-agw'
  scope: resourceGroup()
  params: {
    name: 'ag-${region}-${environment}'
    sku: 'WAF_v2'
    gatewayIPConfigurations: [
      {
        name: 'appGatewayIpConfig'
        properties: {
          subnet: {
            id: virtualNetwork.properties.subnets[0].id
          }
        }
      }
    ]
    frontendIPConfigurations: [
        {
            name: 'appGwFrontend'
            properties: {
                publicIPAddress: {
                    id: publicIp.outputs.resourceId
                }
                privateAllocationMethod: 'Dynamic'
            }
        }
        // Add IPv6 frontend configuration if needed, see my other blog post
    ]
    firewallPolicyResourceId: wafPolicy.outputs.resourceId
    backendAddressPools: [
        {
            name: 'appGwBackendPool'
            properties: {
                backendAddresses: [
                    {
                        fqdn: 'your-app-service.azurewebsites.net'
                    }
                ]
            }
        }
    ]
    httpListeners: [
        {
            name: 'appGwHttpListener'
            properties: {
                frontendIpConfiguration: {
                    id: '${gatewayId}/frontendIpConfigurations/appGwFrontend'
                }
                frontendPort: {
                    id: '${gatewayId}/frontendPorts/appGwFrontendPort'
                }
                protocol: 'Http'
            }
        }
    ]
    requestRoutingRules: [
        {
            name: 'appGwRoutingRule'
            properties: {
                httpListener: {
                    id: '${gatewayId}/httpListeners/appGwHttpListener'
                }
                backendAddressPool: {
                    id: '${gatewayId}/backendAddressPools/appGwBackendPool'
                }
                backendHttpSettings: {
                    id: '${gatewayId}/backendHttpSettings/appGwBackendHttpSettings'
                }
            }
        }
    ]
  }
}

Configure DNS for Application Gateway

After deploying the Application Gateway, you need to update your DNS settings to point to the Application Gateway’s public IP address. This ensures that all incoming traffic to your web application is routed through the Application Gateway, allowing it to provide the necessary security and performance enhancements.

Detection vs Prevention mode

When configuring the WAF policy, you have the option to set the mode to either “Detection” or “Prevention”. In Detection mode, the WAF will monitor and log potential threats without blocking any traffic. This is useful for testing and tuning the WAF rules before enforcing them. In Prevention mode, the WAF will actively block traffic that matches the defined rules, providing a higher level of security for your web applications.

I recommend starting with Detection mode to understand the traffic patterns and potential threats to your application. Once you are confident that the WAF rules are properly configured, you can switch to Prevention mode for enhanced protection.

See my next blog post on how to find false positives and tune your WAF rules.

Next steps

We now got an Application gateway before your application. Your next steps could be:

• Configure custom WAF rules to tailor the security settings to your specific application needs.
• Set up monitoring and alerting to keep an eye on the WAF logs and performance metrics. ( see WAF monitoring)
• If you see no false positives you can switch from Detection to Prevention mode. (see Troubleshoot Application Gateway in Production)
• Implement ip restrictions for your Application gateway on Staging or acceptance environments. (see Implement IP Restrictions)
• Learn more about ipv6. (see Application Gateway with IPv6 support).

Dutch governments need to be available over IPv6 according to this mandate. Therefore I had to make sure my Application Gateway with Web Application Firewall (WAF) is also available over IPv6. In this blog I will explain some of the challenges we faced and how we solved them.

System context

In the existing system we have multiple apps running on Azure App Services behind an Application Gateway with WAF. The Application Gateway is currently only available over IPv4.

We have a listener and rule in place for each app. Each app is configured with its own FQDN (Fully Qualified Domain Name) and a TLS/SSL certificate is used for secure communication.

The system was geo redundant with two Application Gateways in different regions, each with its own public IP address.

A traffic manager profile is used to distribute traffic between the two Application Gateways based on priority. A common active-passive setup.

Dual stack

To make the Application Gateway available over IPv6, we needed to configure dual stack support. This means you have to redeploy the Application Gateway. This has a massive impact because of our current strategy with multiple listeners and rules. We had to make sure that all configurations were preserved during the redeployment.

If you need to do this I recommend:

1. Add Ipv6 address prefixes to your virtual network.
2. Use an AVM module to build your new Application Gateway with dual stack support.
3. Reconsider if you need zones for your Application Gateway. Those also require a full redeployment.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

param region string
param environment string
param applicationGatewayNr int

module vnet 'br/public:avm/res/network/virtual-network:0.7.1' = {
  params: {
    name: 'ag-vnet'
    addressPrefixes: [
      '10.0.0.0/16' // IPv4 address prefix
      'fd00::/48' // IPv6 address prefix
    ]
    subnets: [
      {
        name: 'appgw-subnet'
        addressPrefixes: [
          '10.0.1.0/24' // IPv4 subnet for Application Gateway
          'fd00:0:0:1::/64' // IPv6 subnet for Application Gateway
        ]
        delegation: 'Microsoft.Network/applicationGateways'
      }
    ]
  }
}

module publicIpV4 'br/public:avm/res/network/public-ip-address:0.9.0' = {
  params: {
    // Required parameters
    name: 'pip-v4-mart'
    // Non-required parameters
    availabilityZones: [1, 2, 3]
    publicIPAddressVersion: 'IPv4'
    publicIPAllocationMethod: 'Static'
  }
}

module publicIpV6 'br/public:avm/res/network/public-ip-address:0.9.0' = {
  params: {
    // Required parameters
    name: 'pip-v6-mart'
    // Non-required parameters
    availabilityZones: [1, 2, 3]
    publicIPAddressVersion: 'IPv6'
    publicIPAllocationMethod: 'Static'
  }
}
var agName = 'ag-${applicationGatewayNr}-${region}-${environment}'
module appGateway 'br/public:avm/res/network/application-gateway:0.7.1' = {
  name: '${deployment().name}-agw'
  scope: resourceGroup()
  params: {
    name: agName
    sku: 'WAF_v2'
    availabilityZones: [1, 2, 3] //TODO: Remove this line if you don't need zones
    gatewayIPConfigurations: [
      {
        name: 'agconfig'
        properties: {
          subnet: {
            id: vnet.outputs.subnetResourceIds[0]
          }
        }
      }
    ]
    frontendIPConfigurations: [
      {
        name: 'appGwFrontendIPv4'
        properties: {
          publicIPAddress: {
            id: publicIpV4.outputs.resourceId
          }
          privateAllocationMethod: 'Dynamic'
        }
      }
      {
        name: 'appGwFrontendIPv6'
        properties: {
          publicIPAddress: {
            id: publicIpV6.outputs.resourceId
          }
          privateAllocationMethod: 'Dynamic'
        }
      }
    ]
    listeners: [
      {
        name: 'mart-listener'
        properties: {
          frontendIPConfiguration: {
            id: resourceId(
              'Microsoft.Network/applicationGateways/frontendIPConfigurations',
              agName,
              'appGwFrontendIPv6'
            )
          }
          frontendPort: {
            id: resourceId('Microsoft.Network/applicationGateways/frontendPorts', agName, 'port_443')
          }
          protocol: 'Https'
          hostname: 'ag.martdegraaf.nl'
          sslCertificate: {
            id: resourceId('Microsoft.Network/applicationGateways/sslCertificates', agName, 'sslCert')
          }
        }
      }
    ]
    routingRules: [
      {
        name: 'route-ipv6'
        properties: {
          ruleType: 'Basic'
          priority: 1
          httpListener: {
            id: resourceId('Microsoft.Network/applicationGateways/httpListeners', agName, 'mart-listener')
          }
          backendAddressPool: {
            id: resourceId('Microsoft.Network/applicationGateways/backendAddressPools', agName, 'mart-backendpool')
          }
          backendHttpSettings: {
            id: resourceId(
              'Microsoft.Network/applicationGateways/backendHttpSettingsCollection',
              agName,
              'mart-backendSetting'
            )
          }
        }
      }
    ]
  }
}

public ip addresses connected

Let’s take a look what this means for our architecture. For each Application Gateway we now have two public ip addresses. We just need to configure that the DNS can find this new IPV6 address.

Traffic Manager

We had a traffic manager profile in place to distribute traffic between the two Application Gateways. The traffic manager profile also needed to be updated to support IPv6.

This was actually really complex because Traffic Manager does not support dual stack endpoints directly. Therefore we had to create separate endpoints for IPv4 and IPv6 in the traffic manager profile.

Thereby the Traffic manager routing method priority only supports one endpoint per target. So we had to create three traffic manager profiles to achieve the desired failover behavior. One with the routing method priority with two external endpoints pointing to the nested traffic manager profiles. Each nested traffic manager profile with routing method ‘MultiValue’ had one endpoint for IPv4 and one for IPv6.

Serve traffic over IPv4 and IPv6

Because we want to serve traffic over both IPv4 and IPv6, we had to create a traffic manager profile with the routing method ‘MultiValue’. This profile contains two external endpoints, one for the IPv4 address and one for the IPv6 address of the Application Gateway.

This can be achieved with the following Bicep code:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

param region string
param environment string
param applicationGatewaySequence string

resource publicIpV4 'Microsoft.Network/publicIPAddresses@2023-11-01' existing = {
  name: 'pip-ag-${applicationGatewaySequence}-${region}-${environment}-v4'
}

resource publicIpV6 'Microsoft.Network/publicIPAddresses@2023-11-01' existing = {
  name: 'pip-ag-${applicationGatewaySequence}-${region}-${environment}-v6'
}

module agTrafficManager 'br/public:avm/res/network/trafficmanagerprofile:0.3.0' = {
  name: '${deployment().name}-tm'
  scope: resourceGroup()
  params: {
    name: 'tm-ag-${applicationGatewaySequence}-${region}-${environment}'
    ttl: 15
    trafficRoutingMethod: 'MultiValue'  
    maxReturn: 2
    endpoints: [
      {
        name: 'ag-${applicationGatewaySequence}-${region}-${environment}-v4'
        type: 'Microsoft.Network/trafficManagerProfiles/externalEndpoints'
        properties: {
            target: publicIpV4.properties.ipAddress
            endpointStatus: 'Enabled'
            endpointMonitorStatus: 'Unmonitored'
            alwaysServe: 'Enabled'
        }
      }
      {
        name: 'ag-${applicationGatewaySequence}-${region}-${environment}-v6'
        type: 'Microsoft.Network/trafficManagerProfiles/externalEndpoints'
        properties: {
            target: publicIpV6.properties.ipAddress
            endpointStatus: 'Enabled'
            endpointMonitorStatus: 'Unmonitored'
            alwaysServe: 'Enabled'
        }
      }
    ]
  }
}

Parent profile for failover

To achieve failover between the two Application Gateways in different regions, we created a parent traffic manager profile with the routing method ‘Priority’. This profile contains two external endpoints, each pointing to one of the nested traffic manager profiles.

There are three different endpoint types in Traffic Manager:

1. Azure endpoints
2. External endpoints
3. Nested endpoints

Azure endpoints

Azure endpoints point directly to Azure resources. However, in our case, we are not directly refering to one Web App or one Public IP address. Therefore, Azure endpoints are not suitable for our scenario here.

Nested endpoints

I initially attempted to use nested endpoints, but they were incompatible with the health probes.

A solution for the healthchecks to work was to create a nested traffic manager profile for each application instead of per Application Gateway. This approach forced us to create three Traffic Manager profiles per application, which seemed like a good solution until we encountered the subscription limit of 200 Traffic Manager profiles.

External endpoints

Another solution for the healthchecks to work was to use external endpoints instead of nested endpoints in the parent Traffic Manager profile. When we switched to using external endpoints that pointed to the FQDNs of the nested Traffic Manager profiles, this had some major advantages.

• It allowed us to stay within the subscription limits while still achieving the desired failover behavior.
• It simplified the overall architecture by reducing the number of Traffic Manager profiles needed.
• It ensured that the health probes functioned correctly, providing reliable monitoring of the Application Gateways’ availability.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

param region string
param environment string
param primaryRegion string
param secondaryRegion string
param applicationGatewaySequence string

module serviceTrafficManagerFailover 'br/public:avm/res/network/trafficmanagerprofile:0.3.0' = {
  name: '${deployment().name}-tm-failover'
  scope: resourceGroup()
  params: {
    name: 'tm-ag-failover-${applicationGatewaySequence}-${environment}'
    ttl: 15
    trafficRoutingMethod: 'Priority'
    monitorConfig: {
        protocol: 'HTTPS'
        port: 443
        path: '/healthcheck' //TODO: Adjust based on your health probe requirements
        intervalInSeconds: 30
        timeoutInSeconds: 10
        toleratedNumberOfFailures: 3
        customHeaders: [
            {
                name: 'Host'
                value: 'someapi.martdegraaf.nl' //TODO: Adjust based on your health probe requirements
            }
        ]
    }
    endpoints: [
      {
        name: 'tm-${primaryRegion}-${environment}'
        type: 'Microsoft.Network/trafficManagerProfiles/externalEndpoints'
        properties: {
            target: 'tm-ag-${applicationGatewaySequence}-${primaryRegion}-${environment}.trafficmanager.net'
            endpointStatus: 'Enabled'
            priority: 1
        }
      }
      {
        name: 'tm-${secondaryRegion}-${environment}'
        type: 'Microsoft.Network/trafficManagerProfiles/externalEndpoints'
        properties: {
            target: 'tm-ag-${applicationGatewaySequence}-${secondaryRegion}-${environment}.trafficmanager.net'
            endpointStatus: 'Enabled'
            priority: 2
        }
      }
    ]
  }
}

Update DNS records

If you are using a Traffic Manager profile to expose your application gateway you can update your CNAME record to point to the Traffic Manager FQDN. This way both IPv4 and IPv6 traffic will be routed correctly.

If you are routing directly to the Application Gateway you will need to update both the A record (IPv4) and the AAAA record (IPv6) in your DNS settings to point to the respective IP addresses of the Application Gateway.

After updating the DNS records, it may take some time for the changes to propagate. You can use tools like nslookup or online DNS checkers to verify that the records have been updated correctly.

1

nslookup yourapp.yourdomain.com

Conclusion and discussion

It has consequences to enable IPv6 on your Application Gateway. You have to redeploy the Application Gateway which can be complex depending on your current setup. Also for every listener you will need two listeners (one for IPv4 and one for IPv6). The limit of active listeners is 100 so keep that in mind for your architecture. with two listeners for each application you can only have 50 applications behind one Application Gateway.

Now you have dual stack support. Your Application Gateway is available over both IPv4 and IPv6. Make sure to test your setup thoroughly to ensure that everything is working as expected.

Further reading

• Microsoft Docs: Configure an Application Gateway to use IPv6

On my presentation for the APE Meetup on the 11th of September, I had a demo prepared to show how easy you could build stuff using bicep and Visual Studio Code. A week before i deployed a Application Gateway with a Web Application Firewall (WAF) in front of a simple web app. I have a monthly budget of 150 euro’s to spend on Azure credit. And it was all gone just before the demo. Luckily I had a backup subscription with some credit left, but it was nerve wrecking.

Blog down

After the demo I realized that my blog was down too because the subscription was disabled. I had to move my blog to another subscription and did change the CNAME to the new Static Web App. I just created a new Static Web App in the backup subscription and deployed my blog there. It took 5 minutes to change, but my blog was down for a weekend because you first need to do this.

So here are some tips to avoid this happening to you.

Separate demo from production

So I had a production resource, my blog deployed in the same subscription I play around in with my demos. Not really smart, learn from my mistake and always separate production from demo/test/dev environments. Use different subscriptions if possible.

Setup a budget and alerts

In the Azure portal you can setup a budget for your subscription. You can set alerts to be send when you reach 50%, 75% and 90% of your budget. This way you will be warned in time.

To learn more about setting up budgets and alerts in Azure, check out the official Azure documentation on budgets.

Once you have ran out of credit, you cannot do anything in that subscription anymore, so you cannot create budgets to prevent this from happening right after.

Automate deletion of resources

If you are doing demos often, you can automate the deletion of resources after a certain time. You can use Azure CLI or PowerShell scripts to delete resources after your demo is done. You can also use Azure Automation or Logic Apps to schedule the deletion of resources. Or just create a pipeline in Azure DevOps or GitHub Actions to do this for you.

For building good and reliable software, logging is essential. But not every type of data should be logged. With all the GDRP regulations it’s important to take care of your logging.

By default you should not expose data in your logging. But sometimes it can be handy to see your objects in the logs. This post will discuss methods and show you how to mask data in Azure Application Insights.

Log masking in .NET 8

There are serveral ways to do Log masking in .NET since version 6. Now let’s look what is available for us for .NET 8 and higher.

Logging source generation

By using Source generation for logging you will be able to mask data in your logs. Let’s take a look at how.

Step 1: Add Microsoft.Extensions.Logging

First, you need to add the Microsoft.Extensions.Logging package to your project. You can do this by running the following command in your project directory:

1

dotnet add package Microsoft.Extensions.Logging

Step 2: Use the LogPropertyIgnore in Your Models

Now you can use the [LogPropertyIgnore] in your models to mark properties that should be not be logged.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

using Microsoft.Extensions.Logging;

public class MyModel
{
        public string Name { get; set; }

        [LogPropertyIgnore]
        public string SensitiveData { get; set; }

        public string? NullableString { get; set; }
}

Step 3: Logging or Sending Data

When you log or send instances of MyModel, the SensitiveData property will be masked in the JSON output.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

public class MyController : ControllerBase
{
    private readonly ILogger<MyController> _logger;

    public MyController(ILogger<MyController> logger)
    {
        _logger = logger;
    }

    public IActionResult MyAction()
    {
        var model = new MyModel
        {
            Name = "John Doe",
            SensitiveData = "Secret123"
        };

        // Log the model (the sensitive data will be masked)
            LogMySensitiveModel(_logger, model);

        return Ok();
    }

        [LoggerMessage(
            Level = LogLevel.Information,
            Message = "Logging Sensitive model")]
        private static partial void LogMySensitiveModel(ILogger logger, [LogProperties] MyModel model);
}

See a codesample on GitHub: Log Masking in Application Insights.

Log masking using Custom own made code

While researching for log masking in .NET core i stumbled on this older article: https://dev.to/krusty93/hide-sensitive-data-in-azure-application-insights-logs-of-our-aspnet-core-apis-4ji7.

This article describes how to mask data in your logs. The article describes how to use a custom JsonConverter to mask sensitive data in your logs. This approach allows you to define which properties should be masked and how they should be masked. You can use this approach to mask sensitive data in your logs while still using the built-in JSON serialization features of .NET.

It feels cheaty to do this. But it is a possible path to mask your logs. Also as you can see in the Performance section of this blog, you should be carefull with this approach.

Using the Redaction package

The Redaction package is a simple and effective way to mask sensitive data in your logs. This package allows you to define a list of properties that should be redacted when logging objects. You can install the package using the following command:

Step 1 installing the package

1

dotnet add package Microsoft.Extensions.Compliance.Redaction

Step 2 Create data classification

Create a data classification that defines the properties that should be redacted. You can do this by creating a class that implements the IDataClassification interface:

1
2
3
4
5
6

using Microsoft.Extensions.Compliance.Redaction;

public class PrivateDataAttribute : DataClassificationAttribute
{
    public PrivateDataAttribute() : base(DataClassifications.PrivateDataClassification) { }
}

Step 3 Use the data classification

Now you can use the PrivateDataAttribute attribute to mark properties that should be redacted:

1
2
3
4
5
6
7
8
9

public class MyModel
{
    public string Name { get; set; }

    [PrivateData]
    public string SensitiveData { get; set; }

    public string? NullableString { get; set; }
}

Step 4 Configure the Redaction Options

You can add custom Redactors, and apply them to different classifications of data.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

public class MyCustomRedactor : Redactor
{
    private const string Stars = "****";

    public override int GetRedactedLength(ReadOnlySpan<char> input) => Stars.Length;

    public override int Redact(ReadOnlySpan<char> source, Span<char> destination)
    {
        Stars.CopyTo(destination);
        return Stars.Length;
    }
}

You can configure the redaction options in your Startup.cs file:

1
2
3
4
5
6
7
8

public void ConfigureServices(IServiceCollection services)
{
    services.AddRedaction(options =>
    {
        options.AddDataClassification<DataClassifications.PrivateDataClassification>();
        options.SetRedactor<MyCustomRedactor>(new DataClassificationSet(DataClassifications.OtherDataClassification)); // Set redactor for specific Data Classification
    });
}

Discussion

Personally i am most charmed by the source generation method of logging. The logging is clean and simple enough to use. The redaction package is a more complex way of masking your logs, but has more capabilities to mask and classify different types of data.

Log masking in .NET Framework 4.8

So you are still using .NET Framework 4.8? No worries, you can still mask data in your logs. You are entitled to use build your own TelemetryInitializer. This way you can mask data in your logs.

Step 1: Create a TelemetryInitializer

You need to add properties yourself to the request telemetry. You can do this as seen in the code below. This code does not support lists and such, but suit yourself for that. You can even make it recursive if you would like to log nested objects.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

public class LogData
{
    public void LogObject(RequestTelemetry telemetry, object obj)
    {
        // Get the properties of the object
        var properties = obj.GetType().GetProperties(BindingFlags.Public | BindingFlags.Instance);
        foreach(var property in properties){
            if(!property.canWrite){
                continue;
            }
            var attributes = property.GetCustomAttributes(typeof(SensitiveDataAttribute), true);
            if(attributes.Length > 0){
                telemetry.Properties.Add(property.Name, "****");
            }else{
                // Log the property
                telemetry.Properties.Add(property.Name, property.GetValue(obj).ToString());
            }

        }
        telemetry.Properties.Add(key, properties[key])
    }
}

Step 2: Use the LogObject

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

public class MyController : ControllerBase
{
    public IActionResult MyAction()
    {
        var model = new MyModel
        {
            Name = "John Doe",
            SensitiveData = "Secret123"
        };

        // Log the model (the sensitive data will be masked)
        LogData logData = new LogData();
        var telemetry = HttpContext.Current.Items["Microsoft.ApplicationInsights.RequestTelemetry"] as RequestTelemetry;
        logData.LogObject(telemetry, model); // logdata will be added to telementry client

        return Ok();
    }
}

Conclusion

By creating a custom attribute and a JSON converter, you can effectively mask sensitive properties during serialization in your .NET 8 application. This approach allows you to maintain clean and secure logging practices while still using the built-in JSON serialization features of .NET. Always ensure that you are compliant with data protection regulations when handling sensitive data.

References

• https://andrewlock.net/behind-logproperties-and-the-new-telemetry-logging-source-generator/
• https://andrewlock.net/exploring-dotnet-6-part-8-improving-logging-performance-with-source-generators/
• Log Masking
• https://learn.microsoft.com/en-us/training/modules/dotnet-compliance-cloud-native-applications/
• https://gist.github.com/joperezr/f5f022bcb4d0ce8f077e40e1f77239c8#file-redaction-md
• dev.to - Hide sensitive data in Azure Application Insights logs of our ASP.NET (Core) APIs

So you have your logging in place in Application Insights and you want to be alerted when something goes wrong. This post will show you how to set up alerting in Azure Application Insights.

Setting up Smart Alerting in Azure Application Insights

Azure Application Insights has a feature called Smart Detection. This feature can automatically detect anomalies in your data. You can set up alerts based on these anomalies.

To set up Smart Detection in Azure Application Insights, follow these steps:

1. Go to the Azure portal.
2. Navigate to your Application Insights resource.
3. Click on the Smart Detection tab.

You can set up alerts based on various metrics, such as:

• Server response time
• Server requests
• Server exceptions
• Server failures

Custom alerts via Bicep

If you want more control over your alerts, you can use Bicep to define your alerts. Bicep is a domain-specific language for deploying Azure resources declaratively.

Here is an example of how you can define an alert rule that checks if there are more than 0 exception checking frequently.

By creating Action groups, you can define what should happen when the alert is triggered. In this example, we are using a webhook to call a function app. But you can also send an email or call a logic app.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

param version string = utcNow('yyMMddHHmm')
var location = resourceGroup().location

resource actionGroup 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: 'FunctionActionGroup'
  location: 'Global'
  properties: {
    groupShortName: 'FuncAG'
    enabled: true
    webhookReceivers: [
      {
        name: 'FunctionWebhook'
        // This is obviously a fake URL, replace it with your own
        serviceUri: 'https://my-cool-fnapp.azurewebsites.net/api/HttpTrigger1?code=1234567890'
      }
    ]
  }
}

resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing =  {
  name: 'bicep-appi-mart'
}

resource alert 'Microsoft.Insights/scheduledQueryRules@2021-08-01' = {
  name: 'ExceptionAlert'
  location: location
  properties: {
    description: 'Alert for specific exception'
    enabled: true
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
    scopes:[
      applicationInsights.id
    ]
    criteria: {
      allOf: [
        {
          query: 'exceptions | where exceptionType == "Demo.KQL.FunctionsNet9.DemoException"'
          timeAggregation: 'Count'
          
          operator: 'GreaterThan'
          threshold: 0
        }
      ]
    }
    evaluationFrequency: 'PT5M' // every 5 min
    windowSize: 'PT5M'
    severity: 1 //0 Critical, 1 Error, 2 Warning, 3 Informational, 4 Verbose
  }
}

Multiple alerts via Bicep

With bicep you can make some alerts generic and use parameters to make them more flexible. This way you can reuse the same alert for different applications. By using the for loop you can create multiple alerts at once.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

param alerts array = [
  {
    name: 'ExceptionAlert'
    description: 'Alert for specific exception'
    query: 'exceptions | where exceptionType == "Demo.KQL.FunctionsNet9.DemoException"'
    threshold: 0
  }
  {
    name: 'RequestAlert'
    description: 'Alert for specific request'
    query: 'requests | where url contains "api/HttpTrigger1"'
    threshold: 0
  }
]

resource QueryAlerts 'Microsoft.Insights/scheduledQueryRules@2021-08-01' = [for alert in alerts: {
  name: '${alert.name}-${version}'
  location: location
  properties: {
    description: alert.description
    enabled: true
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
    scopes:[
      applicationInsights.id
    ]
    criteria: {
      allOf: [
        {
          query: alert.query
          timeAggregation: 'Count'
          
          operator: 'GreaterThan'
          threshold: alert.threshold
        }
      ]
    }
    evaluationFrequency: 'PT5M' // every 5 min
    windowSize: 'PT5M'
    severity: 1 //0 Critical, 1 Error, 2 Warning, 3 Informational, 4 Verbose
  }
}]

Conclusion and Discussion

Setting up alerting in Azure Application Insights is essential to monitor your application’s health. By using Smart Detection or defining your alerts via Bicep, you can ensure that you are alerted when something goes wrong.

If you have these alerts set via Bicep, you can also version control them and deploy them via your CI/CD pipeline. This way, you can ensure that your alerts are always in sync with your application. And if seen on Acceptance for example you will fail faster and will iterate sooner.

Have you ever created a new project and had code and pipelines and such ready to go, but still need to manually create the pipelines in Azure DevOps? Annoying, right? The flow is so simple it does not allow you to select folders or name your pipelines. This post will show you how to create Azure Pipelines using PowerShell.

And if thats possible, why not automate more, like giving permissions to the pipelines and creating branchpolices? Let’s dive in!

Solution

To script the code i am using a mix of the Az CLI and the Azure DevOps REST API. The Az CLI is used to get the repo id and getting the authorization token. The REST API is used to create the pipeline, and more. Enough talk, let’s get to the code.

Also make sure the azure-devops extension is installed.

1

az extension add --name azure-devops

Getting access

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$accessToken = az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" -o tsv
if($null -eq $accessToken) {
    Write-Host "Could not get access token"
    exit 1
}

$headers = @{
    "Authorization"  = "Bearer $accessToken"
    "Content-Type"   = "application/json"
}

Getting the repo id

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$repoName = "MyRepo"
$projectName = "MyProject"

$repo = az repos list --project $projectName --query "[?name=='$repoName']" -o json
if($null -eq $repo) {
    Write-Host "Could not find repo"
    exit 1
}
$repoId = $repo.id
Write-Host "Repo id is $repoId"