Forem: David

You Can’t Govern What You Can’t Explain on a Napkin

David — Mon, 22 Dec 2025 10:58:04 +0000

Originally published on Azure-Noob:

https://azure-noob.com/blog/azure-governance-napkin-test/

Every platform team eventually gets asked the same question:

“Why does cloud cost this much?”

If your answer starts with “let me pull a dashboard”, you’ve already lost.

The CFO walks into your office with a printout.

“Why did Azure cost $2.3M this quarter?”

You have:

Azure Policy enforcing compliance
A Landing Zone with perfect architecture
Tags on every resource
Workbooks showing metrics
Dashboards with pretty graphs

But you can’t answer the question.

Not in 30 seconds.

Not on a whiteboard.

Not on a napkin.

This is the governance failure no one talks about.

The Problem: Tools Enforce Rules, Not Understanding

Every enterprise Azure environment has the same stack:

Layer 1: Azure Policy

SKU restrictions
Required tags
Security baselines
Audit findings

Layer 2: Landing Zones

Management groups
Subscription design
Network topology
Identity hierarchy

Layer 3: Tagging Standards

CostCenter
Owner
Environment
Application

Layer 4: Reporting Tools

Azure Monitor Workbooks
Power BI dashboards
Cost Management exports
Custom queries

This stack gives you:

✅ Compliance
✅ Security controls
✅ Resource inventory
✅ Cost visibility

But it doesn’t give you:

❌ Defensibility

And there’s a critical difference.

Compliance ≠ Defensibility

Compliance means:

“Our resources follow the rules we wrote.”

Defensibility means:

“I can explain why this costs what it costs — and justify it to someone who doesn’t trust me.”

Compliant Azure bill:

“All resources are tagged correctly. Policy enforced. Landing Zone followed. Here’s the report.”

Defensible Azure bill:

“Application X costs $180K/month because it serves 2,400 users across 12 regions with 99.95% SLA requirements. Storage is $40K due to 7-year retention for SOX compliance. Network is $25K for dual ExpressRoute. Compute scales between $95K–$140K based on usage.”

The first answer is compliant.

The second answer is defensible.

And most Azure environments can only produce the first one.

The Napkin Test

Can you explain your Azure costs on a napkin?

Not “here’s a dashboard.”

Not “let me pull a report.”

Right now. On a napkin. In 60 seconds.

Try this:

Draw three boxes: Production, Staging, Development
Write the monthly cost in each box
Break Production into: Apps, Data, Network, Security
For the largest app: What does it do? How many users? What’s the SLA?

If you can’t do this without looking anything up:

Your governance isn’t working.

It doesn’t matter how good your policies are.

It doesn’t matter how clean your Landing Zone is.

It doesn’t matter how consistent your tags are.

If the person responsible can’t explain it simply, it’s not governed — it’s just compliant.

Why Tools Fail the Napkin Test

Tags Report Facts, Not Meaning

Tags tell you:

CostCenter: 4200
Environment: Production
Owner: John Smith
Application: CustomerPortal

They don’t tell you:

Why does it cost $340K/month?
Is that reasonable?
What breaks if we cut 30%?
Which business capability disappears?

Tags group resources.

They don’t create understanding.

Landing Zones Organize, They Don’t Explain

Landing Zones give you beautiful structure.

They don’t explain:

Why one subscription costs 3× another
Which decisions drove last month’s increase
What trade-offs were made
What the ROI actually is

Structure without narrative isn’t governance.

It’s just organized chaos.

Policy Audits the Past, Not the Future

Azure Policy tells you what’s non-compliant.

It doesn’t tell you:

Whether the resource should exist
What business problem it solves
What happens if you remove it
Whether the rule still makes sense

Policy enforces rules you already wrote.

It doesn’t tell you if they were good rules.

Dashboards Show Data, Not Decisions

Dashboards show what happened.

Leadership asks:

“Why did costs go up?”

You click through visuals.

They ask:

“What decision caused this?”

Your dashboard has no answer.

Because dashboards don’t explain why —

or whether it should have happened at all.

What Defensibility Actually Requires

Defensible cloud costs have:

Business context per dollar
Decision history
Trade-off awareness
Clear owner accountability

Not:

More dashboards
More tags
More policies

But clear narratives that survive CFO scrutiny.

The Hard Truth

You can’t govern what you can’t explain.

And if you can’t explain it on a napkin —

in 60 seconds,

in business terms,

to someone who doesn’t trust you —

you don’t understand it well enough to govern it.

Until then, governance isn’t governance.

It’s just expensive infrastructure with extra steps.

Modernizing Azure Workbooks - Taking Billy York's Inventory from 50 to 200+ Services

David — Fri, 12 Dec 2025 18:56:22 +0000

The Problem with Azure Inventory

Azure Portal: Shows resources one subscription at a time

Need: See ALL resources across 44 subscriptions

Billy York's solution: Azure Monitor Workbook with Resource Graph queries

Problem: Only covers ~50 Azure services. Azure has 200+.

What Billy York Built (And Why It's Great)

Original workbook:

Queries Azure Resource Graph
Shows VMs, storage, networking
Organized by resource type
Open source on GitHub

Why it's excellent:

Actually works (many don't)
Clean UI
Copy-paste KQL queries
Free

Why it needs enhancement:

Missing 150+ services
No security hygiene checks
No cost context
Manual updates for new Azure services

What We Added

150+ Additional Services

Original: VMs, Storage, VNets, NSGs, Load Balancers

Added:

Azure AI (OpenAI, Cognitive Services, ML)
Databases (SQL, Cosmos, PostgreSQL, MySQL)
Integration (Logic Apps, Service Bus, Event Grid)
Security (Key Vault, Defender, Sentinel)
Monitoring (Application Insights, Log Analytics)
Arc (Hybrid servers, Kubernetes)

Total: 200+ service types

Security Hygiene Checks

Query for public-facing resources:

Resources
| where type =~ 'microsoft.compute/virtualmachines'
| extend hasPublicIP = isnotnull(properties.networkProfile.networkInterfaces[0].properties.ipConfigurations[0].properties.publicIPAddress)
| where hasPublicIP == true
| project name, resourceGroup, location

Query for unencrypted storage:

Resources
| where type =~ 'microsoft.storage/storageaccounts'
| where properties.encryption.services.blob.enabled != true
| project name, resourceGroup, location

Query for expired certificates:

Resources
| where type =~ 'microsoft.keyvault/vaults/certificates'
| extend expiry = todatetime(properties.attributes.exp)
| where expiry < now() + 30d
| project name, expiry, resourceGroup

Cost Context

Added cost data to resource views:

Resources
| where type =~ 'microsoft.compute/virtualmachines'
| extend vmSize = tostring(properties.hardwareProfile.vmSize)
| join kind=leftouter (
    CostManagementExports
    | summarize MonthlyCost = sum(Cost) by ResourceId
) on $left.id == $right.ResourceId
| project name, vmSize, MonthlyCost, resourceGroup

Global Filters

Original: Filter per-section

Enhanced: Global subscription/resource group filter applies to ALL sections

Implementation:

{
  "type": "dropdown",
  "name": "Subscriptions",
  "query": "ResourceContainers | where type == 'microsoft.resources/subscriptions' | project name, subscriptionId",
  "isMultiSelect": true
}

Result: Select subscriptions once, affects entire workbook

The Enhancement Process

Step 1: Clone Billy York's Repo

git clone https://github.com/scautomation/Azure-Inventory-Workbook

Step 2: Identify Missing Services

Query all resource types:

Resources
| distinct type
| order by type asc

Compare to workbook: Find gaps

Step 3: Add Service Sections

Template for new section:

{
  "type": "section",
  "title": "Azure OpenAI",
  "query": "Resources | where type =~ 'microsoft.cognitiveservices/accounts' | where kind == 'OpenAI' | project name, sku.name, location, resourceGroup"
}

Step 4: Add Security Checks

For each service, add:

Public exposure check
Encryption status
Certificate expiration
Compliance flags

Step 5: Add Cost Columns

Join cost data to resource queries:

Resources
| where type =~ '[service-type]'
| join kind=leftouter (
    CostManagementExports
    | where TimeGenerated > ago(30d)
    | summarize MonthlyCost = sum(Cost) by ResourceId
) on $left.id == $right.ResourceId

Real Example: SQL Databases

Original section (basic):

Resources
| where type =~ 'microsoft.sql/servers/databases'
| project name, resourceGroup, location

Enhanced section (with security + cost):

Resources
| where type =~ 'microsoft.sql/servers/databases'
| extend 
    serverName = split(id, '/')[8],
    tier = properties.sku.tier,
    encrypted = properties.transparentDataEncryption.status,
    publicAccess = properties.publicNetworkAccess
| join kind=leftouter (
    CostManagementExports
    | where TimeGenerated > ago(30d)
    | summarize MonthlyCost = sum(Cost) by ResourceId
) on $left.id == $right.ResourceId
| project 
    Database = name, 
    Server = serverName,
    Tier = tier,
    Encrypted = encrypted,
    PublicAccess = publicAccess,
    MonthlyCost = round(MonthlyCost, 2),
    ResourceGroup = resourceGroup,
    Location = location
| order by MonthlyCost desc

Result:

Shows SQL databases
Security status (encryption, public access)
Monthly cost
Sorted by expense

Performance Optimization

Problem: Workbook Timeout

Original: Single massive query for all subscriptions

Enhanced: Paginated queries with limits

Resources
| where type =~ 'microsoft.compute/virtualmachines'
| take 1000  // Pagination

Problem: Slow Joins

Original: Join every resource to cost data

Enhanced: Pre-aggregate cost data

// Pre-aggregate costs
let costs = CostManagementExports
| where TimeGenerated > ago(30d)
| summarize MonthlyCost = sum(Cost) by ResourceId;

// Then join
Resources
| where type =~ 'microsoft.compute/virtualmachines'
| join kind=leftouter costs on $left.id == $right.ResourceId

UI/UX Improvements

Conditional Visibility

Only show sections with resources:

{
  "conditionalVisibility": {
    "parameterName": "HasOpenAI",
    "comparison": "isEqualTo",
    "value": "true"
  }
}

Color Coding

Red: Security issues (public access, unencrypted)
Yellow: Warnings (expiring certs, high cost)
Green: Compliant resources

Export Functionality

Added: Export to CSV for each section

{
  "type": "button",
  "action": "export",
  "format": "csv"
}

Deployment

Option 1: Import JSON

Go to Azure Monitor → Workbooks
Click "New"
Click "Advanced Editor"
Paste enhanced JSON
Save

Option 2: ARM Template

{
  "type": "Microsoft.Insights/workbooks",
  "apiVersion": "2021-03-08",
  "name": "[guid('azure-inventory-enhanced')]",
  "location": "[resourceGroup().location]",
  "properties": {
    "displayName": "Azure Inventory Enhanced",
    "serializedData": "[parameters('workbookContent')]"
  }
}

Deploy with:

az deployment group create --resource-group Monitoring-RG --template-file workbook.json

Real Results

Before (Billy York original):

50 service types
No security context
No cost data
Good for small environments

After (enhanced):

200+ service types
Security hygiene checks
Cost context
Production-ready for enterprise

Time to generate inventory:

Before: Multiple tools, 2 hours
After: Single workbook, 30 seconds

Community Contribution

Billy York's original: https://github.com/scautomation/Azure-Inventory-Workbook

Our enhancements: Fork + pull request with:

150+ additional services
Security checks
Cost integration
Performance fixes

Attribution: Billy York deserves credit for building the foundation. We just scaled it.

Full Enhanced Workbook

Complete workbook JSON, deployment templates, and contribution guide:

👉 Enhanced Azure Inventory Workbook

Also on GitHub: [github.com/dswann101164/azure-inventory-workbook-enhanced]

Using Azure Workbooks? Start with community workbooks like Billy York's, then enhance for your needs. Don't build from scratch—extend what works.

Building Azure Dashboards for Cloud NOC Teams (What Actually Gets Used vs What Gets Ignored)

David — Fri, 12 Dec 2025 18:54:13 +0000

The Dashboard Problem

What we built: 47 tiles showing metrics, logs, alerts, compliance, costs

What NOC uses: 3 tiles

Why: Dashboard answered "what's our resource count?" not "what's broken?"

What NOC Teams Actually Need

Question #1: "What's Down Right Now?"

Not: 15 charts showing healthy services

Yes: List of failures, ranked by business impact

Question #2: "What Needs My Attention?"

Not: 200 active alerts

Yes: 5 critical alerts requiring human action

Question #3: "Is This Normal?"

Not: Current CPU usage

Yes: Current vs 7-day baseline with "normal range" shading

Dashboard Design That Works

Tile 1: Critical Incidents (Top Priority)

Query:

AzureActivity
| where Level == "Critical" or Level == "Error"
| where TimeGenerated > ago(1h)
| summarize Count=count() by ResourceGroup, OperationNameValue
| order by Count desc
| take 10

Display:

Red alert icon
Resource name
Error count
Time since first occurrence
Business impact (if known)

Tile 2: Service Health Issues

Query:

ServiceHealthResources
| where type == "microsoft.resourcehealth/events"
| where properties.status == "Active"
| project ServiceName = properties.service, 
          Issue = properties.title,
          Impact = properties.impact

Display:

Azure service name
Issue description
Affected regions
Link to status page

Tile 3: Failed Deployments

Query:

AzureActivity
| where OperationNameValue contains "Microsoft.Resources/deployments/write"
| where ActivityStatusValue == "Failed"
| where TimeGenerated > ago(24h)
| project TimeGenerated, Caller, ResourceGroup, ErrorMessage = Properties

Display:

Who tried to deploy
What failed
Error message
Time

Tile 4: Abnormal Resource Consumption

Query:

Perf
| where TimeGenerated > ago(1h)
| where CounterName == "% Processor Time"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 85

Display:

VM name
Current CPU %
Comparison to 7-day average
Threshold breach time

Tile 5: Budget Alerts

Query:

AzureActivity
| where OperationNameValue contains "Microsoft.Consumption"
| where Level == "Warning" or Level == "Error"
| where TimeGenerated > ago(24h)

Display:

Subscription name
Current spend
Budget amount
Forecast end-of-month

What NOT to Include

❌ Resource Counts

Why NOC doesn't care: "We have 847 VMs" doesn't help incident response

Who cares: Capacity planning team

Where it belongs: Monthly capacity review, not NOC dashboard

❌ Compliance Metrics

Why NOC doesn't care: "72% compliant with tag policy" isn't urgent at 2 AM

Who cares: Governance team

Where it belongs: Weekly governance report

❌ Cost Breakdown Charts

Why NOC doesn't care: "Compute is 45% of spend" doesn't help fix outages

Who cares: FinOps team

Where it belongs: Monthly cost review

❌ "Healthy" Status

Why NOC doesn't care: If it's working, they don't need to see it

Better: Only show failures. If dashboard is empty, everything's fine.

Real NOC Dashboard Example

Our 5-tile dashboard:

Critical Alerts (red box, top-left)
- Currently: 0
- If >0: Shows alert details
Service Health (orange box, top-right)
- Currently: 1 (Azure DevOps degraded, East US)
- Impact: Low
Failed Deployments (yellow box, middle-left)
- Last 24h: 3 failures
- Links to logs
High CPU VMs (yellow box, middle-right)
- Currently: 2 VMs over 85%
- Shows VM names, current %
Budget Status (green box, bottom)
- 67% of monthly budget used
- 45% of month elapsed
- Forecast: On track

Total tiles: 5

Time to understand status: 10 seconds

Dashboard Refresh Strategy

Real-Time Data (1-minute refresh)

Critical alerts
Service health
High CPU/memory

Near Real-Time (5-minute refresh)

Failed deployments
Error logs
Network issues

Hourly Refresh

Budget status
Backup failures
Compliance alerts

Common Mistakes

❌ Mistake #1: Too Many Tiles

Problem: 47 tiles, can't see critical issues

Fix: Maximum 10 tiles, prioritize by urgency

❌ Mistake #2: Showing "Green"

Problem: "99% of services healthy" takes space

Fix: Only show failures. Empty dashboard = everything's fine.

❌ Mistake #3: No Business Context

Problem: "VM-SQL-12 is down" (which app is that?)

Fix: Map VMs to apps in dashboard query

❌ Mistake #4: Metrics Without Baselines

Problem: "CPU is 45%" (is that normal?)

Fix: Show current vs 7-day average

The "Empty Dashboard Is Good" Philosophy

Traditional thinking: Dashboard must always show data

Better thinking: Dashboard shows PROBLEMS

Result:

Dashboard empty most of the time
When something appears, it's urgent
NOC knows exactly what to fix

Multi-Team Dashboard Strategy

Don't: One dashboard for everyone

Do: Separate dashboards per team:

NOC Dashboard

Incidents requiring immediate action
5 tiles, 10-second understanding

FinOps Dashboard

Cost trends
Budget tracking
Reservation coverage

Security Dashboard

Security alerts
Compliance violations
Vulnerability scans

Capacity Dashboard

Resource utilization
Growth trends
Forecast capacity needs

Full Dashboard Templates

Complete KQL queries, Azure Monitor Workbook templates, and multi-team dashboard architecture:

👉 Azure NOC Dashboard Complete Guide

Building dashboards for NOC teams? Show problems, not status. Empty dashboard = everything's working. That's success.

Azure Tag Governance Reality - Why 247 Variations of "Environment" Collapse Your Cost Reports

David — Fri, 12 Dec 2025 18:49:56 +0000

The Tag Governance Problem

Policy: "All resources must have Environment tag"

Reality: Teams create resources with:

Environment: Production
Env: Prod
environment: production
Enviroment: Production (typo)
Environment: PRODUCTION
Env: P

Result: Cost reports show 247 variations. Finance can't group costs.

Real Example: Our Tag Chaos

Query all "Environment" tags:

Resources
| extend envTag = tostring(tags.Environment)
| summarize count() by envTag
| order by count_ desc

Results:

Production - 847 resources
Prod - 312 resources
PRODUCTION - 156 resources
production - 89 resources
P - 67 resources
PRD - 43 resources
241 more variations...

Total: 247 unique values for "Production" alone

Why Tag Governance Fails

Problem #1: Azure Policy Doesn't Validate Values

Policy: "Require Environment tag"

What it checks: Tag key exists

What it doesn't check:

Value is valid
Capitalization is consistent
Spelling is correct

Result: Tag exists but value is garbage

Problem #2: Teams Work Around Policies

Policy: "Environment tag required"

Team: Creates resource with Environment: "TODO" to pass policy

Later: Never fixes it

Problem #3: No Enforcement at Portal

Portal lets you:

Free-type tag values
Ignore suggested values
Create typos
Use any capitalization

Problem #4: Terraform/ARM Templates Don't Help

tags = {
  Environment = var.environment  # What's in the variable?
}

If variable contains "prod" or "PROD" or "Production", all valid Terraform. All wrong for governance.

The Cost Impact

Finance request: "Show me Production costs vs Non-Production"

Without governance:

Resources
| extend env = tostring(tags.Environment)
| where env in ("Production", "Prod", "PRODUCTION", "production", 
               "PRD", "prd", "P", "p", "Prod1", "Production1"...)

Missing costs:

43 resources tagged PRD instead of Production
$12,000/month unaccounted for in reports

Tag Governance That Actually Works

Step 1: Define Standard Values

Environment tag allowed values:

Production (only this, exactly)
Staging
Development
Sandbox

That's it. No abbreviations. No variations. No typos.

Step 2: Azure Policy with Value Enforcement

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "anyOf": [
        {
          "field": "tags['Environment']",
          "exists": "false"
        },
        {
          "field": "tags['Environment']",
          "notIn": ["Production", "Staging", "Development", "Sandbox"]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Result: Invalid values blocked at creation

Step 3: Fix Existing Resources

// Find resources with non-standard values
Resources
| extend env = tostring(tags.Environment)
| where env !in ("Production", "Staging", "Development", "Sandbox")
| project name, resourceGroup, currentValue = env
| extend suggestedValue = case(
    env in~ ("Prod", "PRD", "P", "PRODUCTION", "production"),
        "Production",
    env in~ ("Stage", "STG", "S", "STAGING"),
        "Staging",
    env in~ ("Dev", "D", "DEVELOPMENT", "development"),
        "Development",
    "Sandbox"
)

Remediation script:

# Get resources with wrong tags
$resources = Get-AzResource | Where-Object {
    $_.Tags.Environment -notin @("Production", "Staging", "Development", "Sandbox")
}

# Fix them
foreach ($resource in $resources) {
    $currentValue = $resource.Tags.Environment

    # Map to standard value
    $newValue = switch -Regex ($currentValue) {
        "^[Pp](rod|RD)?$" { "Production" }
        "^[Ss](tage|taging|TG)?$" { "Staging" }
        "^[Dd](ev|EV)?$" { "Development" }
        default { "Sandbox" }
    }

    # Update tag
    $resource.Tags.Environment = $newValue
    Set-AzResource -ResourceId $resource.ResourceId -Tag $resource.Tags -Force
}

Step 4: Terraform Value Validation

variable "environment" {
  type        = string
  description = "Environment name"

  validation {
    condition = contains([
      "Production",
      "Staging", 
      "Development",
      "Sandbox"
    ], var.environment)
    error_message = "Environment must be exactly: Production, Staging, Development, or Sandbox"
  }
}

The Tag Taxonomy That Works

Required tags for ALL resources:

Environment - Production | Staging | Development | Sandbox
CostCenter - 4-digit code from finance
Owner - Email address
Application - App name from CMDB

Optional tags:

Project - Project code
Backup - Daily | Weekly | None
Compliance - PCI | HIPAA | SOX | None

Key principle: Every tag has DEFINED allowed values. No free text except Owner email.

Enforcement Timeline

Week 1: Policy Deployment

Deploy deny policies for new resources
Existing resources not affected

Week 2-4: Remediation

Run KQL queries to find non-compliant resources
Bulk fix with PowerShell scripts
Team meetings to explain standards

Week 5: Full Enforcement

All resources compliant
Deny policies block non-standard values
Cost reports finally accurate

Real Results

Before:

247 Environment tag variations
Cost reports required 2 hours of Excel cleanup
Finance didn't trust Azure cost data

After:

4 Environment tag values (only valid ones)
Cost reports accurate in 30 seconds
Finance trusts data, uses it for budgeting

Common Mistakes

❌ Mistake #1: Too Many Tags

Bad: Require 15 tags on every resource

Result: Teams copy-paste garbage to pass policy

Good: 4 required tags that matter

❌ Mistake #2: Free-Text Values

Bad: Allow any value for "Owner" tag

Result: "John", "john.doe", "j.doe@company.com", "IT Team"

Good: Validate email format with policy

❌ Mistake #3: No Remediation Plan

Bad: Deploy deny policy, existing resources broken

Result: Production deploys fail, emergency policy exemptions

Good: Fix existing resources BEFORE enforce mode

Full Governance Framework

Complete tag taxonomy, Azure Policy templates, remediation scripts, and enforcement timeline:

👉 Azure Tag Governance Complete Guide

Implementing tag governance? Define allowed values, enforce with policy, remediate existing resources, then enable deny mode. In that order.

50 Windows Commands Every Azure VM Admin Needs (PowerShell + Active Directory)

David — Fri, 12 Dec 2025 18:47:28 +0000

Why This List Exists

Azure Portal is great until:

RDP is slow
You need to fix networking
Active Directory breaks
You're troubleshooting 50 VMs

Then you need actual Windows commands.

Network Troubleshooting

Check IP Configuration

Get-NetIPAddress | Format-Table InterfaceAlias, IPAddress, PrefixLength

Test DNS Resolution

Resolve-DnsName azure-noob.com -Server 8.8.8.8

Trace Route to Endpoint

tracert 10.0.1.4

Check Open Ports

Test-NetConnection -ComputerName 10.0.1.4 -Port 443

Show Routing Table

route print

Flush DNS Cache

ipconfig /flushdns

Show Active Connections

netstat -ano | findstr ESTABLISHED

Active Directory Commands

Join Domain

Add-Computer -DomainName contoso.com -Credential (Get-Credential) -Restart

Verify Domain Join

nltest /dsgetdc:contoso.com

Check AD Replication

repadmin /replsummary

Find Domain Controllers

Get-ADDomainController -Filter * | Select Name, IPv4Address

Reset Computer Account

Reset-ComputerMachinePassword -Server DC01 -Credential (Get-Credential)

Test Domain Trust

nltest /sc_query:contoso.com

Disk Management

List All Disks

Get-Disk | Format-Table Number, FriendlyName, Size, PartitionStyle

Initialize New Disk

Initialize-Disk -Number 2 -PartitionStyle GPT

Create New Partition

New-Partition -DiskNumber 2 -UseMaximumSize -DriveLetter F
Format-Volume -DriveLetter F -FileSystem NTFS -NewFileSystemLabel "Data"

Extend Volume

Resize-Partition -DriveLetter C -Size (Get-PartitionSupportedSize -DriveLetter C).SizeMax

Check Disk Health

Get-PhysicalDisk | Select FriendlyName, HealthStatus, OperationalStatus

Service Management

List All Services

Get-Service | Where-Object {$_.Status -eq "Running"} | Format-Table Name, DisplayName

Start/Stop Service

Start-Service -Name "W32Time"
Stop-Service -Name "Spooler"

Set Service Startup Type

Set-Service -Name "wuauserv" -StartupType Manual

Check Service Dependencies

Get-Service -Name "W32Time" | Select -ExpandProperty DependentServices

Performance & Monitoring

Check CPU Usage

Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 5

Check Memory Usage

Get-WmiObject Win32_OperatingSystem | 
    Select @{N="FreeGB";E={[math]::Round($_.FreePhysicalMemory/1MB,2)}}

Show Top CPU Processes

Get-Process | Sort-Object CPU -Descending | Select -First 10 Name, CPU, PM

Check Disk I/O

Get-Counter '\PhysicalDisk(_Total)\Disk Reads/sec','\PhysicalDisk(_Total)\Disk Writes/sec'

Show Uptime

(Get-Date) - (gcim Win32_OperatingSystem).LastBootUpTime

Windows Updates

Check for Updates

Get-WindowsUpdate

Install Updates

Install-WindowsUpdate -AcceptAll -AutoReboot

Show Update History

Get-WmiObject -Class Win32_QuickFixEngineering | Select HotFixID, InstalledOn

User & Permission Management

List Local Admins

Get-LocalGroupMember -Group "Administrators"

Add User to Local Admin

Add-LocalGroupMember -Group "Administrators" -Member "CONTOSO\john.doe"

Show Logged-in Users

query user

Force Logoff User

logoff 2 /server:localhost

Check File Permissions

Get-Acl C:\Important\File.txt | Format-List

Firewall Management

Show Firewall Rules

Get-NetFirewallRule | Where Enabled -eq True | Select Name, DisplayName

Create Firewall Rule

New-NetFirewallRule -DisplayName "Allow SQL" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Allow

Disable Firewall (Testing Only!)

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Event Log Analysis

Show Recent Errors

Get-EventLog -LogName System -EntryType Error -Newest 20

Search Event Logs

Get-EventLog -LogName Application | Where-Object {$_.Message -like "*SQL*"}

Show Security Events

Get-EventLog -LogName Security -InstanceId 4624 -Newest 10

Azure-Specific Commands

Check Azure VM Agent

Get-Service WindowsAzureGuestAgent

Test Azure Metadata Service

Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01"

Show Azure VM Extensions

Get-AzVMExtension -ResourceGroupName "RG-Prod" -VMName "VM-SQL-01"

System Information

Show OS Version

Get-ComputerInfo | Select WindowsProductName, WindowsVersion, OsBuildNumber

Show Installed Programs

Get-WmiObject -Class Win32_Product | Select Name, Version

Check System Drivers

Get-WindowsDriver -Online

Show Environment Variables

set

Quick Fixes

Reset Windows Update

net stop wuauserv
del C:\Windows\SoftwareDistribution\*.* /s /q
net start wuauserv

Clear Temp Files

Remove-Item -Path "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue

Rebuild Windows Search Index

Get-Service WSearch | Restart-Service

Full Command Reference

Complete command library with parameters, examples, and troubleshooting guides:

👉 50 Windows Commands Complete Guide

Managing Azure VMs? Bookmark this. The Azure Portal can't do everything—sometimes you need actual Windows commands.

Azure Arc Ghost Registrations - 64% of Our Arc Servers Don't Exist

David — Fri, 12 Dec 2025 15:32:44 +0000

The Compliance Report Problem

Azure Policy dashboard: "850 Arc-enabled servers, 72% compliant"

VMware vCenter: "547 VMs total"

Math: 850 - 547 = 303 ghost registrations

Our compliance data was fiction.

What Are Ghost Registrations?

Problem: When you delete a VM, Azure Arc registration persists.

Result:

Compliance reports include servers that don't exist
Cost tracking is wrong
Security dashboards show phantom vulnerabilities
Nobody knows which servers are real

How It Happens

Scenario 1: Delete VM Without Removing Arc Agent

Most common

VMware admin deletes VM
Arc agent never uninstalls (VM gone)
Arc registration stays in Azure
Shows as "offline" forever

Scenario 2: VM Name Reuse

Delete VM named "SQL-PROD-01"
Create new VM with same name
Now TWO Arc registrations for "SQL-PROD-01"
Which one is real? Nobody knows.

Scenario 3: Failed Deletions

Try to delete Arc registration
API times out
Azure portal shows "deleted"
Resource Graph still shows it

The Impact

Compliance Reports Are Fiction

Azure Policy: "347 servers need patches"

Reality: 64% of those are ghosts

Finance: "Why are we patching 347 servers when we only have 220?"

Cost Tracking Is Wrong

Arc costs $5/server/month if you exceed free tier.

Bill: $4,250/month (850 servers)

Reality: $2,735/month (547 servers)

Overpayment: $1,515/month = $18K/year

Security False Positives

Microsoft Defender: "Critical vulnerabilities on 150 servers"

SOC team: Spends 40 hours investigating

Reality: 96 of those servers don't exist

How to Detect Ghosts

Method 1: Resource Graph Query

kql

Azure OpenAI Pricing Reality - $2 Demo Becomes $4,000/Month in Production

David — Fri, 12 Dec 2025 15:19:36 +0000

The Demo vs Production Gap

Demo: "We'll use GPT-4 for customer support. Costs $2/day in testing!"

Month 1 production: $4,200 bill arrives.

Month 2: $6,800.

Finance: "What happened to $2/day?"

Why Microsoft's Calculator Is Wrong

Microsoft's Azure OpenAI pricing calculator shows token costs. It doesn't show:

Hosting fees: $1,836/month minimum for fine-tuning
PTU costs: $2,448/month minimum for dedicated capacity
Embedding costs: Often more expensive than completions
Token ratio reality: Output tokens cost 3x input tokens

Real Pricing (December 2025)

GPT-4o (Newest, Cheapest GPT-4 Class)

Input: $0.005 per 1K tokens
Output: $0.015 per 1K tokens

GPT-4 Turbo

Input: $0.01 per 1K tokens
Output: $0.03 per 1K tokens

GPT-3.5 Turbo

Input: $0.0015 per 1K tokens
Output: $0.002 per 1K tokens

Text Embedding (ada-002)

$0.0001 per 1K tokens
(Sounds cheap until you embed millions of documents)

Token Math That Actually Matters

1,000 tokens ≈ 750 words

Typical customer support query:

User question: 50 tokens
System prompt: 200 tokens
Context from knowledge base: 1,000 tokens
Response: 300 tokens
Total: 1,550 tokens per interaction

Cost per interaction (GPT-4o):

Input: 1,250 tokens × $0.005 / 1,000 = $0.00625
Output: 300 tokens × $0.015 / 1,000 = $0.0045
Total: $0.01075 per interaction

At scale:

1,000 queries/day = $10.75/day = $323/month
10,000 queries/day = $107/day = $3,225/month

The Hidden Costs

Fine-Tuning Hosting Fee

$1,836/month minimum just to host a fine-tuned model. Even if you use it zero times.

When worth it:

High-volume specialized use case (>1M tokens/month)
Accuracy improvement justifies $22K/year fixed cost

When not worth it:

"Let's fine-tune for better results" (try prompt engineering first)
Low-volume use cases

SCCM vs WSUS vs Azure Update Manager vs Intune - Which One Do I Actually Use?

David — Fri, 12 Dec 2025 15:05:41 +0000

Three Different Microsoft Reps, Three Different Answers

Configuration Manager rep: "Keep using SCCM for everything, including Azure."

Azure architect: "Use Azure Update Manager, it's cloud-native and free."

Modern Management rep: "Migrate to Intune. SCCM is legacy."

The Actual Answer

You need all of them. Here's why.

What Each Tool Actually Does

SCCM (Configuration Manager)

Best for: On-prem servers, complex patch orchestration

Use when:

Managing 500+ on-prem Windows servers
Need staged deployments with approval workflows
Require detailed compliance reporting for audits
Have existing SCCM infrastructure

Don't use for:

Cloud-only VMs (expensive licensing)
Simple patch-and-reboot scenarios
Mobile devices

WSUS

Best for: Simple on-prem patching, tight budgets

Use when:

Small environment (<100 servers)
No budget for SCCM
Just need "apply patches monthly"
Windows updates only (no 3rd party apps)

Don't use for:

Anything requiring reporting
Azure VMs (why manage another server?)
macOS or Linux

Azure Update Manager

Best for: Azure VMs, hybrid Windows + Linux

Use when:

Patching Azure VMs (Windows or Linux)
Want cloud-native management
Need automatic patching schedules
No SCCM infrastructure in Azure

Don't use for:

On-prem servers (requires Arc)
3rd party app updates
Complex orchestration workflows

Intune

Best for: Endpoints (laptops, tablets, phones)

Use when:

Managing user devices
Remote/hybrid workforce
Modern cloud-native management
Windows 10/11 endpoints

Don't use for:

Servers
Legacy Windows Server 2012/2016
Complex patch orchestration

The Decision Matrix

Workload Type	Tool	Why
On-prem servers	SCCM or WSUS	Network access, existing infra
Azure Windows VMs	Azure Update Manager	Cloud-native, no agent install
Azure Linux VMs	Azure Update Manager	Only option for Azure Linux
Hybrid Arc servers	Azure Update Manager + Arc	Unified management
User laptops/desktops	Intune	Modern management
Legacy endpoints	SCCM	Still need complex deployments

Real-World Example: Our 850-VM Environment

What we use:

SCCM

300 on-prem Windows servers
Why: Existing infrastructure, complex approval workflows for production

Azure Update Manager

400 Azure Windows VMs
150 Azure Linux VMs
Why: Cloud-native, no SCCM licensing cost in Azure

Intune

1,200 user endpoints
Why: Modern management, remote workforce

WSUS

Nothing (deprecated for us)
Why: SCCM replaced it years ago

Migration Timeline

Don't migrate everything at once. Do it by workload:

Year 1

Keep SCCM for on-prem servers
Deploy Azure Update Manager for Azure VMs
Pilot Intune for 10% of endpoints

Year 2

Scale Intune to 100% of endpoints
Migrate hybrid servers to Arc + Update Manager
Keep SCCM for legacy servers only

Year 3

Retire SCCM as on-prem servers migrate to Azure
Full Azure Update Manager + Intune environment

The Cost Comparison

SCCM:

$100-$200 per server/year (licensing)
Plus: Infrastructure costs (servers, SQL, management)

WSUS:

Free (Windows Server license includes it)
But: Manual effort, limited reporting

Azure Update Manager:

Free (included with Azure VMs)
Pay for Arc agent if managing on-prem ($5/server/month)

Intune:

$6-$8 per user/month (part of M365 bundles)
Cloud service, no infrastructure

Common Mistakes

❌ Mistake #1: "We'll use Intune for servers"

No. Intune is for endpoints, not servers. Use Azure Update Manager.

❌ Mistake #2: "We'll keep SCCM in Azure"

Expensive. SCCM licensing in Azure costs more than the VMs themselves. Use Update Manager.

❌ Mistake #3: "We'll migrate everything to Intune"

Won't work. SCCM has orchestration capabilities Intune doesn't.

Full Guide

Complete decision matrix, migration timeline, and cost calculator:

👉 SCCM vs Update Manager Complete Guide

Patching Azure VMs? Azure Update Manager. Patching on-prem? SCCM or WSUS. Patching laptops? Intune. Use the right tool for each workload.

The Azure Hybrid Benefit Mistake That Cost Us $50K

David — Fri, 12 Dec 2025 15:00:10 +0000

The Audit Email

Subject: Azure Hybrid Benefit Compliance Review

Our reaction: "We're compliant. We have SA licenses."

Microsoft's finding: "Your documentation doesn't prove it."

The bill: $78,000 back-payment + penalties.

What Is Azure Hybrid Benefit?

Use existing Windows Server or SQL Server licenses in Azure. Saves 40-55% on VM costs.

The catch: Microsoft audits it. You must prove compliance.

What We Did Wrong

Mistake #1: No License Inventory

We knew we had Software Assurance (SA). We didn't know:

How many licenses
Which SKUs
When SA expires
Which VMs were using them

Mistake #2: Assumed Core Mapping

We thought: 1 license = 1 Azure VM

Reality: License cores must match Azure VM cores. A 16-core Azure VM needs 16 Windows Server core licenses.

Mistake #3: No Documentation

Applied AHB in portal. Didn't document:

Which on-prem license covered which Azure VM
SA renewal dates
Core count calculations

The Audit Process

Day 1: Microsoft requests license documentation

Day 3: We scramble to find Volume License agreements

Week 2: Discover 40% of AHB-enabled VMs lack proper coverage

Week 4: $78K bill arrives

How to Do It Right

Step 1: License Inventory

Before enabling AHB:

Count on-prem Windows Server licenses with active SA
Verify SA expiration dates
Calculate available Azure core count

Step 2: Core Math

Formula: On-prem license cores ÷ 2 = Azure cores covered

Example:

100 Windows Server licenses (2-core each) = 200 cores
200 ÷ 2 = 100 Azure cores covered
Can apply AHB to VMs totaling 100 cores

Step 3: Documentation

Track in spreadsheet:

Azure VM name
VM core count
On-prem license ID covering it
SA expiration date

Step 4: Ongoing Monitoring

Monthly AHB usage report
SA renewal tracking
New VM AHB approval process

The 8-Question Checklist

Before enabling AHB on ANY VM:

Do you have Windows Server or SQL Server licenses with active SA?
Are those licenses assigned to on-prem servers?
Can you shut down those on-prem servers? (Can't use same license twice)
Do you have enough license cores for the Azure VM size?
Is SA expiration > 6 months away?
Is this documented in your tracking spreadsheet?
Who approved this AHB usage?
Can you produce documentation for a Microsoft audit?

If any answer is "no" or "I'm not sure" → Don't enable AHB

When AHB Makes Sense

✅ Good use case:

Migrating 100 on-prem VMs to Azure
Those VMs have SA licenses
Shutting down on-prem datacenter
Clear license mapping

❌ Bad use case:

Dev/test VMs (use Dev/Test pricing instead)
"We think we have SA somewhere"
Can't find license documentation
On-prem servers staying active

Full Guide

Complete AHB compliance checklist, core calculation templates, and documentation requirements:

👉 Azure Hybrid Benefit Complete Guide

The 55-Question Assessment That Prevents Azure Migration Failures

David — Fri, 12 Dec 2025 14:57:35 +0000

The Meeting That Should Scare You

CIO: "We're migrating to Azure. How much will it cost?"

Consultant: "$800K, 18 months."

Reality: $2.3M, 28 months, half the apps still on-prem.

Why Migrations Fail

Not technical problems. Organizational problems:

Nobody knows what applications exist
Teams can't find installation media
License compliance is "figure it out later"
Dependencies discovered in month 14

The 55 Questions

Before touching Azure Migrate, answer these for EVERY application:

Application Basics

What does this app do? (If nobody knows, retire it)
Who owns it? (Name + phone number)
Where's the installation media?
What's the license model?

Dependencies

What databases does it connect to?
What APIs does it call?
What calls it?
What shared services does it use?

Current State

How many VMs?
What OS versions?
What's the network topology?
What's using public IPs?

Business Context

What's the business impact if it's down?
When can we migrate it? (Maintenance windows)
Who approves changes?

The Problem

Teams skip this. They:

Deploy Azure landing zones
Start Azure Migrate
Discover in month 6 nobody knows what they own

Then:

Budget doubles
Timeline extends
Political pressure builds
Consultants suggest "hybrid strategy" (translation: we failed)

What Actually Works

Phase 1: Discovery (Before Azure)

Application inventory
Dependency mapping
License audit
Owner identification

Timeline: 2-3 months

Cost: $50K-$150K

Value: Prevents $2M+ overruns

Phase 2: Rationalization

Retire 20-30% of apps (nobody uses them)
Rehost 40-50% (lift-and-shift)
Refactor 20-30% (modernize)
Retain 10% on-prem (compliance, cost)

Phase 3: Azure Deployment

Now you can actually use Azure Migrate successfully.

Download the Framework

Complete 55-question assessment with:

Application questionnaire
Dependency mapping template
License compliance checklist
Week-by-week migration timeline

👉 [Download Migration Assessment Framewor

KQL Cheat Sheet for Azure Resource Graph

David — Fri, 12 Dec 2025 14:54:05 +0000

Why This Matters

No Azure cert teaches operational KQL. AZ-104 shows 2 sample queries. That's it.

Here's what you actually need: queries for 31,000+ resource environments.

Essential Queries

Complete VM Inventory

Resources
| where type == "microsoft.compute/virtualmachines"
| extend NetworkInterfaceId = tostring(properties.networkProfile.networkInterfaces[0].id)
| join kind=leftouter (
    Resources
    | where type == "microsoft.network/networkinterfaces"
    | project NetworkInterfaceId = id, 
              PrivateIP = tostring(properties.ipConfigurations[0].properties.privateIPAddress)
) on NetworkInterfaceId
| project VMName = name, PrivateIP, resourceGroup, location

Find Untagged Resources

Resources
| where isnull(tags) or array_length(bag_keys(tags)) == 0
| project name, type, resourceGroup
| order by type

Public IP Audit

Resources
| where type =~ 'microsoft.network/publicipaddresses'
| extend ipAddress = properties.ipAddress,
         associatedResource = properties.ipConfiguration.id
| project name, ipAddress, associatedResource, resourceGroup

Performance Tips

Filter early: | where type == ... before other operations
Project only needed columns: Reduces memory usage
Use in for multiple conditions: Faster than or

Full Guide

45+ queries with performance optimization, SQL translation, and advanced techniques:

👉 Complete KQL Cheat Sheet

Questions? Drop them in comments. Managing Azure at scale? These queries save hours daily.