guides/identity/

This hub, as a tree

• _boot/1f · 5,942t
  • Azure hub — start here5,942 tok
• changelog/9f · 8,985t
  • Azure hub — Compute family (2026-10-20)1,177 tok
  • Azure hub — gap fill for families 1 to 5 (2026-10-20)1,305 tok
  • Azure hub — first release, identity and access (2026-10-20)731 tok
  • Azure hub — Networking family (2026-10-20)910 tok
  • Azure hub — Resource Manager and IaC family (2026-10-20)843 tok
  • Azure hub — Storage family (2026-10-20)1,125 tok
  • Azure hub — Databases family (2026-10-21)1,123 tok
  • Azure hub — databases gap fill (2026-10-21)830 tok
  • Azure hub — family 7, Observability (2026-10-21)941 tok
• examples/0f · 0t
• guides/15f · 30,414t
  • app-service/1f · 1,783t
    • Deploy a Node.js TypeScript app to App Service on Linux without publishing passwords1,783 tok
  • arm/1f · 1,433t
    • Find the real error in a failed Bicep or ARM deployment1,433 tok
  • bicep/1f · 2,140t
    • Deploy a Bicep file at the right scope — validate, preview, deploy2,140 tok
  • entra/2f · 3,970t
    • Create a service principal for automation — and rotate its credential safely1,669 tok
    • Deploy to Azure from GitHub Actions without secrets (OIDC)2,301 tok
  • functions/1f · 2,630t
    • Deploy a TypeScript function app to Flex Consumption without keys2,630 tok
  • identity/1f · 2,015t
    • Fix "access denied" on Azure, layer by layer2,015 tok
  • managed-identity/1f · 1,817t
    • Give an app a managed identity and use it from TypeScript1,817 tok
  • monitor/1f · 2,375t
    • Instrument a Node.js app with OpenTelemetry and keyless Application Insights2,375 tok
  • networking/1f · 2,118t
    • Diagnose a connection that times out or is refused inside Azure2,118 tok
  • rbac/1f · 1,826t
    • Assign Azure roles from the CLI, Bicep and TypeScript — idempotently1,826 tok
  • sql/1f · 2,131t
    • Connect to Azure SQL Database from TypeScript with a managed identity — Entra-only server, database user, mssql token credential, retries2,131 tok
  • storage/2f · 4,601t
    • Read and write Blob and Data Lake storage from TypeScript with Entra ID2,340 tok
    • Create a storage account that is keyless, private to the right networks and redeploys cleanly2,261 tok
  • When the Azure portal or Entra admin center has changed1,575 tok
• patterns/9f · 15,415t
  • alternatives/1f · 1,231t
    • Terraform (azurerm) as the alternative to Bicep1,231 tok
  • App to a database with a managed identity — Azure SQL, Cosmos DB, PostgreSQL, MySQL and Managed Redis side by side1,494 tok
  • App to Key Vault with a managed identity1,415 tok
  • App to Blob Storage with a managed identity1,946 tok
  • Bicep that redeploys cleanly (idempotent infrastructure)1,705 tok
  • Function app to its storage account without keys1,588 tok
  • GitHub Actions to Azure (OIDC handoff)1,460 tok
  • GitHub Actions to Container Registry to Container Apps, with managed identities and no registry passwords2,335 tok
  • Private endpoint for a PaaS service — subnet, private DNS zone, VNet link and zone group, with known-bad configurations2,241 tok
• raw/0f · 0t
• reference/73f · 160,519t
  • app-service/3f · 7,153t
    • App Service Environment v3 — subnet sizing, internal or external VIP, private DNS, NSG and routing rules, Isolated v2 and v42,363 tok
    • App Service configuration and networking — startup, build, deployment auth, outbound IPs, VNet integration, Key Vault references2,439 tok
    • App Service errors — app won't start, 502/503, 403 stopped, container pulls, deployment and Key Vault references2,351 tok
  • application-gateway/1f · 2,695t
    • Application Gateway and WAF errors — 502, unhealthy backends, certificates, WAF 403s, Key Vault certificates and subnet rules2,695 tok
  • arm/6f · 10,927t
    • ARM and Bicep deployment errors — template, dependency and state2,332 tok
    • Deployment stacks — managed sets of resources, deletion and deny settings1,492 tok
    • Azure Resource Manager errors — subscription, provider, quota, SKU and region2,551 tok
    • Resource locks and tags — what they block and their limits1,269 tok
    • Resource IDs, resource providers and API versions1,649 tok
    • Resource Manager throttling and long-running operations1,634 tok
  • azd/1f · 1,427t
    • Azure Developer CLI (azd) errors and how azd provisions1,427 tok
  • azure-identity/2f · 4,062t
    • DefaultAzureCredential and the credential chain (TypeScript)1,804 tok
    • Azure Identity SDK errors (TypeScript)2,258 tok
  • bicep/1f · 1,909t
    • Bicep compiler and linter messages (BCP codes)1,909 tok
  • container-apps/2f · 4,302t
    • Container Apps — environments, ingress, revisions, scale, probes, secrets and registry identity2,108 tok
    • Container Apps errors — image pulls, revisions that never get ready, probes, target port, identity and capacity2,194 tok
  • container-instances/1f · 2,586t
    • Container Instances errors — image pulls with managed identity, capacity, quota, rate limits, restarts and exit codes2,586 tok
  • container-registry/1f · 2,729t
    • Container Registry errors — login, pull and push failures, the ABAC role mode, firewall, DNS and limits2,729 tok
  • cosmos-db/3f · 6,766t
    • Cosmos DB for NoSQL access and design — data-plane RBAC, keys off, network, TLS, partition keys, serverless, with Bicep2,341 tok
    • Cosmos DB for NoSQL errors — 403 network, RBAC and substatus codes, 429 throttling, 404, 409, 412, 413, 449 and 503, from TypeScript2,351 tok
    • Cosmos DB's other APIs and Azure DocumentDB — MongoDB (RU), DocumentDB (vCore) with Entra, Table, Cassandra and Gremlin2,074 tok
  • databases/1f · 1,326t
    • Retired and retiring Azure database services and their replacements1,326 tok
  • entra/4f · 8,707t
    • Microsoft Entra token errors for apps and service principals (AADSTS)2,550 tok
    • Federated identity credential errors (workload identity federation)2,367 tok
    • Microsoft Entra user sign-in and session errors (AADSTS)1,420 tok
    • Workload and agent identities — Conditional Access for service principals, CAE, and Microsoft Entra Agent ID2,370 tok
  • front-door/1f · 1,555t
    • Front Door errors — 504 OriginTimeout, HTTPS-only 502s, 404 on custom domains, 429, and the classic retirement1,555 tok
  • functions/4f · 9,754t
    • Durable Functions — storage providers, task hubs, Durable Task Scheduler with managed identity, the Node.js model, and stuck orchestrations3,004 tok
    • Azure Functions errors — runtime unreachable, host storage, AZFD events, Node.js v4 and CLI create failures2,569 tok
    • Azure Functions on Container Apps — the native kind=functionapp model, the legacy Microsoft.Web model, scaling, identity and limits1,694 tok
    • Azure Functions hosting plans and host storage — Flex Consumption, retirements, identity-based AzureWebJobsStorage2,487 tok
  • keyvault/1f · 2,314t
    • Key Vault access — permission models, network, soft delete and errors2,314 tok
  • load-balancer/1f · 1,669t
    • Load Balancer errors — deployment codes, health probes, no inbound traffic on Standard, and outbound SNAT1,669 tok
  • managed-identity/1f · 2,133t
    • Managed identity errors and delays2,133 tok
  • monitor/5f · 11,176t
    • Azure Monitor alerts — rule types, action groups, limits, log search alert identity, and why alerts don't fire or misfire2,778 tok
    • Application Insights errors and missing telemetry — Entra ingestion errors, where telemetry is lost, sampling, daily cap and limits1,641 tok
    • Getting data into Azure Monitor — diagnostic settings, data collection rules, Azure Monitor Agent and the Logs Ingestion API2,983 tok
    • Log Analytics workspaces — design, table plans, retention, access control, daily cap, and querying from TypeScript2,081 tok
    • Azure Monitor — which pieces to use in 2026, where each signal goes, and what has been retired1,693 tok
  • mysql/1f · 2,219t
    • Azure Database for MySQL flexible server — Entra authentication with a user-assigned identity, CREATE AADUSER, cleartext tokens from Node.js, versions and extended support2,219 tok
  • networking/9f · 20,205t
    • Azure Bastion — SKUs, AzureBastionSubnet and NSG rules, peering and roles, forced tunnelling, and connection failures1,777 tok
    • Networking errors — subnets, delegation, peering, private endpoint creation, approval, DNS and deletion2,911 tok
    • Azure Firewall and DDoS Protection — SKUs, rule processing order, SNAT, forced tunnelling and the management NIC, DNS proxy, known issues, DDoS tiers2,018 tok
    • NSGs and routes — rule evaluation, default rules, service tags, application security groups, user-defined routes and next hops1,886 tok
    • Outbound connectivity — default outbound access, NAT gateway Standard and StandardV2, load balancer outbound rules, SNAT exhaustion2,185 tok
    • Private endpoints and private DNS — zone names per service, resolution paths, links, fallback, approval and network policies2,464 tok
    • Hub-and-spoke at scale — Virtual WAN hubs and routing intent, Azure Virtual Network Manager groups, connectivity, security admin rules, UDR management and IPAM1,998 tok
    • Virtual networks, subnets and peering — sizing, reserved addresses, special subnets, delegation, private subnets and peering rules2,423 tok
    • VPN Gateway and ExpressRoute — gateway SKUs and retirements, GatewaySubnet, active-active and BGP, IKE error codes, circuit states and gateway migration errors2,543 tok
  • overview/1f · 2,914t
    • Azure hub map — services covered and which identity to use2,914 tok
  • policy/1f · 2,491t
    • Azure Policy — effects, timing and RequestDisallowedByPolicy2,491 tok
  • postgresql/2f · 4,063t
    • Azure Database for PostgreSQL flexible server — Entra authentication, roles for managed identities, private access or private endpoints, versions and extended support, errors2,666 tok
    • PostgreSQL flexible server operations — read replicas and virtual endpoints, in-place major version upgrades, elastic clusters1,397 tok
  • rbac/2f · 4,408t
    • Azure RBAC and authorization errors2,202 tok
    • Azure RBAC — scopes, roles and role assignments2,206 tok
  • redis/1f · 2,404t
    • Azure Managed Redis — replacing Azure Cache for Redis, tiers, clustering policies, Entra authentication from Node.js, Bicep2,404 tok
  • sql/4f · 7,402t
    • Azure SQL Database connections and authentication — Entra-only, admins and contained users, network access, connection policy, TLS, serverless resume2,192 tok
    • Azure SQL Database errors — login, network, availability, throttling, resource limits and management operations2,319 tok
    • Azure SQL Managed Instance — subnet, endpoints and ports, Entra logins, failover groups, and how it differs from SQL Database1,560 tok
    • Azure SQL Database scale and continuity — Hyperscale, elastic pools, failover groups and geo-replication1,331 tok
  • storage/11f · 26,626t
    • Storage access errors — Entra ID, network and account gates (401, 403, 409)2,620 tok
    • Storage access models — Entra data roles, Shared Key, SAS and anonymous access2,436 tok
    • Storage accounts — kinds, SKUs and redundancy, names and endpoints, TLS, hierarchical namespace, tiers and lifecycle2,472 tok
    • ADLS Gen2 — how RBAC, ABAC and ACLs combine, ACL rules, and Blob API differences1,670 tok
    • Blob data protection — soft delete, versioning, change feed, point-in-time restore, immutability and object replication2,655 tok
    • Storage data errors — 404, 409, 412, 416, 503 on Blob and ADLS Gen22,895 tok
    • Azure Files access — SMB identity sources, share-level roles, managed identities over SMB, NFS, and mount errors2,607 tok
    • Storage network access — public network access, firewall rules, private endpoints and perimeters2,574 tok
    • Storage Shared Key and SAS errors — KeyBasedAuthenticationNotPermitted, AuthenticationFailed and the SAS mismatch codes2,122 tok
    • Storage SAS — user delegation, service and account SAS, expiration policy and pitfalls2,230 tok
    • Table storage — data model limits, Entra ID access from TypeScript, entity group transactions and Table error codes2,345 tok
  • vm/2f · 4,597t
    • Virtual machine errors — allocation, provisioning, extensions, parameters and operation conflicts2,478 tok
    • VM scale sets and images — Flexible versus Uniform, upgrade policies, health and automatic repairs, Azure Compute Gallery2,119 tok
• Azure hub811 tok