# Azure hub

Hub: azure
Section served: docs
Start here: call the `_hello` tool on the MCP endpoint below. It says what this endpoint is and names the first document to read; every answer after it names the next call. No key and no header are needed to read a public hub.
Canonical document URL: https://cuppy.io/azure/doc/{path without .md}
Raw markdown URL: https://cuppy.io/azure/docs/{path}
Raw file URL: the same path with its .md extension
Sitemap: https://cuppy.io/azure/sitemap.xml
MCP endpoint: https://cuppy.io/mcp/azure — start with the `_hello` tool: ranked search across the hub, the merged view when you work in a layer, workarounds matched to the error you hit, and depth control.
Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.

## Folders
- changelog/ — 9 files, 8985 tokens
- guides/ — 1 files, 1575 tokens
- guides/app-service/ — 1 files, 1783 tokens
- guides/arm/ — 1 files, 1433 tokens
- guides/bicep/ — 1 files, 2140 tokens
- guides/entra/ — 2 files, 3970 tokens
- guides/functions/ — 1 files, 2630 tokens
- guides/identity/ — 1 files, 2015 tokens
- guides/managed-identity/ — 1 files, 1817 tokens
- guides/monitor/ — 1 files, 2375 tokens
- guides/networking/ — 1 files, 2118 tokens
- guides/rbac/ — 1 files, 1826 tokens
- guides/sql/ — 1 files, 2131 tokens
- guides/storage/ — 2 files, 4601 tokens
- patterns/ — 8 files, 14184 tokens
- patterns/alternatives/ — 1 files, 1231 tokens
- reference/app-service/ — 3 files, 7153 tokens
- reference/application-gateway/ — 1 files, 2695 tokens
- reference/arm/ — 6 files, 10927 tokens
- reference/azd/ — 1 files, 1427 tokens
- reference/azure-identity/ — 2 files, 4062 tokens
- reference/bicep/ — 1 files, 1909 tokens
- reference/container-apps/ — 2 files, 4302 tokens
- reference/container-instances/ — 1 files, 2586 tokens
- reference/container-registry/ — 1 files, 2729 tokens
- reference/cosmos-db/ — 3 files, 6766 tokens
- reference/databases/ — 1 files, 1326 tokens
- reference/entra/ — 4 files, 8707 tokens
- reference/front-door/ — 1 files, 1555 tokens
- reference/functions/ — 4 files, 9754 tokens
- reference/keyvault/ — 1 files, 2314 tokens
- reference/load-balancer/ — 1 files, 1669 tokens
- reference/managed-identity/ — 1 files, 2133 tokens
- reference/monitor/ — 5 files, 11176 tokens
- reference/mysql/ — 1 files, 2219 tokens
- reference/networking/ — 9 files, 20205 tokens
- reference/overview/ — 1 files, 2914 tokens
- reference/policy/ — 1 files, 2491 tokens
- reference/postgresql/ — 2 files, 4063 tokens
- reference/rbac/ — 2 files, 4408 tokens
- reference/redis/ — 1 files, 2404 tokens
- reference/sql/ — 4 files, 7402 tokens
- reference/storage/ — 11 files, 26626 tokens
- reference/vm/ — 2 files, 4597 tokens

## Hub pages
- https://cuppy.io/azure — the hub's front page: what it is, its folder spine with counts
- https://cuppy.io/azure/documents/{folder} — one folder, laid out as a catalog or a reading list
- https://cuppy.io/azure/doc/{path without .md} — one document, rendered
- https://cuppy.io/azure/search?q={query} — one search over this hub
(on a host this hub serves directly, drop the `/azure` prefix: /, /documents/{folder}, /doc/{path}, /search)

## Files
- HUB.md — BHMV-K0CD — Azure hub — boot/markdown — 811 tokens — asserted
- changelog/2026-10-20-compute-family.md — ZKRB-9YJ9 — Azure hub — Compute family (2026-10-20) — reference/markdown — 1177 tokens — asserted
- changelog/2026-10-20-gap-fill.md — 47ZT-YJYW — Azure hub — gap fill for families 1 to 5 (2026-10-20) — reference/markdown — 1305 tokens — asserted
- changelog/2026-10-20-identity-family.md — VDPF-2ZH3 — Azure hub — first release, identity and access (2026-10-20) — reference/markdown — 731 tokens — asserted
- changelog/2026-10-20-networking-family.md — KJHT-HD6Q — Azure hub — Networking family (2026-10-20) — reference/markdown — 910 tokens — asserted
- changelog/2026-10-20-resource-manager-family.md — ARMZ-GWRV — Azure hub — Resource Manager and IaC family (2026-10-20) — reference/markdown — 843 tokens — asserted
- changelog/2026-10-20-storage-family.md — 6Z06-4ZAQ — Azure hub — Storage family (2026-10-20) — reference/markdown — 1125 tokens — asserted
- changelog/2026-10-21-databases-family.md — EYZD-EJQH — Azure hub — Databases family (2026-10-21) — reference/markdown — 1123 tokens — asserted
- changelog/2026-10-21-databases-gap-fill.md — RFZP-3JBE — Azure hub — databases gap fill (2026-10-21) — reference/markdown — 830 tokens — asserted
- changelog/2026-10-21-observability-family.md — KHY7-Z9PW — Azure hub — family 7, Observability (2026-10-21) — reference/markdown — 941 tokens — asserted
- guides/app-service/deploy-node-app.md — QTDZ-GN4R — Deploy a Node.js TypeScript app to App Service on Linux without publishing passwords — guide/markdown — 1783 tokens — asserted
- guides/arm/debug-failed-deployment.md — 5C5S-R6WX — Find the real error in a failed Bicep or ARM deployment — guide/markdown — 1433 tokens — asserted
- guides/bicep/deploy-bicep.md — RKED-DQ1C — Deploy a Bicep file at the right scope — validate, preview, deploy — guide/markdown — 2140 tokens — asserted
- guides/entra/create-service-principal.md — VJ76-MSHD — Create a service principal for automation — and rotate its credential safely — guide/markdown — 1669 tokens — asserted
- guides/entra/github-actions-oidc.md — 9X2M-1BJ7 — Deploy to Azure from GitHub Actions without secrets (OIDC) — guide/markdown — 2301 tokens — asserted
- guides/functions/deploy-typescript-function.md — S6Q1-SFPT — Deploy a TypeScript function app to Flex Consumption without keys — guide/markdown — 2630 tokens — asserted
- guides/identity/fix-access-denied.md — 5KKJ-HPJR — Fix "access denied" on Azure, layer by layer — guide/markdown — 2015 tokens — asserted
- guides/managed-identity/use-managed-identity.md — ZM1W-BQ8M — Give an app a managed identity and use it from TypeScript — guide/markdown — 1817 tokens — asserted
- guides/monitor/instrument-node-app-with-opentelemetry.md — 5KJZ-RT2K — Instrument a Node.js app with OpenTelemetry and keyless Application Insights — guide/markdown — 2375 tokens — asserted
- guides/networking/diagnose-connectivity.md — 0DBP-P6EC — Diagnose a connection that times out or is refused inside Azure — guide/markdown — 2118 tokens — asserted
- guides/rbac/assign-roles.md — 447T-DE9Z — Assign Azure roles from the CLI, Bicep and TypeScript — idempotently — guide/markdown — 1826 tokens — asserted
- guides/sql/connect-from-typescript.md — 0NZX-739H — Connect to Azure SQL Database from TypeScript with a managed identity — Entra-only server, database user, mssql token credential, retries — guide/markdown — 2131 tokens — asserted
- guides/storage/access-blobs-from-typescript.md — 343K-DEG4 — Read and write Blob and Data Lake storage from TypeScript with Entra ID — guide/markdown — 2340 tokens — asserted
- guides/storage/create-secure-storage-account.md — W7M3-AHXW — Create a storage account that is keyless, private to the right networks and redeploys cleanly — guide/markdown — 2261 tokens — asserted
- guides/when-the-portal-has-changed.md — HR2Q-ZTWT — When the Azure portal or Entra admin center has changed — guide/markdown — 1575 tokens — asserted
- patterns/alternatives/terraform-azurerm.md — MFS5-8126 — Terraform (azurerm) as the alternative to Bicep — pattern/markdown — 1231 tokens — asserted
- patterns/app-to-database-with-managed-identity.md — SF89-S31Y — App to a database with a managed identity — Azure SQL, Cosmos DB, PostgreSQL, MySQL and Managed Redis side by side — pattern/markdown — 1494 tokens — asserted
- patterns/app-to-keyvault-with-managed-identity.md — A70E-F5FJ — App to Key Vault with a managed identity — pattern/markdown — 1415 tokens — asserted
- patterns/app-to-storage-with-managed-identity.md — 2GNJ-V717 — App to Blob Storage with a managed identity — pattern/markdown — 1946 tokens — asserted
- patterns/bicep-idempotent-redeploy.md — W6T3-4PCG — Bicep that redeploys cleanly (idempotent infrastructure) — pattern/markdown — 1705 tokens — asserted
- patterns/functions-keyless-host-storage.md — PPR1-VX8Q — Function app to its storage account without keys — pattern/markdown — 1588 tokens — asserted
- patterns/github-actions-to-azure.md — T2VF-VW2X — GitHub Actions to Azure (OIDC handoff) — pattern/markdown — 1460 tokens — asserted
- patterns/github-actions-to-container-apps.md — Q9HX-BSSY — GitHub Actions to Container Registry to Container Apps, with managed identities and no registry passwords — pattern/markdown — 2335 tokens — asserted
- patterns/private-endpoint-for-paas.md — HTCZ-GYKF — Private endpoint for a PaaS service — subnet, private DNS zone, VNet link and zone group, with known-bad configurations — pattern/markdown — 2241 tokens — asserted
- reference/app-service/app-service-environment.md — T50Y-P0H6 — App Service Environment v3 — subnet sizing, internal or external VIP, private DNS, NSG and routing rules, Isolated v2 and v4 — reference/markdown — 2363 tokens — asserted
- reference/app-service/configuration-and-networking.md — 76WR-H9ZX — App Service configuration and networking — startup, build, deployment auth, outbound IPs, VNet integration, Key Vault references — reference/markdown — 2439 tokens — asserted
- reference/app-service/errors.md — DHKD-S25V — App Service errors — app won't start, 502/503, 403 stopped, container pulls, deployment and Key Vault references — reference/markdown — 2351 tokens — asserted
- reference/application-gateway/errors.md — 0K4Q-8BY8 — Application Gateway and WAF errors — 502, unhealthy backends, certificates, WAF 403s, Key Vault certificates and subnet rules — reference/markdown — 2695 tokens — asserted
- reference/arm/deployment-errors.md — XADB-BPH0 — ARM and Bicep deployment errors — template, dependency and state — reference/markdown — 2332 tokens — asserted
- reference/arm/deployment-stacks.md — 46WD-SV5E — Deployment stacks — managed sets of resources, deletion and deny settings — reference/markdown — 1492 tokens — asserted
- reference/arm/errors.md — ME2A-B3R1 — Azure Resource Manager errors — subscription, provider, quota, SKU and region — reference/markdown — 2551 tokens — asserted
- reference/arm/locks-and-tags.md — PE1M-CEFM — Resource locks and tags — what they block and their limits — reference/markdown — 1269 tokens — asserted
- reference/arm/resource-ids-and-providers.md — P9ZK-RDTT — Resource IDs, resource providers and API versions — reference/markdown — 1649 tokens — asserted
- reference/arm/throttling-and-long-running-operations.md — 1VD0-ZV4A — Resource Manager throttling and long-running operations — reference/markdown — 1634 tokens — asserted
- reference/azd/errors.md — 1G1K-PC9S — Azure Developer CLI (azd) errors and how azd provisions — reference/markdown — 1427 tokens — asserted
- reference/azure-identity/credential-chain.md — KFB7-TGY9 — DefaultAzureCredential and the credential chain (TypeScript) — reference/markdown — 1804 tokens — asserted
- reference/azure-identity/errors.md — ZTRJ-MHNR — Azure Identity SDK errors (TypeScript) — reference/markdown — 2258 tokens — asserted
- reference/bicep/compile-errors.md — 7AS4-R2KT — Bicep compiler and linter messages (BCP codes) — reference/markdown — 1909 tokens — asserted
- reference/container-apps/apps-ingress-and-scale.md — H8X2-B6V7 — Container Apps — environments, ingress, revisions, scale, probes, secrets and registry identity — reference/markdown — 2108 tokens — asserted
- reference/container-apps/errors.md — 0E4Y-5PR8 — Container Apps errors — image pulls, revisions that never get ready, probes, target port, identity and capacity — reference/markdown — 2194 tokens — asserted
- reference/container-instances/errors.md — 4GFH-FT3X — Container Instances errors — image pulls with managed identity, capacity, quota, rate limits, restarts and exit codes — reference/markdown — 2586 tokens — asserted
- reference/container-registry/errors.md — NFJ8-1YK4 — Container Registry errors — login, pull and push failures, the ABAC role mode, firewall, DNS and limits — reference/markdown — 2729 tokens — asserted
- reference/cosmos-db/access-and-modeling.md — B2NQ-W3P3 — Cosmos DB for NoSQL access and design — data-plane RBAC, keys off, network, TLS, partition keys, serverless, with Bicep — reference/markdown — 2341 tokens — asserted
- reference/cosmos-db/errors.md — M49B-PH2G — Cosmos DB for NoSQL errors — 403 network, RBAC and substatus codes, 429 throttling, 404, 409, 412, 413, 449 and 503, from TypeScript — reference/markdown — 2351 tokens — asserted
- reference/cosmos-db/other-apis-and-documentdb.md — TC9A-YQ8N — Cosmos DB's other APIs and Azure DocumentDB — MongoDB (RU), DocumentDB (vCore) with Entra, Table, Cassandra and Gremlin — reference/markdown — 2074 tokens — asserted
- reference/databases/retired-and-replacements.md — J0EH-2MT3 — Retired and retiring Azure database services and their replacements — reference/markdown — 1326 tokens — asserted
- reference/entra/errors.md — JB2M-G52B — Microsoft Entra token errors for apps and service principals (AADSTS) — reference/markdown — 2550 tokens — asserted
- reference/entra/federated-credential-errors.md — BENQ-6PRT — Federated identity credential errors (workload identity federation) — reference/markdown — 2367 tokens — asserted
- reference/entra/sign-in-errors.md — 978F-F4CY — Microsoft Entra user sign-in and session errors (AADSTS) — reference/markdown — 1420 tokens — asserted
- reference/entra/workload-and-agent-identities.md — BN6D-5JZF — Workload and agent identities — Conditional Access for service principals, CAE, and Microsoft Entra Agent ID — reference/markdown — 2370 tokens — asserted
- reference/front-door/errors.md — FAWM-REC1 — Front Door errors — 504 OriginTimeout, HTTPS-only 502s, 404 on custom domains, 429, and the classic retirement — reference/markdown — 1555 tokens — asserted
- reference/functions/durable-functions.md — B462-59WP — Durable Functions — storage providers, task hubs, Durable Task Scheduler with managed identity, the Node.js model, and stuck orchestrations — reference/markdown — 3004 tokens — asserted
- reference/functions/errors.md — FFDY-C9BC — Azure Functions errors — runtime unreachable, host storage, AZFD events, Node.js v4 and CLI create failures — reference/markdown — 2569 tokens — asserted
- reference/functions/functions-on-container-apps.md — JR0F-RJ74 — Azure Functions on Container Apps — the native kind=functionapp model, the legacy Microsoft.Web model, scaling, identity and limits — reference/markdown — 1694 tokens — asserted
- reference/functions/hosting-and-host-storage.md — X1F6-XMVA — Azure Functions hosting plans and host storage — Flex Consumption, retirements, identity-based AzureWebJobsStorage — reference/markdown — 2487 tokens — asserted
- reference/keyvault/access-and-errors.md — 94B6-102S — Key Vault access — permission models, network, soft delete and errors — reference/markdown — 2314 tokens — asserted
- reference/load-balancer/errors.md — 04Q3-XJY7 — Load Balancer errors — deployment codes, health probes, no inbound traffic on Standard, and outbound SNAT — reference/markdown — 1669 tokens — asserted
- reference/managed-identity/errors.md — GCZK-E5VM — Managed identity errors and delays — reference/markdown — 2133 tokens — asserted
- reference/monitor/alerts.md — 9AN7-KFYD — Azure Monitor alerts — rule types, action groups, limits, log search alert identity, and why alerts don't fire or misfire — reference/markdown — 2778 tokens — asserted
- reference/monitor/application-insights-errors.md — CA4F-D7PB — Application Insights errors and missing telemetry — Entra ingestion errors, where telemetry is lost, sampling, daily cap and limits — reference/markdown — 1641 tokens — asserted
- reference/monitor/diagnostic-settings-and-data-collection.md — 030M-7PH3 — Getting data into Azure Monitor — diagnostic settings, data collection rules, Azure Monitor Agent and the Logs Ingestion API — reference/markdown — 2983 tokens — asserted
- reference/monitor/log-analytics-workspaces.md — T4F5-GBEP — Log Analytics workspaces — design, table plans, retention, access control, daily cap, and querying from TypeScript — reference/markdown — 2081 tokens — asserted
- reference/monitor/what-to-use.md — T0Z1-7X1S — Azure Monitor — which pieces to use in 2026, where each signal goes, and what has been retired — reference/markdown — 1693 tokens — asserted
- reference/mysql/flexible-server.md — 138K-N2TY — Azure Database for MySQL flexible server — Entra authentication with a user-assigned identity, CREATE AADUSER, cleartext tokens from Node.js, versions and extended support — reference/markdown — 2219 tokens — asserted
- reference/networking/bastion.md — 891H-GZ4M — Azure Bastion — SKUs, AzureBastionSubnet and NSG rules, peering and roles, forced tunnelling, and connection failures — reference/markdown — 1777 tokens — asserted
- reference/networking/errors.md — MF9F-Q83R — Networking errors — subnets, delegation, peering, private endpoint creation, approval, DNS and deletion — reference/markdown — 2911 tokens — asserted
- reference/networking/firewall-and-ddos.md — SMF9-HBEJ — Azure Firewall and DDoS Protection — SKUs, rule processing order, SNAT, forced tunnelling and the management NIC, DNS proxy, known issues, DDoS tiers — reference/markdown — 2018 tokens — asserted
- reference/networking/nsgs-and-routes.md — ATTG-WT7B — NSGs and routes — rule evaluation, default rules, service tags, application security groups, user-defined routes and next hops — reference/markdown — 1886 tokens — asserted
- reference/networking/outbound-connectivity.md — EY9K-YMKN — Outbound connectivity — default outbound access, NAT gateway Standard and StandardV2, load balancer outbound rules, SNAT exhaustion — reference/markdown — 2185 tokens — asserted
- reference/networking/private-endpoints-and-dns.md — Z447-M4P9 — Private endpoints and private DNS — zone names per service, resolution paths, links, fallback, approval and network policies — reference/markdown — 2464 tokens — asserted
- reference/networking/virtual-wan-and-network-manager.md — 6XK4-42N8 — Hub-and-spoke at scale — Virtual WAN hubs and routing intent, Azure Virtual Network Manager groups, connectivity, security admin rules, UDR management and IPAM — reference/markdown — 1998 tokens — asserted
- reference/networking/vnets-subnets-and-peering.md — W40P-G895 — Virtual networks, subnets and peering — sizing, reserved addresses, special subnets, delegation, private subnets and peering rules — reference/markdown — 2423 tokens — asserted
- reference/networking/vpn-and-expressroute.md — 929A-WHFM — VPN Gateway and ExpressRoute — gateway SKUs and retirements, GatewaySubnet, active-active and BGP, IKE error codes, circuit states and gateway migration errors — reference/markdown — 2543 tokens — asserted
- reference/overview/services-and-identities.md — CHHH-9A4Q — Azure hub map — services covered and which identity to use — reference/markdown — 2914 tokens — asserted
- reference/policy/effects-and-errors.md — 59K7-48G9 — Azure Policy — effects, timing and RequestDisallowedByPolicy — reference/markdown — 2491 tokens — asserted
- reference/postgresql/flexible-server.md — F35G-1NEW — Azure Database for PostgreSQL flexible server — Entra authentication, roles for managed identities, private access or private endpoints, versions and extended support, errors — reference/markdown — 2666 tokens — asserted
- reference/postgresql/replicas-upgrades-and-clusters.md — ZCB1-GMFR — PostgreSQL flexible server operations — read replicas and virtual endpoints, in-place major version upgrades, elastic clusters — reference/markdown — 1397 tokens — asserted
- reference/rbac/errors.md — KXTA-Q7MM — Azure RBAC and authorization errors — reference/markdown — 2202 tokens — asserted
- reference/rbac/role-assignments-and-scopes.md — G9BC-ENWQ — Azure RBAC — scopes, roles and role assignments — reference/markdown — 2206 tokens — asserted
- reference/redis/managed-redis.md — 39J7-4RFF — Azure Managed Redis — replacing Azure Cache for Redis, tiers, clustering policies, Entra authentication from Node.js, Bicep — reference/markdown — 2404 tokens — asserted
- reference/sql/connections-and-auth.md — DCQ3-412T — Azure SQL Database connections and authentication — Entra-only, admins and contained users, network access, connection policy, TLS, serverless resume — reference/markdown — 2192 tokens — asserted
- reference/sql/errors.md — W0HQ-C7CK — Azure SQL Database errors — login, network, availability, throttling, resource limits and management operations — reference/markdown — 2319 tokens — asserted
- reference/sql/managed-instance.md — TBTY-D743 — Azure SQL Managed Instance — subnet, endpoints and ports, Entra logins, failover groups, and how it differs from SQL Database — reference/markdown — 1560 tokens — asserted
- reference/sql/scale-and-continuity.md — V97G-S7A3 — Azure SQL Database scale and continuity — Hyperscale, elastic pools, failover groups and geo-replication — reference/markdown — 1331 tokens — asserted
- reference/storage/access-errors.md — N89G-N7P4 — Storage access errors — Entra ID, network and account gates (401, 403, 409) — reference/markdown — 2620 tokens — asserted
- reference/storage/access-models.md — QV1H-KB8H — Storage access models — Entra data roles, Shared Key, SAS and anonymous access — reference/markdown — 2436 tokens — asserted
- reference/storage/accounts-and-redundancy.md — NRJE-DTGQ — Storage accounts — kinds, SKUs and redundancy, names and endpoints, TLS, hierarchical namespace, tiers and lifecycle — reference/markdown — 2472 tokens — asserted
- reference/storage/adls-gen2.md — RAAZ-9BZR — ADLS Gen2 — how RBAC, ABAC and ACLs combine, ACL rules, and Blob API differences — reference/markdown — 1670 tokens — asserted
- reference/storage/blob-data-protection.md — P6BT-4A7F — Blob data protection — soft delete, versioning, change feed, point-in-time restore, immutability and object replication — reference/markdown — 2655 tokens — asserted
- reference/storage/data-errors.md — TYA1-XKAP — Storage data errors — 404, 409, 412, 416, 503 on Blob and ADLS Gen2 — reference/markdown — 2895 tokens — asserted
- reference/storage/files-access-and-errors.md — K356-W7M0 — Azure Files access — SMB identity sources, share-level roles, managed identities over SMB, NFS, and mount errors — reference/markdown — 2607 tokens — asserted
- reference/storage/network-and-firewall.md — X03P-XYC6 — Storage network access — public network access, firewall rules, private endpoints and perimeters — reference/markdown — 2574 tokens — asserted
- reference/storage/sas-and-key-errors.md — 14GH-95ZC — Storage Shared Key and SAS errors — KeyBasedAuthenticationNotPermitted, AuthenticationFailed and the SAS mismatch codes — reference/markdown — 2122 tokens — asserted
- reference/storage/sas.md — CET4-R3F1 — Storage SAS — user delegation, service and account SAS, expiration policy and pitfalls — reference/markdown — 2230 tokens — asserted
- reference/storage/tables.md — 4GW8-NNPE — Table storage — data model limits, Entra ID access from TypeScript, entity group transactions and Table error codes — reference/markdown — 2345 tokens — asserted
- reference/vm/errors.md — W18V-PE0C — Virtual machine errors — allocation, provisioning, extensions, parameters and operation conflicts — reference/markdown — 2478 tokens — asserted
- reference/vm/scale-sets-and-images.md — XCT4-CT4S — VM scale sets and images — Flexible versus Uniform, upgrade policies, health and automatic repairs, Azure Compute Gallery — reference/markdown — 2119 tokens — asserted
files_listed: 107 / files_total: 107