Tag: technology

Azure Health Check – A Free Script to Audit and Visualise Cloud Hygiene

Are you running Azure subscriptions and want a quick, human-friendly overview of your governance, compute, storage, network and Key Vault hygiene?
The Azure Health Check PowerShell script gives you exactly that — scanning multiple subscriptions, flagging weak spots, and producing a clean interactive HTML report (with charts!).

Why this matters

Large and growing Azure estates can easily drift into insecure or unsupported configurations: unprotected VMs, public storage blobs, missing resource locks, orphaned disks, exposed network ports — all of which can lead to security, availability or compliance issues.

Yet manually auditing each subscription is time-consuming. That’s where automation helps. With this script, you get a multi-subscription health summary, scored, visualised and exportable — ideal for periodic reviews, customer readiness checks, or even compliance audits.

Continue reading “Azure Health Check – A Free Script to Audit and Visualise Cloud Hygiene”

Azure Private Link Service Direct Connect – Simplified Private Connectivity (Public Preview)

Azure Private Link Service (PLS) has long been the go-to option for exposing your services privately to consumers across Azure — ensuring that traffic never crosses the public internet.
Until recently, this required a Standard Load Balancer to sit in front of your service. That setup worked well, but it added complexity and limited flexibility, especially in hybrid or custom routing scenarios.
Now, with Private Link Service Direct Connect, Microsoft has simplified the model. You can route traffic directly to any privately routable IP address, removing the dependency on load balancers altogether.
This new feature opens the door to several use cases — from simplifying secure hybrid connections to enabling private access to third-party SaaS and appliances.

Continue reading “Azure Private Link Service Direct Connect – Simplified Private Connectivity (Public Preview)”

How to Troubleshoot High Memory Pressure on an Azure VM Using Performance Diagnostics

Recently, I had to troubleshoot a case of performance degradation on an Azure VM. The key symptom was high memory pressure, which in Azure means the system is under heavy strain to fulfill memory requests — often leading to lag, paging, and slow performance.

To get to the root cause, we used Azure Performance Diagnostics (PerfInsights) — a powerful and easy-to-use troubleshooting tool. Here’s how you can install and use it from the Azure Portal, without needing to log in to the VM.

Continue reading “How to Troubleshoot High Memory Pressure on an Azure VM Using Performance Diagnostics”

Introducing Azure Private Subnets: Enhancing Security by Disabling Default Outbound Access

Azure Networking Tips & Techniques - Part 1

Azure recently announced the general availability of Private Subnet, a new feature that allows you to disable the implicit outbound Internet connectivity for virtual machines in a subnet. In this blog post, we’ll cover:

  1. What Azure Private Subnets are and why they matter

  2. Key benefits of disabling default outbound access

  3. Step-by-step instructions to configure a private subnet via the Azure Portal

  4. Verifying that default outbound has been disabled

What Is an Azure Private Subnet?

Traditionally, when you create a subnet in an Azure Virtual Network (VNet) without any explicit outbound connectivity (such as a NAT gateway, Public IP, or Load Balancer), Azure automatically provides a default outbound access IP for those VMs. While this is convenient, it introduces an implicit egress path—VMs can communicate with public endpoints without you having explicitly configured any egress resources.

A Private Subnet in Azure is simply a subnet where this default outbound access is turned off. Consequently:

  • Any VM deployed within that subnet cannot reach the Internet by default.

  • You must explicitly configure an alternative egress mechanism if VMs need outbound connectivity (e.g., NAT Gateway, Standard Load Balancer, Firewall, or a Public IP assigned directly to the NIC).

By removing the implicit outbound IP, Azure Private Subnets enforce a “zero trust” approach: no VM can communicate externally until you grant it an explicit, auditable path.

Why Disable Default Outbound Access?

  1. Secure by Default
    Default outbound IPs are not customer-owned and can change unpredictably. By disabling implicit egress, you ensure VMs only send traffic externally when you explicitly allow it, reducing your attack surface.

  2. Prevent Data Exfiltration
    In regulated or highly sensitive environments (for example, PCI-DSS or HIPAA workloads), any unsolicited outbound route can pose compliance or security risks. Private Subnets eliminate unexpected data exfiltration channels.

  3. Encourage Explicit Egress Configuration
    When default outbound is disabled, you must provision a known, managed egress mechanism (like a NAT Gateway), which can be tightly monitored for logging, analytics, and cost control. This “explicit-over-implicit” model aligns with best practices for cloud network security.

Continue reading “Introducing Azure Private Subnets: Enhancing Security by Disabling Default Outbound Access”