Blog
Articles & Thoughts
Writing about building software, scaling systems, and the startup journey.
Implementing Azure Storage Accounts for AZ-104: Step-by-Step Configuration Guide
An Azure storage account is a single namespace that holds an account's blob, file, queue, and table data behind one HTTPS endpoint [1]. It is also an Azure Resource Manager resource, which means it lives inside a resource group and inherits the role assignments and policies attached to that container [1]. Getting the seven portal tabs right is one of the most heavily tested skills on the AZ-104 exam Implement and manage storage carries 15 to 20 percent of the score [2].
Read articleHands-On with Azure Management Groups: Hierarchy, Inheritance, and Policy Enforcement
Inheritance describes the entire reason an Azure management group exists: every role assignment, Policy binding, and hierarchy setting attached to a parent group propagates downward to every child container, subscription, and resource within scope [1]. New subscriptions arrive at the Tenant root by default [1] and that default is usually the first thing worth changing.
Read articleAZ-104 Exam Prep: 15 Real-World Governance Scenarios You Must Know
Azure governance is the set of native controls that decides what gets deployed, where it can live, who can change it, and what it costs. On AZ-104 the domain carries 20–25% of the exam score, the heaviest of the five functional areas, against a passing mark of 700 [1]. The 15 scenarios below map directly to that domain and to the work a junior Azure admin does on day one.
Read articleImplementing Azure Policy for Governance: From Definition to Compliance Reporting
An Azure Policy assignment is a JSON-driven rule that the platform evaluates against every in-scope resource and reports back as compliant, non-compliant, or exempt [1]. It is the mechanism Azure administrators rely on to stop configuration drift from quietly pulling a subscription out of alignment with internal standards or regulatory baselines. What follows walks the full pipeline end to end — planning scope, authoring or selecting definitions, grouping them into initiatives, assigning at the right level, wiring up remediation, and reading compliance results across the portal, CLI, and Resource Graph. The end state is a working governance loop across a management group hierarchy.
Read articleMastering Azure Subscription Hierarchy: Management Groups, Subscriptions, and Resource Groups for AZ-104
An Azure management group is a container that sits above subscriptions and applies governance settings - Azure Policy assignments, role assignments, and hierarchy controls - that cascade down to every resource underneath [1].
Read articleHow to Set Up Windows Firewall: PowerShell Hardening Guide
Windows Firewall ships with every edition of the operating system — Pro, Enterprise, Education — enabled by default, at no additional cost [1]. It blocks unsolicited inbound traffic from the moment you boot up. And yet, breaches keep happening.
Read articleUnderstanding and Configuring DKIM, DMARC, and SPF for Exchange Online
Over 90% of cyberattacks begin with a phishing email. In 2023 alone, Business Email Compromise (BEC) losses exceeded $2.9 billion according to the FBI IC3 report — with spoofed sender addresses serving as the primary attack vector. This threat is not theoretical. It is constant, escalating, and targeting every organization with an email domain.
Read articleHow to Set Up Automated Alerts and Notifications Across Office 365 Apps
Managing a Microsoft 365 environment without proactive alerting is like running a building without smoke detectors — everything seems fine until it isn't. Microsoft 365 ships with dozens of default alert policies covering malware detection, phishing campaigns, privilege escalation, and unusual file activity, yet many organizations never customize them beyond the out-of-box defaults. The result: a dangerous gap between what the platform can tell you and what it actually does.
Read articleHow to Enable and Configure Microsoft Defender for Office 365 Safe Attachments
Email remains one of the most common vectors for delivering malware — and traditional signature-based scanning simply cannot catch every threat. Safe Attachments in Microsoft Defender for Office 365 closes this gap by detonating email attachments in a virtual sandbox environment before they ever reach a recipient's inbox. Going well beyond the built-in anti-malware scanning provided by Exchange Online Protection (EOP), Safe Attachments adds a critical layer of defence against zero-day threats and unknown malware.
Read articleBlocking Auto-Forwarding Rules in Exchange Online to Prevent Data Exfiltration
When a threat actor compromises a Microsoft 365 account, one of their first moves is deceptively simple: set up an email forwarding rule. It's quiet, persistent, and devastatingly effective. Even after a password reset, a hidden forwarding rule keeps silently siphoning sensitive emails to an attacker-controlled address. CISA advisory AA21-008A explicitly calls out malicious email forwarding rules as a key indicator of compromise and a primary exfiltration technique targeting organizations running Microsoft cloud environments.
Read article