Azure Managed Grafana: diagnose API access before recreating a token
A production runbook for separating expiration, audience, Grafana role and deployed-secret drift when Azure Managed Grafana automation receives a 401 or 403.
Read article
Tag
identity
56 articles connected to this technical signal.
Azure DevOps: contain a compromised self-hosted agent before reopening the pool
A production runbook for quarantining a suspicious Azure DevOps self-hosted agent, preserving evidence, bounding exposed identities and validating a clean replacement before the pool receives production jobs again.
Read articleAzure DevOps WIF: diagnose issuer or subject drift before bringing back a secret
A production runbook for comparing the service connection, federated credential, issuer, subject, audience and RBAC before repairing, migrating or rolling back an Azure DevOps identity.
Read articleAzure Key Vault: migrate access policies to Azure RBAC without breaking workloads
A production runbook for inventorying Key Vault access, staging data-plane roles, cutting over to Azure RBAC with real probes, validating workloads and rolling back without broadening permissions.
Read articleMicrosoft Entra PIM: diagnose Azure role activation before granting permanent access
A production runbook for separating PIM eligibility, activation, approval, Conditional Access, RBAC propagation and effective ARM access before any permanent bypass.
Read articleAgentOps: prevent MCP token forwarding before production actions
A production runbook for proving token audience, delegation, scopes and runtime identity across an MCP tool chain before restoring state-changing actions.
Read articleAzure Managed Identity: diagnose principal drift after resource recreation
A production runbook for proving that a recreated Azure resource has a new principalId, finding orphaned roles and restoring least privilege without broadening RBAC.
Read articleTerraform on Azure: contain concurrent applies before state divergence
A production runbook for proving which Terraform writer owns an Azure Blob state lease, stopping competing pipelines, recovering a stale lock and validating state before another apply.
Read articleMicrosoft Foundry Toolbox: validate a version before promoting it to agents
A production runbook to test a Toolbox version, its MCP tools, identities, approvals and traces before promotion, then return to the previous version without redeploying agents.
Read articleAzure Site Recovery: test a recovery plan without touching production
A production runbook for running an Azure Site Recovery test failover in an isolated network, validating dependencies, measuring application recovery and cleaning up unambiguously.
Read articleAzure DevOps: diagnose a Key Vault secret after rotation before rerunning production
A production runbook for qualifying an Azure Key Vault secret consumed by Azure Pipelines through a variable group, isolating version, mapping, identity, network and precedence, then validating or rolling back without exposing the value.
Read articleAgentOps: diagnose permission drift before widening an agent's rights
A production runbook for qualifying AI agent permission drift with the real identity, RBAC, tool scopes, traces, expected denials, human validation and rollback before widening access.
Read articleAzure DevOps: diagnose an offline self-hosted agent before recreating it
A production runbook for qualifying an Azure DevOps self-hosted agent that no longer picks up jobs by separating runner service, identity, network, disk, cache, pool, logs and rollback.
Read articleAgentOps: validate the Foundry automation handoff before a production action
A production runbook for qualifying the handoff from a Microsoft Foundry agent to Azure Automation, AWX, Azure DevOps or an MCP tool with contract, identity, traces, dry run, human validation and rollback.
Read articleAzure APIM self-hosted gateway: diagnose sync drift before rerouting traffic
A production runbook for qualifying an Azure API Management self-hosted gateway with configuration sync, token or Workload Identity, Kubernetes, logs, backend reachability, validation and rollback before moving traffic.
Read articleAzure Container Apps: diagnose Managed Identity before widening a role
A production runbook for qualifying Azure Container Apps 401/403 failures with Managed Identity, token evidence, RBAC scope, Key Vault, ACR, logs, validation and rollback before widening permissions.
Read articleMicrosoft Entra Workload ID: diagnose Conditional Access before excluding a CI pipeline
A production runbook for qualifying a Conditional Access block on a workload identity with service principal logs, policy scope, risk, CI identity, KQL evidence, bounded exception and rollback.
Read articleAgentOps: diagnose MCP server drift before a production action
A production runbook for qualifying MCP server drift with tool manifests, schemas, identity, secrets, network path, traces, evaluations, validation and rollback before reauthorizing an AI agent.
Read articleAgentOps: scope an internal MCP server before exposing it to an agent
A production runbook for qualifying an internal MCP server with tool inventory, scopes, identities, secrets, audit, dry runs, evaluations, human validation and rollback before agent access.
Read articleAzure APIM: diagnose mTLS client certificate failures before changing policies
A production runbook for qualifying Azure API Management mTLS failures with client certificate chain, hostname, policy, gateway logs, backend identity, validation and rollback before changing API policies.
Read articleAgentOps: diagnose a failed tool call before retrying a production action
A production runbook for qualifying a failed AI agent tool call with trace evidence, idempotence, identity, backend state, approvals, validation and rollback before retrying.
Read articleAgentOps: validate agent memory before production actions
A production runbook for qualifying AI agent memory with sources, traces, aging, permissions, evaluations, guardrails, human validation and rollback before it influences real actions.
Read articleAzure Backup: validate a restore point before declaring rollback ready
A production runbook for qualifying an Azure Backup restore point with application consistency, dependencies, identity, networking, test restore, evidence, decision and rollback before cutover.
Read articleAzure App Service: diagnose a Managed Identity token failure before bringing back a client secret
A production runbook for qualifying an Azure App Service Managed Identity failure with IMDS endpoint, Entra ID, RBAC, Key Vault or target API evidence, logs, validation and rollback before reintroducing a client secret.
Read articleAzure DevOps: diagnose a self-hosted agent before rerunning the pipeline
A production runbook for qualifying an Azure DevOps failure on a self-hosted agent with disk, workspace, cache, local services, identity, logs, controlled cleanup, validation and rollback.
Read articleAzure APIM: diagnose a subscription key before rotating it in production
A production runbook for qualifying Azure API Management 401/403 errors with subscription key, product, API, consumer, logs, validation and rollback before rotation.
Read articleMicrosoft Foundry: validate guardrails before exposing an agent to production
A production runbook for qualifying Microsoft Foundry agent guardrails with sources, refusals, tools, identity, traces, canary, human validation and rollback before user exposure.
Read articleAzure DevOps: validate approvals and checks before bypassing production
A production runbook for qualifying an Azure DevOps deployment blocked by approvals or checks with environment scope, identity, logs, audit evidence, validation and rollback before bypassing the guardrail.
Read articleAgentOps: validate an approval policy before production actions
A production runbook for qualifying an agent approval policy change with action scope, identity, traces, evaluation cases, guardrails, human validation and rollback.
Read articleAzure IaC: validate an infrastructure plan before production apply
A production runbook for qualifying a Terraform, Bicep or ARM plan before apply with drift, CI identity, Azure Policy, destructive changes, validation and rollback.
Read articleAgentOps: rotate an agent runtime identity before tool access fails
A production runbook for rotating or revoking an AI agent runtime identity with scoped permissions, dry-run tool calls, traces, approvals, validation and rollback before breaking production actions.
Read articleAgentOps: validate an agent tool before it can change production
A production runbook for qualifying a new AI agent tool with contract review, scoped identity, dry run, traces, approvals, evaluation cases and rollback before enabling real actions.
Read articleAzure App Configuration: diagnose a feature flag before rollback
A production runbook for qualifying an Azure App Configuration or feature flag regression with labels, identities, refresh, Key Vault references, logs, validation and rollback.
Read articleAzure Container Registry: diagnose an image pull failure before redeploying
A production runbook for qualifying an ACR image pull failure with identity, network, DNS, firewall, logs, node cache, validation and rollback before rerunning deployment.
Read articleAzure RBAC: diagnose authorization drift before widening a role
A production runbook for qualifying Azure RBAC drift with the real identity, scope, PIM, role assignments, deny assignments, logs, validation and rollback before adding permissions.
Read articleKQL snippet: find risky tool actions from an AI agent
A short query to isolate write-capable tool calls, their execution identity and correlation before disabling an AI agent.
Read articleAzure deployment from a private runner: diagnose the pipeline before rerun
A production runbook for qualifying an Azure deployment failure from a private runner by separating identity, DNS, routing, NSG, NAT, dependency access, logs and rollback.
Read articleKQL snippet: diagnose Workload Identity Federation failures in CI
A short query to find federated principal sign-in failures before falling back to a client secret.
Read articleAzure Policy remediation: fix drift without breaking production
A production runbook for running Azure Policy remediation with impact preview, managed identity checks, controlled batches, exemptions, logs and rollback.
Read articleMicrosoft Foundry: evaluate an agent before giving it a production action
A runbook for validating an AI agent before real action by separating sources, tools, identity, evaluation cases, human approvals, logs and rollback.
Read articleAgentOps: expose MCP tools without losing control of production actions
A production runbook for exposing MCP tools to an AI agent while keeping action scope, approvals, identities, logs, evaluation and rollback under control.
Read articleAzure Service Bus: diagnose a private endpoint before touching queues
An operational runbook for Azure Service Bus private access incidents by separating DNS, Private Endpoint, identity, firewall, metrics, logs and rollback.
Read articleKQL snippet: isolate Service Bus private endpoint errors
A short query to separate missing connection evidence, identity denial, expired SAS and processing errors during a private Service Bus incident.
Read articleAzure SQL: diagnose a private endpoint before changing the database
An operational runbook for Azure SQL private access failures by separating DNS, Private Endpoint, firewall, identity, SQL logs and rollback evidence.
Read articleKQL snippet: isolate Azure SQL private endpoint errors
A short query to separate firewall, authentication, public endpoint and missing connection evidence during a private Azure SQL incident.
Read articleAzure Storage: diagnose a private endpoint without opening the account
An operational runbook for Azure Storage private access failures by separating DNS, Private Endpoint, firewall, identity, logs and rollback evidence.
Read articleKQL snippet: isolate Azure Storage 403 on a private endpoint
A short query to separate identity, firewall, public endpoint and wrong subresource when private Azure Storage access is denied.
Read articleAzure App Service: diagnose a private endpoint before redeploying
Build an operational runbook for App Service private access failures by separating DNS, Private Endpoint, access restrictions, Application Gateway, application logs and rollback evidence.
Read articleAzure Functions: diagnose a private HTTP endpoint before changing code
Build an operational runbook for private Azure Functions failures by separating DNS, Private Endpoint, access restrictions, private storage, Application Insights logs and rollback evidence.
Read articleKQL snippet: correlate an Azure Functions private HTTP endpoint
A short query to separate DNS, private access, Functions runtime and application exceptions during a private HTTP incident.
Read articleAzure internal APIM: diagnose a private API before changing policies
Qualify a failure across Application Gateway, WAF, internal APIM and a private backend by separating DNS, routing, policy, identity and logs before any fix.
Read articleAzure managed identity: diagnose private access before changing permissions
Build a runbook for Key Vault, Storage or private API access failures with managed identity, RBAC, private DNS, logs and real execution evidence.
Read articleKQL snippet: diagnose Key Vault denial with managed identity
A short query to separate identity denial, network path and source address when an Azure workload can no longer access Key Vault.
Read articleService identity and secret rotation: a production runbook, not an isolated task
Build operable rotation for secrets, certificates, and application identities with dependency inventory, evidence, change windows, monitoring, and rollback.
Read articleKQL snippet: detect authentication errors after secret rotation
A short query to watch 401, 403, and 500 errors after rotating an application secret or service identity.
Read articleLinux Active Directory join across distributions with SSSD and DNS discipline
A multi-distribution runbook for joining Linux to Active Directory with realmd, adcli, SSSD, Kerberos, validation steps, and the checks that catch fragile integrations before they reach production.
Read article