Entra ID, Intune and Azure, explained for the people who run them.
What's new in Entra ID, Intune and Azure, what it means in practice, and the steps and scripts to act on it.
PS> Get-Post -Latest 1 Title : What's actually inside an Azure region? From the planet to one server, then we break it PS> # 57 posts · 43 tools · 46 deadlines
Free admin tools
No ads, no sign-up. They run in your browser, so nothing you paste leaves your machine.
Sign-in Investigator NEW
Replay sign-in logs on a 3D globe and catch password spray, MFA fatigue and impossible travel.
Tenant health check
Run one read-only script and get a scored security report for your tenant.
Least-privilege role finder
Tick what someone needs and get the smallest Azure or Entra role that allows it.
Graph query builder
Filters, the right headers and Graph PowerShell for users, groups, devices and sign-ins.
Tenant ID lookup
Any domain's tenant ID, cloud, region and whether sign-in is managed or federated.
AADSTS error lookup
Every common Entra sign-in error, explained with what to check.
Latest
What's actually inside an Azure region? From the planet to one server, then we break it
Pick UK South from a dropdown and you're choosing a real place: zones, buildings, fences, generators, racks and hosts. Here's what's inside, layer by layer, using only what Microsoft publishes. Then choose how your app is deployed, knock out a server, a zone or the whole region, and see what survives.
Learning paths
Posts in a sensible order, with your progress saved.
Recent changes
What Microsoft changed, and what needs action.
By topic
Pick an area to see recent posts.
Identity, sign-in, Conditional Access and governance. All 38 Entra ID posts →
Entra Governance · Security NEWGoverning AI agent identities in Entra: sponsors, access packages and expiry
Every AI agent with an Entra Agent ID needs a human who answers for it, access that runs out, and a plan for when its sponsor leaves. Here's how to set up sponsors, access packages and Lifecycle Workflows so agents don't become the next generation of orphaned service principals.
Entra Security NEWDomainless SAML federation: let partners sign in with their own IdP, whatever their email domain
SAML/WS-Fed federation for B2B guests used to depend on the guest's email domain matching the partner's IdP. Domainless federation is now generally available, and it routes sign-in by the IdP's Issuer URI instead.
Entra Security · Governance NEWSOC Identity Responder: contain a compromised account without handing out admin roles
A new built-in Entra role lets security analysts disable users, revoke sessions and reset passwords from Microsoft Defender, and nothing else. Here's what it can and can't do, and how to set it up with PIM.
Device management, compliance and apps. All 10 Intune posts →
Intune Windows · What's newIntune in September: deployment rings, faster compliance and stricter automation
Five recent Intune changes that affect how you roll out, how quickly devices become compliant, and whether your automation keeps working.
Intune What's newIntune in August: unattended Remote Help, DDM app installs and eSIM
Helpdesk agents can now support Windows devices with nobody at the keyboard, Apple VPP apps can install through declarative device management, and corporate Android gets eSIM control.
Intune Security · What's newIntune in July: macOS custom compliance and Defender settings that finally win
Custom compliance comes to macOS, a preview stops Group Policy overriding your Defender settings, and Store app search goes regional.
Platform, networking, governance and cost. All 13 Azure posts →
Azure NEWHow a Tube gate gets paid: half a second at the edge, the maths in the back office
You tap a bank card, the gate opens, and your bank hasn't approved anything yet. Here's how London's contactless system works, why it's built that way, and the cloud design lesson inside it.
Azure NEWRoad to 50: how this blog runs for about £1 a month
Fifty posts in, here's exactly how azureblog.co.uk is built, hosted and published, and why the whole thing costs less than a coffee each month.
Azure GovernanceStop surprise Azure bills with budgets and anomaly alerts
Azure won't stop you spending, but it will tell you early if you set it up. Two features take five minutes and catch most surprises.
Latest posts
all 57 posts →- What's actually inside an Azure region? From the planet to one server, then we break it NEWAzure · Security
- Microsoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday NEWIntune · Security news
- Windows Server 2012 and 2012 R2: the last security update ships tomorrow NEWAzure · Security news
- Governing AI agent identities in Entra: sponsors, access packages and expiry NEWEntra ID · Governance
- Domainless SAML federation: let partners sign in with their own IdP, whatever their email domain NEWEntra ID · Security
- How a Tube gate gets paid: half a second at the edge, the maths in the back office NEWAzure
- SOC Identity Responder: contain a compromised account without handing out admin roles NEWEntra ID · Security news
- Road to 50: how this blog runs for about £1 a month NEWAzure
Get new posts
A practical post most days on what's changing in Entra ID, Intune and Azure, and what to do about it.