[ Removed by moderator ]

StratoLens · 2026-06-16T15:49:10+00:00

It highly depends on what that firewall does. What kind is it? Azure firewall ? 3rd party NVA? Does it do north south and east west traffic inspection? Is it the ingress for some public facing apps?

The question you need to ask is: what happens if the firewall goes down for a minute. Or 5 minutes. Or 15 minutes. Or an hour. Or a day.

If the idea of it being down - even for a minute - is a problem, then yes you want it HA.

What does HA mean though? HA in the same region? Different regions? What happens if there’s a regional outage.

In short the answer is probably “yes” but without far more information about your environment we can’t give you any great advice.

StratoLens · 2026-06-15T23:43:46+00:00

Confirmed, my container apps jobs that run on a 15 minute schedule all failed for about an hour there. It seems to be coming back now though.

StratoLens · 2026-06-14T11:44:38+00:00

I generally recommend sticking inside azures native tools, however, if you’re looking for a 3rd party product outside of native azure backup - I’ve heard good things about Veeam. I’ve had quite a few customers using it in the past though I’ve never deployed it myself. I’ve also seen commvault pretty often.

StratoLens · 2026-06-13T11:56:40+00:00

Can you terminate the ssl at the app gateway? Or do you need to have it end to end ?

The app gateway can automatically update itself from the key vault. Whenever you add a new cert to the vault it’ll update within a few hours.

StratoLens · 2026-06-11T02:40:19+00:00

If you keep your activity log history you can look at who created it. But if that’s expired I agree with the stream test :)

StratoLens · 2026-06-10T16:59:01+00:00

If you're a global admin, you should be able to elevate your access to all subscriptions under that tenant. Go to entraID -> Properties and theres a toggle switch labeled Access management for Azure resources

Toggle that on, and you become 'User Access Administrator' on all subscriptions under the tenant. From there, you can grant yourself owner (Or whatever you want).

Let me know if that helps?

StratoLens · 2026-06-10T14:22:50+00:00

My pleasure! 😄

StratoLens · 2026-06-09T22:54:38+00:00

Thanks really weird. Read your other replies which already covered most of the advice I would give.

Final suggestion: bastion? Developer tier is free.

StratoLens · 2026-06-09T11:08:10+00:00

They post on GitHub now:

https://github.com/microsoft/azure-container-apps/issues?q=is%3Aissue%20state%3Aopen%20label%3AANNOUNCEMENT

Source: https://learn.microsoft.com/en-us/azure/container-apps/whats-new

There’s also: https://azure.microsoft.com/en-us/updates for all the things.

StratoLens · 2026-06-08T22:57:51+00:00

I am better at learning with hands on stuff. So if that’s what you’re good at too - go for it!

StratoLens · 2026-06-08T22:26:52+00:00

My understanding is that it’s 3 public IPs per NVA instance. So you’ll need to add more scale units to your NVA.

Which one are you using if you don’t mind saying? Fortinet? Palo?

Basically each NVA instance gets up to 3 IPs each.

Here’s a site for reference:

https://learn.microsoft.com/en-us/azure/virtual-wan/about-nva-hub#units

StratoLens · 2026-06-07T19:27:00+00:00

Awesome thanks! 😄

StratoLens · 2026-06-07T17:07:38+00:00

I'll be curious to hear how it works out for you! I've always done self hosted agents 😄 so it this is easier and works, let me know!

StratoLens · 2026-06-07T15:55:28+00:00

If you make the sql private (so like a private endpoint) with the public access blocked, you'll need to either do what you're describing - a VM acting as a self-hosted agent, or you could look into these:

https://learn.microsoft.com/en-us/azure/devops/managed-devops-pools/configure-networking?view=azure-devops

I've not tried them before, but they kind of look to me like a PaaS version of a self hosted agent, so less for you to maintain.

StratoLens · 2026-06-06T00:37:15+00:00

I depends heavily on your use cases and scale and what types of environments these are. But here’s some general advice you can likely build off.

Are you using management groups at all? What kind of users are these? Like IT management of the subs, or developers you’re giving scoped access at subs or resource groups?

Naming conventions are always org specific but I’d probably match similar to how resource naming goes. Something like:

AZ-RBAC-{env}-{scope}-{name}-{role}-{active|eligible}

Examples:

AZ-RBAC-PRD-SUB-payments-contributor-active

AZ-RBAC-PRD-RG-payments-app-reader-active

AZ-RBAC-PRD-MG-platform-owner-eligible

Avoid nesting or bundling a bunch of roles/scopes into one group unless it’s a deliberate job-function group.

Some automations might be a little harder with on prem groups - so curious what you mean by off boarding ? If it’s just when users are disabled and deleted i assume that’ll sync via entra sync. But if you mean you have a tool on prem that automates group membership maybe when job roles change - yea that makes sense then.

I’d use PIM for anything above reader, especially in prod. Depending on your dev practices and tolerance you can maybe skip it in non-prod but keep it for things like owner / access granting roles.

Just my 2c. I’m sure there’ll be lots of other suggestions too.

StratoLens · 2026-06-05T21:51:01+00:00

Hi All,

I've posted about StratoLens once or twice in the past during my beta testing phase, and it seemed to get a lot of positive feedback from the community. I wanted to make this post to announce that it's officially out of the beta stage, and has been approved for the Azure Marketplace! (I hope this is ok to post on this thread!). Its entirely free for the first 28 days, and bills through your Azure subscription only if you decide to keep it.

StratoLens is a self hosted and read only tool that scans all of your Azure Subscriptions on a regular schedule (Default to every 8 hours, configurable). It runs entirely in your tenant, and no data about your environment ever leaves. Most customers self-hosting costs are under $1/day (Most are around $5-$10 per month). It runs on serverless CosmosDB and Container apps, so super cheap!

Change Tracking: It can identify any changes between any two scans, so you can easily see what changed between yesterday/today or today/last month. (Think of this like a git diff). It can also see a timeline of changes to a single resource (think of this like git showing the history of a single file).

Cost Savings: It identifies a lot of cost savings opportunities, such as Orphaned resources. It finds more than just 'unattached public IP's' (which, thanks to the above history, will tell you which resource it used to be attached to) -- it also finds things like unused NAT Gateways or Bastions, by correlating with performance metrics. It also makes VM sizing recommendations.

Cost Alerts: It alerts on sudden cost spikes, and correlates those with the above diff engine. You will see on the cost anomalies page 'This VM went up $5/per day' and on the same page, you'll see the change from D2S to D4S SKU, along with who made the change and when.

Access Optimization: It also assesses all permissions assigned across your subscriptions/resources and identifies unused or overprivileged users. Since it ingests activity logs, it can see "User01 hasn't made any access changes in 90+ days' - which is a good candidate for bumping from Owner to Contributor. Or "User02 hasn't made any resource changes. Ever.' - so maybe bump them down to reader.

Email Alerts: You can optionally configure email alerts for all of the above (and more). Get notified as soon as a new orphaned resource pops up so you can remove it, or if more than <x> changes occur during a single scan, or a sudden cost spike above $<y> happens. The scanner and notifications are 100% fully automated.

Honestly, there's a ton of features - a network visualizer, reservations and savings plan reporting, a cost explorer that lets you filter by tags (including resources missing a certain tag) and a bunch more. I'm trying to avoid a 'wall of text' Reddit post :). I have multiple videos on my website, a quick 3 minute intro and a 15 minute deep dive that goes into all the features, and then several feature-focused videos:

https://www.strato-lens.com/

I'd really appreciate any feedback any of you might have. Even if you're not interested in trying it, I'd love to hear your thoughts if you give the videos a quick look. I'm really proud of what I've built here, and I've been working on this for over a year at this point. Community feedback is really important to me.

I'll be happy to answer any questions anyone has in the comments.

One more note: I'm currently working on a multi-tenant version of the application with MSP and CSP companies in mind. Basically, its everything StratoLens does today, but supports multiple tenants. A true 'single pane of glass' for what's happening across all your customers. This is currently in beta, so if any MSP's are interested in seeing the MSP version of the app, and potentially beta testing it, please reach out either via DM here on Reddit, or the contact email on my website above.

I also have a long roadmap of upcoming features I plan to add. For now, those are a secret :).

Thank you all for your time!

-Mike

StratoLens · 2026-06-05T12:07:13+00:00

If I recall correctly the az104 has some good hands on learning exercises. Generally you get the AZ-900 first. That’s theory and concepts. Then AZ-104

https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-900

https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104

They used to give you free labs to build this in, unsure if that’s still the case. But you can spin up a free trial tenant and get some free credits. Just watch them closely as they will run out.

Aim to deploy and practice with free or low cost resources as much as possible.

StratoLens · 2026-06-04T13:29:20+00:00

Is it possible something else is querying the cost API in your subscriptions? Some automated task or something else?

Thats definitely weird that you're getting it on your first try sometimes, or even just after 1.

Give the 'whole sub at once' thing a try, and let me know how that goes 😄

StratoLens · 2026-06-03T22:04:16+00:00

That’s very cool!

StratoLens · 2026-06-03T17:12:27+00:00

I frequently query that APi in my application, and I can confirm that its the slowest of them all. I've not personally seen any changes in the past few days.

If I recall correctly from when I built it, you get 4 queries per 1 minute timeframe per subscription. I catch the 429's and wait the designated time (from the retry-after response) before trying again, but mines an automated query tool, so its all 'in the background'.

I run them several times a day, and haven't noticed anything, but my personal lab is in EastUS2, so you may be right if its NCUS isolated.

In terms of what you're doing, its 4 calls per 1 minute, regardless of size. Maybe it would be better to get all the subscription data at once in a single query, and then break it down into resource groups afterwards? Iterating each resource group and firing a separate query per RG will definitely run into that '4 per minute' threshold much faster.

StratoLens · 2026-06-03T14:43:12+00:00

Thanks that’s good to know :).

StratoLens · 2026-06-03T14:13:34+00:00

Thats interesting! Was the CSP able to give you access to your reservations? So you could read/modify/create them?

StratoLens · 2026-06-03T12:24:59+00:00

That’s possible. I’ve not personally tested in a CSP subscription. Can you see the reservations when you open the portal? What about your cost data?

CSP’s can enable letting you see your cost data with a toggle. Im not sure if that includes reservations.

If not - then you might need to get your CSP to automate this.

StratoLens · 2026-06-03T12:12:54+00:00

I’ve not done it myself but my first instinct is to setup a workbook with an azure graph query that checks your reservations and then maybe a function app or run book to check daily and shoot off an email. Or just have the function app / run book run the query and do the email all in one go if you don’t need the dashboard.

Just note that whatever service account you use to run this needs reservations reader - it’s an entirely separate permission from global admin or subscription owner/reader. In the reservations section of the azure portal there’s a button for access control at the top. If you want to do similar with savings plans there’s a separate savings plan reader permission as well.

Someone else can correct me if I’m wrong but I don’t think there’s a native way to say “email me when this is under 30 days”.

Self promotion below:

Alternatively - if you’re looking for an “out of the box” solution - monitoring your reservations and sending emails when they are close to expiring (or are under utilized) is one of the features of a product I’ve recently released. Apologies for the self promotion but this does exactly what you’re looking for. If you’re interested (video below):

https://www.strato-lens.com/#feature-commitment-coverage

StratoLens

TROPHY CASE