Guides · 119
What are you trying to do?
Fix a problem
4The error or symptom in front of you, and the fix.Identity & security
Break-glass accounts and Conditional Access without locking yourself out
How to run Conditional Access without ever locking the administrators out: two cloud-only break-glass accounts with passkeys, excluded from blocking policies and alerted on every sign-in; every new policy in report-only mode first and checked with the What If tool; and a quarterly drill so the accounts work on the day they're needed.
Identity & security
Azure mandatory MFA is enforced: fix the scripts, pipelines and service accounts it broke
Azure mandatory MFA now applies to every user account that creates, updates or deletes resources from the CLI, PowerShell, pipelines, IaC tools and the REST API, and the last postponement ended on 1 July 2026. What the errors look like, how to find the user accounts your scripts and pipelines sign in with, and how to move each one to a managed or workload identity.
Identity & security
Azure managed identities explained: connect services without secrets
Azure managed identities explained for people who have to make one work: system-assigned or user-assigned, how the SDK gets a token, what to do on your laptop where there is no managed identity, the role assignment in Bicep that doesn't fail on the first deploy, and the errors with their fixes.
Identity & security
Azure 403 after assigning a role: control plane vs data plane, scopes and propagation
You assigned the role and Azure still says 403. Nearly always one of four things: the role is control plane and the call is data plane, the scope is wrong, the assignment hasn't propagated yet, or a firewall or private endpoint is answering before RBAC does. The data-plane role per service, the waiting times, and how to tell which one you have.
Design patterns
1Structures that hold up as things grow.Identity & security
Azure access in one picture: Entra ID, RBAC and managed identities
Azure access has three parts that people mix up: Entra ID says who you are, Azure RBAC says what you may do and at what scope, and managed identities let your services do it without secrets. One picture, the two kinds of role, the two planes, and the five places access goes wrong.
Quick reference
1Error codes, limits and cheat sheets to keep open.Identity & security
AADSTS sign-in errors decoded: the codes you'll actually meet
Microsoft's list of AADSTS sign-in errors runs to hundreds of codes. These are the thirty or so that appear in real apps, connectors and pipelines, grouped by what's wrong (the app registration, consent, the credential, the user, MFA and Conditional Access, federated credentials), each with the cause and the one fix.