Blog
Practical architecture notes — Azure, security, and the occasional AI detour.
-
Architecting Azure Container Apps: When to Choose It Over AKS or App Service
30 September 2026Evaluate Azure Container Apps against AKS and App Service for enterprise scenarios. This analysis covers architectural fit, DevSecOps controls, and operational trade-offs.
-
Ransomware-Resilient Backup Architecture on Azure
28 September 2026Design Azure Backup against ransomware with soft delete, locked immutable vaults, separate authorization, monitoring, and rehearsed restores.
-
Zero-Trust Operating Model for Azure Key Vault: Architecture and Controls
27 September 2026Implement a zero-trust operating model for Azure Key Vault using strict network isolation, Azure RBAC, managed identities, and auditable recovery controls to minimize blast radius.
-
FinOps Guardrails for Enterprise Azure
26 September 2026A practical Azure FinOps operating model linking cost allocation, budgets, anomaly triage, commitment decisions, and engineering accountability.
-
Designing an Azure Observability Baseline
24 September 2026A practical platform baseline for Azure Monitor: workspace boundaries, intentional diagnostic settings, actionable alerts, and service-level ownership.
-
Bringing Defender for Cloud into the DevSecOps Loop
25 September 2026Connect GitHub repositories to cloud posture, assign findings to the teams that can fix them, gate only credible release risks, and verify remediation in code and Azure.
-
Private AKS: Network Isolation Without Breaking Delivery
23 September 2026A guide to architecting private AKS clusters that enforce strict network isolation while maintaining developer velocity. Covers private endpoints, egress control, DNS strategies, and operational trade-offs.
-
Passwordless Azure Deployments: GitHub Actions Workload Identity Federation
22 September 2026An enterprise design for GitHub OIDC federation, environment-specific identities, least-privilege Azure RBAC, release authorization, and correlated deployment evidence.
-
Just-in-Time Azure Write Access: A Governance Pattern for Multi-Environment Engineering
21 September 2026Explore a just-in-time access pattern for Azure engineering teams. Standing Reader access is paired with eligible PIM roles, requiring MFA, approvals, and risk-based activation windows across dev, test, staging, and production.
-
From Audit to Enforcement: Scaling Azure Policy Guardrails for Platform Teams
20 September 2026Explore how enterprise platform teams can move from audit-only visibility to safe enforcement using Azure Policy initiatives, exemptions, remediation, policy as code, and measurable rollout gates.
-
Azure DDoS Protection: One Plan, Many Subscriptions
28 June 2026One DDoS Protection Plan covers VNets across every subscription in a tenant. Creating one per subscription burns roughly US$35K a year, per extra plan.
-
Azure Application Gateway: Common Mistakes and the Right WAF Rollout
27 June 2026The ten mistakes I see most often, a disciplined detection-to-prevention rollout, and what changes when the traffic is healthcare.
-
An Architect's Guide to Azure Storage
4 June 2026Blob, Files, Queues, Tables, and Disks — redundancy, lifecycle, multi-region DR, and cost, with Terraform and Bicep baselines.
-
Claude for Developers: Using AI Agents Across the Development Lifecycle
17 May 2026Where AI agents genuinely help across planning, coding, review, and deployment — and the security controls worth putting around them.
-
Microsoft Fabric and Azure AI Foundry for Healthcare Analytics
16 May 2026Unifying claims, FHIR, and streaming data in OneLake, then layering AI for denial prediction and document summarisation — HIPAA intact.
-
DevOps is Dead? How AI Agents Are Rewriting the Pipeline Playbook
10 May 2026Incident response, Kubernetes triage, Terraform drift, and security auto-fix — what agents actually do well in a pipeline, and what they don't.
-
AI Agents in Every IDE
28 April 2026Setup for VS Code, JetBrains, Visual Studio, Eclipse, and Neovim, with real troubleshooting and deployment scenarios.
-
Building Agentic AI Systems: MCP, Orchestration, and Architecture
18 March 2026The Model Context Protocol, multi-agent patterns, memory architecture, and the enterprise security controls that make them viable.
-
Generative AI in the Enterprise: Patterns for Production LLM Deployments
12 February 2026RAG pipeline design, private model deployment, responsible AI controls, and evaluation-driven development.
-
Cloud Trends Enterprise Architects Must Act On Now
22 January 2026AI-native infrastructure, platform engineering, confidential computing, and sovereign cloud — what to prioritise, and why.
-
Zero Trust Architecture on Azure: A Practitioner's Blueprint
14 November 2025End-to-end Zero Trust — identity and Conditional Access through network micro-segmentation, encryption, and SIEM-driven detection.
-
Healthcare Cloud: Designing for HIPAA and HITRUST
8 October 2025How a large-scale claims platform reached HITRUST in under six months — reference architecture, risk register, and control mapping.
-
Azure Landing Zone Design
5 September 2025Getting the foundation right before you build — management group hierarchy, hub-spoke networking, and policy as code.