Azure

Architecture diagrams are useful, but they eventually have to become files that run together. In this tutorial I build one complete vertical slice of a personal operations assistant, first on a Windows workstation with no Azure dependency, then on Azure Container Apps with Azure OpenAI and Azure AI Search. The companion implementation is in labs/personal-assistant in my agentic-infra-handbook repository. The commands and snippets below match that lab. The lab’s README also has its own step-by-step Azure deployment walkthrough, covering App Registration, the AZD environment, callback registration, validation, and cleanup as a standalone reference. ...

Azure AI Foundry: from zero to production What I cover when a customer asks “we want to build AI applications on Azure, where do we start?” TL;DR: Azure AI Foundry is the unified platform for building AI apps on Azure. Start with Standard PAYGO, use Priority Processing selectively when latency matters but traffic is bursty, and move predictable baseline traffic to PTU when utilization exceeds 60-70%. Use ptucalc.com to model your costs before committing. ...

From reactive firefighting to proactive operations: custom skills for Azure SRE Agent TL;DR: Azure SRE Agent is great at reactive incident response, but doesn’t cover proactive operations out of the box. I built an open-source pack of 8 custom skills that add governance audits, FinOps reporting, capacity planning, postmortems, and more. Combined with Scheduled Investigations, they move your operations from reactive to proactive. How a customer conversation revealed the gap between what Azure SRE Agent does out of the box, and what production teams actually need. ...

You’ve probably used MCP from the host side already. This post is the other angle: what is actually on the wire. If the MCP 101 post was the architecture diagram, this one is the packet trace. The short version is that MCP is JSON-RPC 2.0 plus capability discovery, per-request metadata, and two standard transports. As of protocol version 2026-07-28, the core is stateless. If LSP standardized editor-to-language-server traffic, MCP does the same for host-to-tool-server traffic. ...

Chapter 5: Governance on Microsoft Foundry The previous four posts built agents I designed myself, so I could still keep the whole thing in my head. That arrangement lasts right up until another team stands up its own agent on the same platform. Then the question stops being “is this tool safe” and becomes “how do I know what is running, where, and with which permissions?” That is the point where governance stops being a nice habit and becomes table stakes. ...

Chapter 4: Multi-Agent Orchestration So far the series has built two separate things: in post 1, an agent that talks to AKS via aks-mcp to diagnose the cluster; in posts 2 and 3, a watchdog that watches TPM consumption on Azure OpenAI and decides how urgent an alert should be. Both are useful on their own. Together, they still leave the first SRE question hanging in the air: when token consumption jumps out of nowhere, did somebody deploy something? In most teams, that answer still lives in two browser tabs and one annoyed human. ...

Chapter 3: From Script to Agent In the previous post, the Azure OpenAI quota watchdog was a script with if pct_of_tpm > 0.8: alert. That works, but it has the same flaw every blunt monitoring rule has: context does not exist. A batch job that predictably eats 90% of TPM for 10 minutes at month-end looks identical to an agent gone feral and burning tokens all afternoon. Both cross the threshold. Only one should wake somebody up. ...

Second post in the Azure Platform Engineering series. In Part 1, we built the provisioning layer of the Internal Developer Platform: Dev Center, Azure Deployment Environments, Bicep templates, and shared AKS runtime patterns. That is necessary, but it is not sufficient. An Internal Developer Platform becomes trustworthy when it enforces standards without turning into a bureaucratic cage. That is where governance, observability, and security enter the picture. The platform must make the right path easy, the risky path difficult, and the unsupported path visible. ...

First post in a two-part series on Platform Engineering on Azure. If your developers still need tickets, handoffs, or tribal knowledge to get a usable environment, your delivery system is slower than your codebase. Platform Engineering is how you fix that. The goal is not to hide infrastructure from developers. The goal is to package infrastructure, security, and observability into a self-service product developers can trust. On Azure, that means combining Microsoft Dev Center, Azure Deployment Environments, Bicep, and a shared runtime such as AKS. ...

Second post in the Azure postmortem series. In Part 1, we built the foundation: blameless culture, a reusable template, KQL-based evidence collection, and Logic Apps automation. Now we move from documentation to operations. A mature postmortem process should leave traces in the engineering system: linked work items, measurable trends, dashboards, and visible feedback into reliability practices such as SLOs, alert tuning, and chaos experiments. If a postmortem ends as a document nobody operationalizes, the process failed. ...