maskati / #entra-requestid-uti.md

Created June 23, 2026 06:02

Converting between Microsoft Entra Request ID and uti

Entra ID sign-in logs contain unique identifiers:

Correlation ID: The correlation ID groups sign-ins from the same sign-in session. The value is based on parameters passed by a client, so Microsoft Entra ID can't guarantee its accuracy.
Request ID: An identifier that corresponds to an issued token. If you're looking for sign-ins with a specific token, you need to extract the request ID from the token, first.
Unique token identifier: A unique identifier for the token passed during the sign-in. This identifier is used to correlate the sign-in with the token request.

The unique token identifier is emitted as the uti claim in ID tokens

maskati / #canary.md

Last active November 5, 2025 14:46

Azure Network Canary

This Azure template deploys a low-interaction network honeypot VM that acts as a canary detection sensor. It monitors and logs all incoming TCP connection attempts (TCP SYN packets), providing early warning of network reconnaissance and attack activities.

The deployment creates a minimal B1ls VM (1 vCPU, 0.5GB RAM) running Azure Linux 3. This demo deployment also deploys a public IP address to demonstrate functionality based on Internet port scans. The VM is configured with cloud-init to use nftables to log TCP SYN packets to the systemd-journal. Journal SYN probe logs are continuously read, transformed and stored

maskati / #pls-directconnect.md

Last active October 21, 2025 14:28

Azure Private Link service Direct Connect

Until recently Azure Private Link has been restricted to specific Microsoft enabled resource types or your own Azure VM hosted resources.

A notable limitation has been the requirement for the destination to be a Standard Load Balancer with a backend pool configured by NIC. This excluded services such as VNet integrated Azure Container Instances, which do not support private endpoints and also do not provision a NIC in the VNet and therefore could only be routed by IP address.

Microsoft recently released in public preview Private Link Service [Direct Connect](https://learn.microsoft.com/en-us/azure/private-link/configur

maskati / #bicep-fast-lint.md

Created March 24, 2025 11:21

Faster linting of multiple Bicep files

Bicep v0.34.1 brings many great features to Bicep. One that I think is underrated by not having it as a highlighted feature is the new --pattern argument for faster batch operations on multiple files. Below is a comparison of a simulated linting of 100 Bicep files using a parallel invocation of bicep lint vs a single invocation of bicep lint --pattern. The difference is dramatic, with pattern based linting being 40 times faster in clock time on a 4 core system, and 261 times faster in CPU usage. I typically lint all Bicep files that are part of an IaC repository to ensure that module changes do not break upstream or downstream dependencies. This change will allow you to save CI runner resources and have your IaC PR checks completed faster.

> docker run --rm -it alpine /bin/sh -c 'apk add -q --no-progress libstdc++ icu-libs icu-data-full parallel && wget

maskati / #aad-b2c-hash.md

Last active March 23, 2026 22:51

Calculate the Azure AD B2C hash claims transformation locally using PowerShell

The Azure AD B2C hash claims transformation takes the following form:

<ClaimsTransformation Id="MyHashClaimsTransformation" TransformationMethod="Hash">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="myPlaintext" TransformationClaimType="plaintext" />
    <InputClaim ClaimTypeReferenceId="mySalt" TransformationClaimType="salt" />
  </InputClaims>
  <InputParameters>
    <InputParameter Id="randomizerSecret" DataType="string" Value="B2C_1A_MyRandomizerSecret" />

maskati / #dotnet-remote-diagnostics.md

Created February 17, 2025 16:19

Diagnosing .NET applications remotely

Performing .NET diagnostics such as memory dumps and process tracing can be challenging in some scenarios, for example when running distroless containers which do not have an interactive shell. Fortunately .NET provides several options for performing remote diagnostics. The options differ somewhat in their capabilities.

Tool	Description	Supports remote diagnostics
diagnostic tools	Command line utilities, which connect to your .NET process to perform diagnostics.	Limited support. `dotnet-counters` and `dotnet-trace` support remote diagnostics with shared diagnostic port socket (for example shared `/tmp` for default port). Currently other utilities such as `dotnet-dump` require shared process namespace. T

maskati / #user-assigned-identity-token.md

Created February 6, 2025 11:53

Acquire an access token for a user-assigned identity using PowerShell and an Azure Storage account

Acquire an access token for a user-assigned identity

Did you know that you can acquire an access token for an Azure user-assigned identity using PowerShell and an Azure Storage account? You can achieve this by hosting a minimal OpenID Provider and delegating trust via workload identity federation. This post will also help you better understand the technical details of how federated credentials work.

Note

This only gives you the access token. There might also be network access control or Entra conditional access for workload identities which limit calling resources with the token.

The process in brief:

Create an RSA sign

maskati / #keyvault-copy-across-subscriptions.md

Created February 6, 2025 07:01

Copy Azure Key Vault keys between subscriptions

Azure Key Vault keys secure the private key material in a way that is not exportable. Key Vault backups are encrypted and restricted to the same Azure subscription and Azure geography.

You can copy a key from one subscription to another by:

Taking a backup in the source subscription
Creating a new key vault in the source subscription (any region in the same geography) and restoring the backup
Moving the new key vault to the destination subscription

Some limitations:

maskati / #azure-vpn.md

Last active October 28, 2025 06:53

Host your own global VPN on Azure PaaS using Tailscale

This example shows setting up a Tailscale exit node running as a container on Azure Container Instances to provide global Internet egress. You can also use a similar setup to configure a Tailscale subnet router which would allow access to Azure private Virtual Networks, private endpoints, private DNS zone resolution as well as Azure service endpoints.

You can use exit nodes on several platforms including Android, iOS, Linux, macOS, tvOS and Windows.

Warning

Using an exit node will tunnel all your traffic through the selected Azure region. This might trigger certain security controls such as Entra ID protection impossible travel.

[!NOTE]

maskati / #flexible-federated-identity.md

Created January 16, 2025 08:50

Azure flexible federated identity credentials

Up until now you have been able to define a federatedIdentityCredential with the issuer, audiences and subject properties. For example to allow a GitHub Actions workflow running in the context of environment prod in the repository octo-org/octo-repo:

{
  "issuer": "https://token.actions.githubusercontent.com"
  "audiences": [
    "api://AzureADTokenExchange"
  ]