Larry.

I build things

Recent Posts

Continuous Compliance: Using AI to Generate and Audit Azure Policy

You need to write a custom Azure Policy that denies any Azure OpenAI resource without a private endpoint. Simple enough requirement. An hour later, you’re still hunting for the right resource provider alias, your JSON nesting is wrong, and the policy ARM rejects on every test run. Azure Policy …

May 10, 2026 Read

The AI SRE Blueprint: Securely Automating Incident Response on Azure

It’s 2:47am. Your AKS node pool has exhausted its memory. Azure Monitor fires an alert. Your phone screams. You fumble for your laptop, SSH into the cluster, run kubectl top pods, identify the offending deployment, and scale it down. Eleven minutes of groggy, reactive work—for a problem the …

May 9, 2026 Read

AI-Driven Secrets Scanning: Protecting the Pipeline from Hallucinated Credentials

GitHub Copilot just suggested an Azure Storage connection string. The format was correct, the key length was right, and the AccountName matched a plausible service name. You accepted the suggestion, committed, and pushed. Instantly, your terminal flashed a red error: GH007: Your push would publish a …

May 8, 2026 Read

Securing the Prompt: Implementing AI Guardrails with Azure API Management

You built a CI/CD tool that sends code diffs to Azure OpenAI for automated review comments. It works great. Three months later, a security audit lands on your desk. The diffs have been routinely sending database connection strings, AWS access keys, and internal IP addresses—verbatim—to the LLM. The …

May 7, 2026 Read

Building a Secure RAG System for Internal DevOps Documentation

It’s 2am. You’re paged for a SEV1. Your runbooks are scattered across Confluence pages, SharePoint libraries, GitHub wikis, and a legacy shared drive that nobody admits still exists. You search three systems, find conflicting procedures with different dates, and end up calling the person …

May 6, 2026 Read

Keyless AI: Using Entra ID Managed Identities for Azure OpenAI

You followed the quickstart. You grabbed the key from the portal, pasted it into a .env file, and your app worked. Now that key lives on your laptop, in your CI/CD secrets, probably in a Slack message from six months ago, and quite possibly in a git log you haven’t checked. It does not expire. …

May 5, 2026 Read

GitHub Copilot Enterprise Governance: Content Exclusions & Policy Controls

Someone on your team opens a pull request. Copilot Chat is active, the monorepo is open in their IDE, and they type @workspace. In that moment, Copilot has context over your Terraform modules with embedded policy logic, your Bicep templates with subscription IDs, your internal SDK with proprietary …

May 4, 2026 Read

Mastering Zero Data Retention: The Guide to Modified Abuse Monitoring in Azure OpenAI

Your GDPR review is two weeks out. Someone asks whether Azure OpenAI retains prompts. You check the docs. There it is, in plain language: prompts and completions are stored for up to 30 days in Microsoft-operated infrastructure — outside your Azure tenant, not queryable, not deletable. Every …

May 3, 2026 Read

Configuring Azure OpenAI Private Link: Keeping AI Traffic Off the Public Internet

You open your CI/CD pipeline logs, and there it is: a curl call to your-resource.openai.azure.com — a public FQDN, resolving to a Microsoft-owned IP, carrying your internal service names and proprietary logic over the public internet. TLS encrypts the session body, but the endpoint itself is still …

May 2, 2026 Read

The Ultimate Guide to Secure AI DevOps on Azure: A Privacy-First Blueprint

Your team has been using Azure OpenAI for three months. Everything works. Then someone runs a security review and asks a simple question: where does the prompt data go? You pull up the docs and find out that every Copilot prompt—containing your internal service names, API patterns, and architectural …

May 1, 2026 Read

Day-2 Operations: Maintaining and Evolving Your Azure Landing Zone

Deploying your landing zone was the easy part. Now you have to live with it.

The most common failure mode in platform engineering is not a bad initial deployment — it is treating the landing zone as a finished project rather than an ongoing product. Azure releases new services and deprecates old …

Apr 11, 2026 Read

Cost Governance in the Landing Zone: Tagging Enforcement, Budgets, and FinOps Automation

The Azure invoice arrives on a Friday. $12,000 over budget. You spend the weekend clicking through the Cost Management portal, filter by resource group, filter by service, filter by tag — except half the resources have no tags at all. By Monday you have a spreadsheet, a list of suspects, and a …

Apr 10, 2026 Read