Skip to content
Talk to an architect
Home / Blog
BLOG

Practical guides from the people who deliver the work

Microsoft Fabric, AI, security, Azure and app modernization, explained for the people deciding what to do next quarter.

A sign-in passes through Conditional Access checks for MFA, device compliance and risk and is allowed, while a legacy authentication client is blocked; a report-only switch sits above the checks.Security
Featured
SECURITY · 6 MIN READ

A Conditional Access baseline for Microsoft Entra ID

The Conditional Access policies every Microsoft Entra ID tenant should have, what each one needs in licensing, and how to roll them out without locking anyone out.

Read the guide
A sign-in passes through Conditional Access checks for MFA, device compliance and risk and is allowed, while a legacy authentication client is blocked; a report-only switch sits above the checks.
SECURITY · 6 MIN READ

A Conditional Access baseline for Microsoft Entra ID

The Conditional Access policies every Microsoft Entra ID tenant should have, what each one needs in licensing, and how to roll them out without locking anyone out.

Monthly Azure spend bars sit under a dashed budget line; one spike is flagged as an anomaly, later bars drop after rightsizing and a commitment is bought afterwards, beside budget alerts, cost tags and a monthly review.
AZURE · 6 MIN READ

Controlling Azure spend: a practical FinOps routine

How to control Azure spend with budgets and alerts, tagging and cost allocation, Azure Advisor, reservations and savings plans, rightsizing, and a monthly review.

An attack path runs from the internet to an exposed virtual machine with an open port, through a managed identity, to a critical storage account holding sensitive data; a fix on the first hop breaks the path.
SECURITY · 6 MIN READ

Building a cloud security posture baseline with Microsoft Defender for Cloud

What free Foundational CSPM gives you, when Defender CSPM is worth paying for, how secure score and compliance views work, and a rollout order across Azure, AWS and Google Cloud.

Inside a Finance domain, a Confidential sensitivity label travels along lineage from a lakehouse to a certified semantic model to a report; an Excel export keeps the label while a CSV export does not.
DATA & AI · 6 MIN READ

Governing Microsoft Fabric with Microsoft Purview: domains, labels, lineage and a rollout order

How Microsoft Purview and Fabric's built-in controls govern your data, covering domains, endorsement, sensitivity labels, DLP, the Unified Catalog and lineage, plus a rollout order.

Three paths from Delta tables in OneLake to a Power BI report: Import through a refreshed copy, Direct Lake highlighted as the direct path, and DirectQuery querying the source, with a dashed fallback from Direct Lake to DirectQuery.
DATA & AI · 6 MIN READ

Direct Lake in Power BI explained: how it works, fallback and when to choose it

How Direct Lake in Microsoft Fabric compares with Import and DirectQuery, how framing and fallback work, which capacity guardrails apply, and when to choose each mode.

Fabric capacity usage over time: a burst rises far above the SKU limit, smoothing spreads its cost into a gentle curve, and where smoothed usage stays above the limit a throttling zone begins; levers such as pause, scale and reserve sit below.
DATA & AI · 6 MIN READ

Sizing Microsoft Fabric capacity and keeping its cost under control

How Fabric capacity units, bursting, smoothing and throttling work, and which levers control cost: pause and resume, scaling, reservations, surge protection and the Capacity Metrics app.

An agent at the centre draws on knowledge sources such as SharePoint and uploaded files, acts through tools such as creating a ticket, and is published to channels such as Teams and a website.
AI · 6 MIN READ

Building business agents with Copilot Studio: where to start

How Copilot Studio agents use knowledge, tools and topics, where they can be published, which governance to set first, and how to choose a first use case.

An invoice with highlighted fields is turned into extracted fields with confidence bars; confident fields flow to the ERP system while a low-confidence total is routed to human review.
AI · 6 MIN READ

Automating paperwork with Azure Document Intelligence: models, confidence and human review

How to automate document-heavy processes with Azure Document Intelligence: prebuilt or custom models, confidence thresholds, human review, workflow integration and data residency.

An AI agent carries its own ID badge with a sponsor; a scoped role is allowed while subscription-wide access is denied, a write action waits at an approval gate, and a trace records model calls, tool calls and decisions.
AI · 6 MIN READ

Governing AI agents in the enterprise: identity, permissions and approval

How to govern AI agents with Microsoft Entra Agent ID, least-privilege access, monitoring, content safety guardrails and a practical approval process.

Microsoft Copilot answers from a Finance site's General and Confidential files while a Purview DLP policy excludes Highly Confidential files, and the site's share to everyone is restricted to the Finance team
SECURITY · 6 MIN READ

Preparing your data for Microsoft Copilot with Microsoft Purview

How to find and fix oversharing before a Microsoft Copilot rollout, using data risk assessments, SharePoint access controls, sensitivity labels and DLP.

Two stacks side by side: on Container Apps you run the app and its scale rules while the platform runs nodes and upgrades; on AKS Standard you run every layer. Below, Container Apps scales to zero while AKS nodes keep running.
APP MODERNIZATION · 6 MIN READ

AKS or Azure Container Apps? Choosing where your containers run

How Azure Kubernetes Service and Azure Container Apps differ on operations, scaling, networking, Dapr, cost and skills, with a short checklist to pick one per workload.

Windows, macOS and iOS devices enroll into Intune, pass a compliance check for encryption, OS version, password and jailbreak status, and then receive Windows updates in waves through test, pilot and broad rings.
MODERN WORK · 6 MIN READ

A practical Microsoft Intune baseline: from enrollment to phased rollout

The Intune building blocks to set up first, from Autopilot enrollment and compliance-based Conditional Access to security baselines, BYOD app protection, update rings and rollout.

A list of workloads each gets its own decision, Rehost, Replatform, Refactor, Rearchitect, Replace or Retire, with arrows to Virtual Machines, App Service, Container Apps, AKS or a SaaS product, and the retired one ends.
APP MODERNIZATION · 6 MIN READ

Rehost, replatform or refactor? Choosing an app modernization path per workload

How to pick a migration strategy for each application, use Azure Migrate to narrow the options, choose a hosting target, and where GitHub Copilot helps with .NET.

On the left, data is copied from source to staging, warehouse, data mart and report model with a refresh pipeline between each copy; on the right, one Delta table in OneLake is read by Spark, T-SQL and Power BI without copies.
DATA & AI · 6 MIN READ

Microsoft Fabric vs the traditional data warehouse: what actually changes

How Microsoft Fabric's architecture differs from a classic data warehouse, from one copy in OneLake and shortcuts to Direct Lake and capacity, and what stays the same.

An Oracle database streams inserts, updates and deletes through a data gateway into mirrored, read-only Delta tables in OneLake, which feed a report, with no ETL pipeline in between.
DATA & AI · 6 MIN READ

Mirroring Oracle into Microsoft Fabric without building ETL

How Microsoft Fabric mirrors Oracle databases using LogMiner and the on-premises data gateway, what lands in OneLake, what it costs, and where GoldenGate still fits.

Mirroring, shortcuts and pipelines feed a bronze raw layer, which climbs to a silver cleansed layer, a gold curated layer and a certified Direct Lake semantic model, with domains, labels and Git underneath.
DATA & AI · 6 MIN READ

Building a Fabric data landing zone: medallion, governance and Direct Lake

A practical blueprint for a Microsoft Fabric data landing zone, covering workspaces, bronze, silver and gold layers, mirroring, Purview, Direct Lake and Git-based CI/CD.

A question goes to a search index, which retrieves passages the user may read while a finance passage is trimmed as no access; the answer cites its sources as [1] and [2].
AI · 6 MIN READ

Grounded, not guessed: how enterprise AI assistants cite their sources

How retrieval-augmented generation on Azure grounds answers in your documents, respects user permissions, shows citations and checks for made-up claims.

A pilot passes through evaluation against agreed thresholds and a guardrails shield that stops prompt attacks, then reaches production users with tracing, while a cost gauge tracks token spend.
AI · 6 MIN READ

From AI pilot to production on Microsoft Foundry: evaluation, guardrails and cost

What it takes to move a generative AI pilot into production on Microsoft Foundry: evaluation gates, guardrails, monitoring and cost controls.

A draft pull request opened by the coding agent on its own branch, with tests, code scanning and push protection passing, is held at a ruleset gate until a human reviewer approves, and then merges into main.
APP MODERNIZATION · 6 MIN READ

GitHub Copilot for the enterprise: agent mode, rulesets and governance

What GitHub Copilot's agents do with your code, and the policies, rulesets, GitHub Advanced Security and Entra ID controls that keep AI-written code safe.

Three separate scores, Defender, Entra and Purview, are kept apart rather than averaged and feed one ranked plan whose items are tagged by critical asset, attack path, disruption and accepted risk.
SECURITY · 6 MIN READ

One Security Posture Across Defender, Entra and Purview

How Secure Score, Cloud Secure Score, compliance score and Exposure Management fit together, and how to turn their recommendations into a ranked plan your board can follow.

Log connectors feed Microsoft Sentinel: high-value sources go to the analytics tier and high-volume firewall and proxy logs to the lower-cost data lake tier; detections raise incidents that automation rules route to a playbook, with approval before containment.
SECURITY · 6 MIN READ

Microsoft Sentinel for Regional SOCs: Ingestion, Cost and Automation

How to run Microsoft Sentinel well in a regional SOC, covering data connectors and ASIM, detections, the Defender portal move, data tiers and commitment tiers, playbooks, and data residency.

A management group tree under an intermediate root splits into Platform, holding Identity, Management, Connectivity and Security, and Landing zones, holding Corp, Online and Local, beside a hub-and-spoke network whose hub belongs to Connectivity.
AZURE · 6 MIN READ

Azure Landing Zones explained: the decisions to make before the first workload

What an Azure landing zone is, the design areas behind it, and the identity, network, policy and deployment decisions to settle before your first workload moves.

The Microsoft 365 tenant sits at the centre of layered defences, identity, devices, email and data, beside a Secure Score trend line that rises month by month.
SECURITY · 6 MIN READ

Is Your Microsoft 365 Environment Really Secure?

Owning Microsoft 365 is not the same as securing it. Learn where configuration gaps hide, which controls matter most, and how to measure and keep improving your posture.

Inside the organisation boundary, Microsoft Copilot works with Word, Excel, Outlook and Teams under existing permissions, audit and no training on your data, while a customer email pasted into a public AI chat leaves the boundary.
MODERN WORK · 6 MIN READ

Why businesses choose Microsoft Copilot over public AI tools

How Microsoft Copilot handles your data differently from public AI tools, and the practical steps to govern shadow AI while you roll it out.

OneLake sits at the centre, with the Fabric workloads the article names around it: Data Factory, data engineering, Data Warehouse, Real-Time Intelligence, Data Science, databases and Power BI.
DATA & AI · 6 MIN READ

Why organizations are moving to Microsoft Fabric

What Microsoft Fabric changes for the business, how its capacity licensing works, and how to tell whether it fits your organization before you commit.

A protected resource sits inside a triangle of the three Zero Trust principles, verify explicitly, least privilege and assume breach, connected to the six technology pillars: identities, endpoints, apps, data, infrastructure and network.
SECURITY · 6 MIN READ

Implementing a Zero Trust Security Architecture for the Modern Enterprise

A practical guide to Zero Trust with Microsoft: the three principles, the six technology pillars, and an adoption sequence you can plan by quarter and track with real metrics.