Insights on Azure architecture, cloud security, Infrastructure as Code, and AI.https://genioct.lu/https://genioct.lu/en/blog/dora-register-of-information-azure/https://genioct.lu/en/blog/dora-register-of-information-azure/The DORA register of information looks like a compliance spreadsheet. Filling it in honestly is an Azure architecture exercise: inventory, data locations, subcontracting chains, exit strategy. Here is what the CSSF actually expects.Sun, 05 Jul 2026 00:00:00 GMThttps://genioct.lu/en/blog/platform-architecture-audit-evidence/https://genioct.lu/en/blog/platform-architecture-audit-evidence/A technically correct landing zone can still fall apart the first time someone asks 'show me.' Why the trail from business risk to control to proof belongs inside the architecture, not bolted on the week before an audit.Thu, 25 Jun 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-apim-v2-migration-playbook/https://genioct.lu/en/blog/azure-apim-v2-migration-playbook/A field playbook for migrating Azure API Management from classic Developer, Standard, or Premium to the v2 tiers: what carries over, what breaks, how to preserve subscription keys, the order to run the cutover in, and when staying on classic is the right call.Fri, 12 Jun 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-container-apps-express-2026-preview-gap/https://genioct.lu/en/blog/azure-container-apps-express-2026-preview-gap/Azure Container Apps Express hit public preview at Build 2026 with subsecond cold starts and no environment to provision. The preview feature gap is large, and so is the region constraint. Here is what Express actually changes inside the ACA family, and where it still sends you back to a standard environment.Tue, 09 Jun 2026 00:00:00 GMThttps://genioct.lu/en/blog/cloud-sovereignty-2026-workload-classification/https://genioct.lu/en/blog/cloud-sovereignty-2026-workload-classification/Cloud sovereignty in 2026 means SEAL levels and 48 EU procurement criteria beyond region selection. The architect's job is workload classification across five distinct concerns.Thu, 04 Jun 2026 00:00:00 GMThttps://genioct.lu/en/blog/aks-2026-what-changed-when-it-still-wins/https://genioct.lu/en/blog/aks-2026-what-changed-when-it-still-wins/AKS has matured beyond recognition since its 2018 GA. Automatic upgrades, Workload Identity, Cilium, managed observability, and the new AKS Automatic tier have changed the operational picture. Here is when AKS is still the right call and when simpler platforms do the job better.Sun, 24 May 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-private-link-dns-failure-modes/https://genioct.lu/en/blog/azure-private-link-dns-failure-modes/Private Link is easy to deploy. Getting DNS right across hub-spoke, hybrid, and multi-subscription environments is where it breaks. Seven failure modes.Sat, 02 May 2026 00:00:00 GMThttps://genioct.lu/en/blog/nis2-belgium-after-basic-azure-evidence/https://genioct.lu/en/blog/nis2-belgium-after-basic-azure-evidence/The 18 April 2026 NIS2 checkpoint has passed for Belgian essential entities. The next challenge for Azure-heavy organisations is continuous evidence rather than another readiness questionnaire.Sat, 02 May 2026 00:00:00 GMThttps://genioct.lu/en/blog/service-principals-bigger-blast-radius-than-vms/https://genioct.lu/en/blog/service-principals-bigger-blast-radius-than-vms/In most Azure tenants, real exposure is a forgotten service principal with Owner scope, an expired secret, no human owner. Four risk patterns mapped to NIS2.Wed, 29 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-front-door-2026-standard-premium-decision/https://genioct.lu/en/blog/azure-front-door-2026-standard-premium-decision/Front Door Standard vs Premium, Private Link to origin, the App Gateway overlap question, and what changed since Microsoft stopped new classic profiles. The enterprise decision guide.Sat, 25 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/nis2-audit-readiness-azure-12-week-checklist/https://genioct.lu/en/blog/nis2-audit-readiness-azure-12-week-checklist/The 12-week NIS2 readiness plan we run with Azure clients. Article 21 mapping, gap closure, evidence assembly, and pre-audit dry run, week by week, with the Azure controls and pitfalls at each stage.Sat, 25 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/serverless-entra-application-proxy-azure-functions/https://genioct.lu/en/blog/serverless-entra-application-proxy-azure-functions/For a narrower class of internal apps and APIs, you can avoid Entra Application Proxy connector VMs with a cloud-native proxy pattern using Azure Functions, Easy Auth, and VNet integration. Here is the decision framework.Sat, 18 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/defender-for-cloud-2026-enable-tune-ignore/https://genioct.lu/en/blog/defender-for-cloud-2026-enable-tune-ignore/Defender for Cloud has grown into a sprawling product. Here is a practical guide to which plans are worth the money, which recommendations matter, and how to avoid the noise.Sat, 11 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-ai-enterprise-architecture-2026/https://genioct.lu/en/blog/azure-ai-enterprise-architecture-2026/Three years after Azure OpenAI went GA, the enterprise AI platform looks very different. Microsoft Foundry, GPT-5, the Responses API, agentic retrieval, and model-agnostic PTU reservations have changed the design decisions. Here is what matters now.Sat, 04 Apr 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-monitor-workbook-no-data-access-control/https://genioct.lu/en/blog/azure-monitor-workbook-no-data-access-control/The hidden access control trap in Azure Monitor Workbooks. Resource-context vs workspace-context queries, why Monitoring Reader is not always enough, and the fix that takes five minutes.Sat, 28 Mar 2026 00:00:00 GMThttps://genioct.lu/en/blog/palo-alto-cloud-ngfw-azure-2026/https://genioct.lu/en/blog/palo-alto-cloud-ngfw-azure-2026/Cloud NGFW has matured from an early ISV experiment into a credible managed firewall for Azure. How it compares to Azure Firewall Premium, what the real costs are, and a decision framework for enterprises choosing between them.Fri, 27 Mar 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-firewall-2026-standard-vs-premium-nva/https://genioct.lu/en/blog/azure-firewall-2026-standard-vs-premium-nva/Azure Firewall now has Basic, Standard, and Premium SKUs. Premium adds TLS inspection, IDPS, and URL filtering for regulated workloads. Here is the real enterprise decision guide for 2026.Sat, 21 Mar 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-landing-zones-nis2-dora-separate-hubs/https://genioct.lu/en/blog/azure-landing-zones-nis2-dora-separate-hubs/Should production and non-production share a hub in regulated Azure environments? A decision framework grounded in NIS2 operational resilience requirements and DORA environment separation obligations.Sat, 14 Mar 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-managed-partner-cost-savings/https://genioct.lu/en/blog/azure-managed-partner-cost-savings/Microsoft's Partner Earned Credit can reduce net Azure costs when your partner has the right access and operational role. Most enterprises never see that benefit because the setup is wrong. Here is how to check and fix it.Sat, 07 Mar 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-functions-flex-consumption-locked-storage-gotchas/https://genioct.lu/en/blog/azure-functions-flex-consumption-locked-storage-gotchas/How to deploy Azure Functions Flex Consumption to secured storage accounts. One Deploy, managed identity, the AzureWebJobsStorage format that matters, and Terraform workarounds.Sat, 28 Feb 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-waf-false-positives-rules-that-break-traffic/https://genioct.lu/en/blog/azure-waf-false-positives-rules-that-break-traffic/The CRS rules that trigger most often on real Azure web applications. How to identify, confirm, and safely exclude false positives without weakening your WAF.Sat, 21 Feb 2026 00:00:00 GMThttps://genioct.lu/en/blog/rag-azure-internal-knowledge-platforms/https://genioct.lu/en/blog/rag-azure-internal-knowledge-platforms/An architecture guide for building Retrieval-Augmented Generation on Azure. Document ingestion, AI Search, permission trimming, grounding, and the production challenges that tutorials skip.Sat, 07 Feb 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-policy-guardrails-developers-dont-hate/https://genioct.lu/en/blog/azure-policy-guardrails-developers-dont-hate/Practical Azure Policy examples that enforce governance without blocking delivery. Tag enforcement, SKU restrictions, network controls, and diagnostic settings that work with developer workflows.Sat, 31 Jan 2026 00:00:00 GMThttps://genioct.lu/en/blog/azure-landing-zones-2026-what-matters-now/https://genioct.lu/en/blog/azure-landing-zones-2026-what-matters-now/Landing zones are easy to deploy. Operating and evolving them is the real challenge. Policy hygiene, subscription vending, identity changes, and the day-2 problems that mature Azure environments face.Sat, 17 Jan 2026 00:00:00 GMThttps://genioct.lu/en/blog/microsoft-sentinel-2026-ingestion-cost-control/https://genioct.lu/en/blog/microsoft-sentinel-2026-ingestion-cost-control/Sentinel's biggest problem in enterprise Azure is not capability but cost. Data Collection Rules, Basic Logs, commitment tiers, and what to onboard first.Sat, 03 Jan 2026 00:00:00 GMThttps://genioct.lu/en/blog/yaml-driven-terraform-cloud-product-catalog/https://genioct.lu/en/blog/yaml-driven-terraform-cloud-product-catalog/How to turn your Terraform codebase into a self-service platform. A YAML-driven approach that lets teams provision cloud resources without writing HCL - and keeps your platform team sane.Thu, 18 Dec 2025 00:00:00 GMThttps://genioct.lu/en/blog/azure-apim-v2-vs-classic/https://genioct.lu/en/blog/azure-apim-v2-vs-classic/Azure API Management is moving to a new platform. The StandardV2 and BasicV2 tiers bring real improvements, but also breaking changes that catch teams off guard. Here is what you need to know before migrating.Tue, 02 Dec 2025 00:00:00 GMThttps://genioct.lu/en/blog/azure-waf-analysis-methodology/https://genioct.lu/en/blog/azure-waf-analysis-methodology/Azure WAF protects your web applications, but without a structured analysis methodology, you are flying blind. Learn how to turn WAF from a checkbox into a security asset.Wed, 12 Nov 2025 00:00:00 GMThttps://genioct.lu/en/blog/azure-landing-zone-audit-what-we-find/https://genioct.lu/en/blog/azure-landing-zone-audit-what-we-find/The patterns we see when reviewing enterprise Azure environments. Management group chaos, unenforced policies, DNS problems, identity gaps, and cost tagging failures.Fri, 15 Aug 2025 00:00:00 GMThttps://genioct.lu/en/blog/why-internal-developer-platforms-fail-azure/https://genioct.lu/en/blog/why-internal-developer-platforms-fail-azure/The patterns behind failed platform engineering initiatives. Too many tools, no paved path, no product ownership, inconsistent modules, and missing policy guardrails.Tue, 08 Jul 2025 00:00:00 GMThttps://genioct.lu/en/blog/developers-need-guardrails-not-more-tools/https://genioct.lu/en/blog/developers-need-guardrails-not-more-tools/The platform engineering problem is not tool count. It's the lack of opinionated defaults, clear ownership, and a measurable self-service path through the tools you already have.Thu, 05 Jun 2025 00:00:00 GMThttps://genioct.lu/en/blog/azure-apim-vs-front-door-vs-app-gateway/https://genioct.lu/en/blog/azure-apim-vs-front-door-vs-app-gateway/The real decision guide for Azure's overlapping edge services. When to use API Management, Front Door, Application Gateway, or a combination.Tue, 20 May 2025 00:00:00 GMThttps://genioct.lu/en/blog/azure-cost-optimization-beyond-rightsizing/https://genioct.lu/en/blog/azure-cost-optimization-beyond-rightsizing/The cost problems that rightsizing and reserved instances don't fix. Partner configuration errors, log ingestion sprawl, unused private endpoints, egress surprises, and diagnostic settings nobody audits.Thu, 10 Apr 2025 00:00:00 GMThttps://genioct.lu/en/blog/managing-technical-disagreements-platform-teams/https://genioct.lu/en/blog/managing-technical-disagreements-platform-teams/A real story from an enterprise platform team split over infrastructure tooling. The technical debate was the easy part. The human side, sunk cost, identity, and fear of starting over, is where it gets hard.Sat, 01 Feb 2025 00:00:00 GMThttps://genioct.lu/en/blog/dapr-1-0-distributed-application-building-blocks/https://genioct.lu/en/blog/dapr-1-0-distributed-application-building-blocks/Dapr graduated from CNCF in November 2024. The building-block model for distributed applications is now production-mature. Here is when Dapr earns its place on Azure, when native SDKs are still the better answer, and how Container Apps and AKS host it differently.Tue, 12 Nov 2024 00:00:00 GMThttps://genioct.lu/en/blog/cloud-security-board-level-nis2-dora/https://genioct.lu/en/blog/cloud-security-board-level-nis2-dora/NIS2 and DORA are now enforceable. Belgium's CyFun self-assessment deadline is April 2026. What CTOs and IT directors at Belgian and EU enterprises need to understand, and where the compliance gaps are showing up.Tue, 08 Oct 2024 00:00:00 GMThttps://genioct.lu/en/blog/terraform-azurerm-4-migration-guide/https://genioct.lu/en/blog/terraform-azurerm-4-migration-guide/The AzureRM provider 4.0 just dropped with breaking changes to resource naming, attribute defaults, and provider configuration. After migrating several production codebases, this is what you need to know.Thu, 05 Sep 2024 00:00:00 GMThttps://genioct.lu/en/blog/multi-cloud-trap-vendor-lock-in-myth/https://genioct.lu/en/blog/multi-cloud-trap-vendor-lock-in-myth/Most enterprises go multi-cloud out of fear rather than strategy. The result is double the complexity, double the skills gap, and rarely any actual portability. Here is what to do instead.Wed, 10 Jul 2024 00:00:00 GMThttps://genioct.lu/en/blog/build-vs-buy-platform-team-decision/https://genioct.lu/en/blog/build-vs-buy-platform-team-decision/An honest breakdown of when to hire cloud engineers in-house versus engaging a consultancy for your platform team. Real costs, real timelines, and the hybrid model that actually works for most enterprises.Wed, 20 Mar 2024 00:00:00 GMThttps://genioct.lu/en/blog/azure-verified-modules-standardized-iac/https://genioct.lu/en/blog/azure-verified-modules-standardized-iac/Azure Verified Modules provide Microsoft-maintained, tested, and standardized Terraform and Bicep modules for Azure resources. After using them in production, this is what works, what doesn't, and when to use your own modules instead.Tue, 12 Mar 2024 00:00:00 GMThttps://genioct.lu/en/blog/azure-bicep-vs-terraform-comparison/https://genioct.lu/en/blog/azure-bicep-vs-terraform-comparison/After running both Bicep and Terraform in production for the same enterprise, here is an honest take. Terraform is our default, Bicep has its place, and badly written Terraform is worse than either.Thu, 15 Feb 2024 00:00:00 GMThttps://genioct.lu/en/blog/palo-alto-cloud-ngfw-azure-pharma-poc/https://genioct.lu/en/blog/palo-alto-cloud-ngfw-azure-pharma-poc/We ran a proof of concept for Palo Alto Cloud NGFW alongside VM-Series in an enterprise Azure hub-spoke environment. The managed firewall works, but the operational details matter more than the feature sheet suggests.Thu, 01 Feb 2024 00:00:00 GMThttps://genioct.lu/en/blog/keda-cncf-graduation-event-driven-autoscaling/https://genioct.lu/en/blog/keda-cncf-graduation-event-driven-autoscaling/KEDA graduated from CNCF in August 2023. Event-driven autoscaling is now a stable, multi-vendor foundation that Container Apps, AKS, and any Kubernetes platform can rely on. Here is when KEDA earns its place, which scalers carry real operational weight, and where default HPA already does the job.Tue, 22 Aug 2023 00:00:00 GMThttps://genioct.lu/en/blog/microsoft-entra-id-azure-ad-rebrand/https://genioct.lu/en/blog/microsoft-entra-id-azure-ad-rebrand/Microsoft renamed Azure Active Directory to Microsoft Entra ID. Beyond the branding, there are real changes to APIs, PowerShell modules, and Terraform resources that affect every Azure environment.Tue, 18 Jul 2023 00:00:00 GMThttps://genioct.lu/en/blog/cloud-migration-hidden-costs-leadership-guide/https://genioct.lu/en/blog/cloud-migration-hidden-costs-leadership-guide/Enterprise cloud migrations routinely blow past their budgets by 20-30%. The reason isn't compute pricing. It's the platform teams, dual-run periods, licensing traps, and retraining costs that never made it into the original spreadsheet.Wed, 14 Jun 2023 00:00:00 GMThttps://genioct.lu/en/blog/azure-openai-enterprise-architecture-patterns/https://genioct.lu/en/blog/azure-openai-enterprise-architecture-patterns/Azure OpenAI Service is now generally available. Every Azure architecture now needs an AI strategy. Here are the patterns for network isolation, token management, and responsible deployment that we use in practice.Sat, 28 Jan 2023 00:00:00 GMThttps://genioct.lu/en/blog/azure-dns-private-resolver-hybrid-dns/https://genioct.lu/en/blog/azure-dns-private-resolver-hybrid-dns/Azure DNS Private Resolver is a managed service that replaces the custom DNS forwarder VMs that every enterprise hub-spoke architecture has been running. After migrating several environments, this is how it works and what to watch for.Tue, 15 Nov 2022 00:00:00 GMThttps://genioct.lu/en/blog/azure-container-apps-vs-aks-decision-framework/https://genioct.lu/en/blog/azure-container-apps-vs-aks-decision-framework/Azure Container Apps just went GA. With three container hosting options on Azure, here is a practical decision framework for architects who are tired of over-engineering container platforms.Wed, 01 Jun 2022 00:00:00 GMThttps://genioct.lu/en/blog/github-actions-azure-cicd-pipelines/https://genioct.lu/en/blog/github-actions-azure-cicd-pipelines/GitHub Actions now has first-class Azure integration. If your code lives in GitHub, your CI/CD probably should too. A practical comparison with Azure Pipelines and the migration patterns that work.Thu, 10 Mar 2022 00:00:00 GMThttps://genioct.lu/en/blog/microsoft-defender-for-cloud-multi-cloud-security/https://genioct.lu/en/blog/microsoft-defender-for-cloud-multi-cloud-security/Microsoft just unified Azure Security Center and Azure Defender into Defender for Cloud with multi-cloud support for AWS and GCP. Here is what changed and what it means for your security architecture.Mon, 08 Nov 2021 00:00:00 GMThttps://genioct.lu/en/blog/securing-web-apps-kubernetes-real-world-audit/https://genioct.lu/en/blog/securing-web-apps-kubernetes-real-world-audit/A step-by-step walkthrough of auditing a live Kubernetes web app, from XSS exploitation through a WAF in DetectionOnly mode, to exposed Prometheus metrics and missing authentication. Practical fixes included.Tue, 14 Sep 2021 00:00:00 GMThttps://genioct.lu/en/blog/azure-static-web-apps-jamstack/https://genioct.lu/en/blog/azure-static-web-apps-jamstack/Azure Static Web Apps just went GA with built-in CI/CD, serverless API backends, authentication, and global distribution. For static sites and SPAs on Azure, this changes the deployment story entirely.Thu, 20 May 2021 00:00:00 GMThttps://genioct.lu/en/blog/azure-arc-hybrid-cloud-management/https://genioct.lu/en/blog/azure-arc-hybrid-cloud-management/Azure Arc brings Azure Policy, monitoring, and security to servers and Kubernetes clusters anywhere. Here is what it actually does, where it fits, and the practical considerations for hybrid architectures.Thu, 12 Nov 2020 00:00:00 GMThttps://genioct.lu/en/blog/azure-landing-zones-real-world-lessons/https://genioct.lu/en/blog/azure-landing-zones-real-world-lessons/Microsoft's Enterprise-Scale architecture provides a production-ready Azure foundation. After implementing it for multiple organisations, here are the lessons that the documentation does not cover.Tue, 20 Oct 2020 00:00:00 GMThttps://genioct.lu/en/blog/azure-private-link-enterprise-paas/https://genioct.lu/en/blog/azure-private-link-enterprise-paas/Azure Private Link brings PaaS services into your private network. Here is how it works, the DNS complexity it introduces, and the architecture patterns every enterprise needs.Tue, 25 Feb 2020 00:00:00 GMThttps://genioct.lu/en/blog/azure-bastion-secure-vm-access/https://genioct.lu/en/blog/azure-bastion-secure-vm-access/Azure Bastion provides secure RDP and SSH access to your VMs directly from the Azure portal, without public IPs, jump boxes, or VPN. After rolling it out across multiple environments, this is what we learned.Wed, 06 Nov 2019 00:00:00 GMThttps://genioct.lu/en/blog/azure-sentinel-cloud-native-siem/https://genioct.lu/en/blog/azure-sentinel-cloud-native-siem/Microsoft's new cloud-native SIEM changes how enterprises design security operations. Here is what Sentinel does differently, how to architect around it, and when it replaces your existing SIEM.Thu, 03 Oct 2019 00:00:00 GMThttps://genioct.lu/en/blog/azure-front-door-global-load-balancing/https://genioct.lu/en/blog/azure-front-door-global-load-balancing/Azure Front Door combines global HTTP load balancing, SSL offload, WAF, and CDN caching in one service. After deploying it for multi-region applications, this is what works and what to watch out for.Thu, 18 Apr 2019 00:00:00 GMThttps://genioct.lu/en/blog/azure-firewall-cloud-native-network-security/https://genioct.lu/en/blog/azure-firewall-cloud-native-network-security/Azure Firewall is now generally available. Here is what it means for enterprise hub-spoke architectures, when it replaces NVAs, and the design patterns that work in practice.Tue, 02 Oct 2018 00:00:00 GMThttps://genioct.lu/en/blog/azure-devops-vsts-rebrand-what-changed/https://genioct.lu/en/blog/azure-devops-vsts-rebrand-what-changed/Microsoft just rebranded Visual Studio Team Services to Azure DevOps. Beyond the new name, the split into five independent services changes how teams adopt CI/CD, boards, and artifact management.Wed, 12 Sep 2018 00:00:00 GMThttps://genioct.lu/en/blog/azure-managed-identity-zero-credential-architecture/https://genioct.lu/en/blog/azure-managed-identity-zero-credential-architecture/Azure Managed Identity eliminates the need for credentials in your code. Here is how it works, when to use system-assigned vs user-assigned, and the architecture patterns that make secrets a thing of the past.Wed, 25 Jul 2018 00:00:00 GMThttps://genioct.lu/en/blog/azure-kubernetes-service-aks-production-lessons/https://genioct.lu/en/blog/azure-kubernetes-service-aks-production-lessons/Azure Kubernetes Service is now generally available. Before you migrate everything to AKS, here are the architecture decisions, networking gotchas, and operational realities that the quickstart guides skip.Wed, 20 Jun 2018 00:00:00 GMT