#azure · 8sync News

Brussels moves to put AWS and Azure under its toughest tech rules

The European Commission has issued preliminary findings that AWS and Azure should be designated as gatekeepers under the Digital Markets Act, despite neither service meeting the regulation's standard quantitative thresholds. Brussels is invoking the DMA's qualitative route, arguing both platforms serve as critical gateways for EU businesses. If designated, the two cloud giants would face obligations including no self-preferencing, mandated interoperability, and data portability rules aimed at reducing vendor lock-in. The move is partly motivated by cloud infrastructure's growing role as the foundation for AI adoption across Europe. Both Amazon and Microsoft have objected, and a defence phase is now underway before any final decision.

Azure Bicep Has a Plan Mode: Use It On Your Next Production Deployment

Azure Resource Manager's What-If operation is the Bicep equivalent of terraform plan — it predicts infrastructure changes before applying them. The post covers how to run What-If at different deployment scopes, how to interpret its output symbols (create, delete, modify, nochange), and how to integrate it as a mandatory pipeline stage. Key guidance includes treating deletions as a separate risk class, classifying modifications by blast radius rather than line count, handling provider-generated noise by establishing a baseline, using JSON output for automated policy gates, and understanding that What-If is pre-deployment evidence rather than a state lock.

Azure RBAC Explained: Roles, Scope, and Why Least Privilege Breaks Down

Azure RBAC uses a principal + role + scope model to control access across Azure resources. While it provides a solid foundation for access control, it does not automatically enforce least privilege — broad roles like Contributor and Owner get assigned at high scopes for convenience and are rarely revisited. Service principals and managed identities accumulate standing permissions that outlive their projects and rarely appear in access reviews. The post covers RBAC building blocks, common failure patterns (inherited access, non-human identity sprawl, overly broad roles), and best practices including narrowing scope, capping subscription Owners, using just-in-time access via Microsoft Entra PIM, and auditing dormant identities. It concludes by noting that native Azure controls reflect configured state, not actual usage, and promotes a usage-based approach to continuously enforce least privilege.

Rethinking cloud operations with agentic observability

Microsoft has announced the general availability of the Azure Copilot Observability Agent, built on Azure Monitor. The tool correlates logs, metrics, traces, topology, and operational context across environments to help operators move faster from incident detection to root cause resolution. It addresses growing cloud complexity — with 84% of organizations reporting increased complexity and 69% saying it outpaces their operating model — by using AI agents to reason across signals in real time. Customer examples cite reclaiming 250 engineering hours monthly and significantly faster incident resolution. The post frames observability as foundational to a broader shift toward agentic cloud operations, where AI agents continuously interpret signals, take action, and improve system resilience over time, with governance and human oversight remaining essential.

AI Engineering Needs Platform Controls

As AI-assisted engineering matures, platform teams need the same controls that make cloud platforms reliable: cost visibility, ownership, sensible defaults, observability, governance, and evaluation loops. Token usage should be treated like CPU or memory — a consumption signal requiring context, not a value proxy. Azure API Management's GenAI gateway capabilities (token rate limits, quota policies, telemetry) provide a shared control point for model consumption. GitHub Copilot usage metrics and team-level reporting help attribute spend. Workload-owned AI resources should be deployed via approved Terraform modules with networking, diagnostics, and tagging baked in. MCP servers and agent skills need explicit ownership and permission models. Governance should work through paved roads — repeatable workflows with evaluation loops — rather than policy documents that teams route around.

Conditional & Iterative Deployments with Azure Bicep

A deep dive into Azure Bicep's conditional (if) and iterative (for) deployment features, covering practical patterns and common pitfalls. Key topics include: guarding references to conditional resources using ternary expressions, the non-cascading nature of conditions on child resources, safe use of runtime functions like listKeys(), resource naming stability in loops, the difference between resource/module loops and variable/output loops, index fragility in filtered loops, and using @batchSize() to control deployment parallelism. Includes a practical checklist and a complete example combining conditionals, filtered loops, batching, and structured outputs.

Event Sourcing: Aggregates, Dynamic Consistency Boundaries, or what?

Part eleven of an event sourcing series explores how to handle consistency boundaries without relying on DDD aggregates or Dynamic Consistency Boundaries (DCBs). The author argues that the best approach depends on the actual problems at hand. Two alternatives are discussed: replacing concurrent designs with non-concurrent ones (e.g., a draft-registration phase processed by a single-threaded algorithm), and using Azure Service Bus sessions to serialize workday validation, eliminating race conditions within a consistency boundary. The post emphasizes solving real problems holistically rather than applying patterns preemptively, and shows how task-based UIs and small data models reduce the likelihood of concurrency conflicts in the first place.