Author: DP Staff

If you’re working with an Azure VM and want to delete the backup restore point collection, you might find that the resource group associated with it refuses to be deleted. Here’s a simple guide to help you understand the issue and how to resolve it.

When you enable backups on an Azure VM, Azure automatically creates a hidden resource group called something like “AzureBackupRG_region_number” (for example, “AzureBackupRG_eastus_1”). This group holds the restore point collection, which is used for instant restore snapshots. These restore points are different from the recovery points stored in the Recovery Services vault. When you delete the VM, disable the backup, and delete the vault, the restore point collection can sometimes be left behind as an orphaned resource. That’s why you can’t delete the “AzureBackupRG” resource group—it’s expected behavior enforced by Azure.

Here’s how to clean up the restore point collection and resolve the issue:

First, locate the hidden restore point collection. Log into the Azure portal and navigate to ‘Resource groups’. Find the “AzureBackupRG_region_number” resource group. To see the hidden resources, turn on the “Show hidden types” option from the top menu. You will spot a resource of type “Microsoft.Compute/restorePointCollections,” usually named with your VM’s name and a series of numbers.

Next, try deleting the restore point collection directly from the portal. If the portal doesn’t allow deletion, use Azure PowerShell or Azure CLI, which are reliable and supported methods.

With PowerShell, run:

Remove-AzResource -ResourceGroupName "AzureBackupRG_region_number"
-ResourceType “Microsoft.Compute/restorePointCollections” -Name "AzureBackup_VMName_numbers"
-Force

Using Azure CLI, execute:

RESOREPOINTID=$(az resource list -g AzureBackupRG_region_number \
–resource-type Microsoft.Compute/restorePointCollections \
–query “[?starts_with(name, ‘AzureBackup_VMName’)].id” -o tsv)
az resource delete –ids $RESTOREPOINTID

Executing these commands will remove the instant restore snapshots, but it doesn’t affect vault data (which you’ve already deleted).

Sometimes, you might see an error saying there’s an active shared access signature (SAS) attached to the restore point. This means a SAS token is still linked to the disk restore point, and you’ll need to revoke it using the REST API before attempting deletion again. Microsoft provides documentation for this process here.

After revoking any SAS, try deleting the restore point collection again using PowerShell or CLI.

Once all restore point collections are removed, the hidden resource group should be able to delete normally. If it still doesn’t delete, run:

Remove-AzResourceGroup -Name “AzureBackupRG_region_number” -Force

If you encounter persistent issues, such as errors related to SAS tokens or locks, note down the exact message and seek further assistance. Providing these details can help troubleshoot more effectively.

Following these steps should help you clean up the orphaned resource and fully delete the backup restore point collection.

If you’re trying to use Anthropic features within Microsoft Foundry and encounter an error message, it usually means the current setup doesn’t support these functions. The message might say something like “code_execution, skills not supported in your workspace,” which can be confusing.

Here’s what’s happening: The Claude models hosted on Microsoft Foundry don’t have all the features available on the full Anthropic platform. In particular, server-side tools like code execution aren’t available when Claude runs on Azure. This limitation affects certain features, such as the built-in PowerPoint skill that depends on those server-side capabilities.

So, if your goal is to generate PowerPoint presentations with Claude in Microsoft Foundry, you’ll need to find an alternative approach. Instead of relying on the built-in PowerPoint skill, you can use your application to create the presentation. This means integrating a presentation-generation library or service within your program. Essentially, your application will handle the creation of PowerPoint slides, rather than expecting the AI model to do it all automatically.

To sum up, because of platform limitations, the best way to generate presentations with Claude is to implement the presentation creation process within your app. This way, you can bypass the unsupported features and still get the results you want. If you want more details, check out the official documentation for Anthropic’s Claude in Microsoft Foundry.

If your identity verification process has taken more than a week, it might be because the verification provider needs to perform additional manual checks. This is often the case for new organizations or when more detailed business records need to be reviewed.

Here are some simple steps you can follow to help speed things up:

First, make sure all the information you submitted is exact. Double-check that your organization’s legal name, address, and registration details match what you entered for Trusted Signing.

Next, review your email inbox and spam folders regularly. Look out for any messages from Microsoft or the verification provider, as they might have sent important updates or request additional information.

If you’ve already contacted support, it’s helpful to include your Validation ID, Support Request ID, and Tenant ID in any follow-up conversations. Providing these details can help Microsoft support agents direct your case to the right team more quickly.

It’s best not to send a new verification request while your current one is still being processed. Submitting another request might cause additional delays.

Sometimes, Microsoft moderators monitor support forums and can assist in escalating your case. By sharing your Validation ID and support ticket number here, you may get faster help.

If this information was useful, please “Accept the Answer.” Doing so not only helps us but also assists others seeking solutions.

If you’re working with older virtual machine (VM) sizes in Azure and notice that some SKUs are missing cost information, here’s how to handle the situation. I recently encountered this issue myself when reviewing my machine learning workspace. Certain VM SKUs like DS11_v2 and D13_v2 aren’t showing their costs, and after digging into it, I found that these are older generation VM sizes.

These older SKUs still work and can be used, but they don’t have updated cost metadata because Azure doesn’t update support details for outdated models as often. Think of it like using an older phone model: it still functions but may lack current features or updated info. If you see missing price info, it’s probably because your VM falls into this older category.

While support for older VM sizes continues temporarily, it’s best to switch to newer VM sizes for better performance and security. You can find a list of current VM size families by visiting the official Azure documentation. This list will help you choose newer generations that come with clear, up-to-date pricing details.

For the most accurate pricing, I recommend using the Azure Pricing Calculator. It’s a simple tool that provides detailed cost estimates based on your specific VM choices. Just head over to the Azure pricing page for machine learning services, and you’ll see all the latest options and prices.

Hopefully, this helps clarify why some VM SKUs might show missing cost info and points you toward better options. If you have any questions or need more assistance, don’t hesitate to reach out. And if you found this helpful, clicking “upvote” would be greatly appreciated!

When preparing for a PostgreSQL major version upgrade on Azure, you’ll need to be aware of certain roles and extensions that Azure manages automatically. One such role is the ‘azure_pg_failover_slots_validator.’ This role is created and managed by Azure’s ‘pg_failover_slots’ feature and is not assigned or controlled by you. It’s important to note that Flexiblle Servers do not give full PostgreSQL superuser access, and you should avoid dropping or changing this role.

Before proceeding with your upgrade, run the validation check for the major version upgrade to see if there’s any blocking issue. One common problem involves the ‘pg_failover_slots’ extension. First, verify whether ‘pg_failover_slots’ is enabled in the ‘shared_preload_libraries’ setting. If it is enabled but you no longer need it, you should disable it: remove it from ‘shared_preload_libraries,’ restart your server, and then remove the extension from all databases where it’s installed. Always test this process on a restored, point-in-time backup of your server before applying it to your live environment.

If the ‘pg_failover_slots’ extension is not enabled or the validation still reports the Azure-managed role, then this is a situation that your changes won’t fix. In such cases, the issue is on Azure’s side. You’ll need to contact Azure Support and provide specific information including your server’s resource ID, current and targeted PostgreSQL versions, the validation output, operation IDs, and the timestamp of the test. Request that the Azure team updates the ‘stale managed-role attribute’ to resolve the issue. After they’ve made the correction, rerun the validation and try your upgrade again.

If you’re having trouble accessing your original Microsoft Entra tenant, here’s a simple way to solve the issue:

First, understand that sometimes, tenants can become temporarily inaccessible or might seem to disappear from your account. This can happen due to a variety of reasons, such as configuration changes or account issues.

To start, try signing out of your Microsoft account completely. Then, clear your browser’s cache and cookies to ensure no outdated data is causing the problem. After that, sign back into your account and check if the tenant appears in your list of available tenants.

If the tenant still isn’t showing up, it’s a good idea to contact Microsoft Support directly. When reaching out, provide details like your tenant’s onmicrosoft.com domain and explain that you previously had access without any issues. Mention that it appears to have disappeared or is inaccessible now.

Ask the support team to investigate what happened to the tenant and see if they can help restore your access. Usually, they can look into account and tenant settings on their end and resolve any issues.

Following these steps should help you regain access to your original Microsoft Entra tenant. Remember to keep any relevant details handy when contacting support, which will help expedite the process.

If your Azure Database for PostgreSQL Flexible Server experiences unexpected downtime, don’t panic. The first step is to understand that since the issue is caused by the platform itself, Microsoft’s support and backend investigation are your best resources.

Start by checking the Resource Health status for your affected server. This tool provides specific insights into the health of your resource and can help identify if the problem is related to platform maintenance, outages, or other platform issues. If you see an event related to the downtime, the most reliable next step is to open a support request directly from that Resource Health event.

While restarting the server manually might bring the service back temporarily, it won’t reveal what caused the outage. To find the root cause, request a Microsoft backend Root Cause Analysis (RCA) support. This involves asking Microsoft support to investigate their internal logs and telemetry data, which are not accessible through customer-side logs like PostgreSQL logs or activity logs.

Submitting this support request ensures you get detailed insights into what caused the downtime, keeping you better informed and helping prevent similar issues in the future. Remember, the Resource Health tool can tell you if an impact was planned, unplanned, or user-initiated, but only Microsoft’s internal investigation can uncover the exact cause.

If you want more detailed information about Resource Health and how it works, you can review the official documentation here:

• Azure Service Health Resource Health FAQ
• Azure Resource Health Overview

Hopefully, this guidance helps you resolve the issue. Please don’t hesitate to reach out if you have any further questions, need more steps, or clarification. And if you find this information useful, consider not closing the conversation by upvoting or accepting the answer, so others can benefit too.

If you’re seeing an error related to Azure Container Apps not recognizing the OS or architecture from your image, don’t worry—it’s a common issue that isn’t about your Dockerfile being wrong. Usually, the problem stems from how the image was built and uploaded to your Azure Container Registry (ACR).

One common cause is when you build your Docker image using Docker Buildx and push a multi-platform or OCI index image. In these cases, the image’s manifest might not clearly specify that it’s a Linux or amd64 platform. Azure Container Apps expects a straightforward Linux image with a specific platform, commonly linux/amd64.

This often happens if you build your image on a machine with Apple Silicon (like M1, M2, or M3 chips) or if you skip specifying the platform during the build. The pushed image could then be linux/arm64 or a multi-arch manifest, which Azure Container Apps doesn’t recognize correctly, leading to the “invalid operating system” error.

To fix this, you should explicitly build and push the image for the linux/amd64 platform. If you’re using Docker Buildx, add the --platform linux/amd64 flag to your build command:

bash
docker buildx build –platform linux/amd64 -t .azurecr.io/: –push .

If you’re not using Buildx, you can set the platform during the simple Docker build process like this:

bash
docker build –platform linux/amd64 -t .azurecr.io/: .
docker push .azurecr.io/:

After pushing, verify what was uploaded by inspecting the image manifest:

bash
docker manifest inspect .azurecr.io/:

Look for these details in the output:

“os”: “linux”,
“architecture”: “amd64”

If the os field is missing or empty, or if only arm64 is listed, Azure Container Apps won’t accept it and will show the error you’re experiencing.

Additionally, ensure you’re pushing a standard Docker schema v2 image. If you used Buildx with --output type=oci, ACA might not process it correctly. Stick to the default push method described above for better compatibility.

Remember, building and pushing with a clear, specific platform makes all the difference in avoiding these errors. If this helps resolve your issue, please accept the answer so others can find this solution easily. Your support helps the community grow.

Good luck!

If you have a Microsoft Customer Agreement (MCA) and want to transfer a subscription from one billing account to another, even if the accounts are in different tenants, it is possible as long as you have the right billing permissions.

Since you’re the billing owner on both accounts and also own the subscription, the best way to do this is through a billing ownership transfer request from the new billing account.

Here’s how you can do it:

1. First, go to the account you want to transfer the subscription to.

   • Navigate to Cost Management + Billing.
   • Select the target billing account, then go to the billing profile and the invoice section.

2. Next, create a transfer request.

   • Find and click on “Transfer requests.”
   • Hit “Add new request.”
   • Enter the email address of the owner of the current billing account (or your own email if you’re the same person).

3. Approving the transfer.

   • Open the transfer request email you receive.
   • Select the subscription(s) you want to move.
   • Review the details carefully, then confirm the transfer.

4. Finalize the transfer.

   • Once approved, the billing ownership of the subscription will shift to the new billing account.

This process effectively moves the billing responsibility for the subscription to a different account that supports this transfer under the MCA setup.

For more detailed information on moving billing ownership, you can refer to this guide: Transfer Azure product billing ownership to a Microsoft Customer Agreement.

If you found this solution helpful, please consider giving it an upvote and marking it as accepted. Your support helps others in the community find useful answers more easily.

When planning changes to your Azure setup, it’s important to understand what each action does. Moving billing ownership by itself doesn’t affect your Entra directory or your Azure DevOps organization, which means your repositories and Boards will stay the same. However, changing the subscription’s directory can remove important permissions like Azure RBAC assignments, custom roles, service principals, managed identities, Key Vault access, and pipeline service connections. This can cause issues with access and automation.

If you’re merging organizations, the best approach is to keep your current Azure DevOps organization as it is. Instead of trying to merge it directly, connect it to the target company’s Entra tenant. Microsoft does not support a direct organization merge, so this method is recommended. Before making any changes, ensure a team member with Project Collection Administrator permissions is in the target tenant. Then, export your user list, map identities correctly, invite any necessary guest users, and request support to clean up SSH keys if needed. Microsoft suggests reaching out to Support if you need to remap more than 100 users to avoid issues.

It’s also a good idea to pause deployments during this process to prevent disruptions. First, export your existing RBAC roles and service connection inventories. Afterwards, check that all users can sign in, verify group memberships, licenses, pipelines, agent pools, feeds, extensions, and federated credentials are working correctly.

If you’re only transferring billing information, you can leave the directory unchanged, and no other action is needed. But if you are changing the directory, make sure to re-create Azure roles and identity permissions before resuming production to keep everything running smoothly.

If you’re trying to redeem your Azure benefit through the Microsoft Startups Founders Hub but keep hitting a snag, you’re not alone. Many users face the same issue where, after clicking “Complete Azure sign-up,” they’re redirected to create an Azure account but then see a message saying they’re “not eligible for an Azure free account.”

Here’s a simple step-by-step solution that can help you get past this obstacle:

First, make sure you’ve completed all the necessary steps correctly. These include adding a valid Visa credit card, verifying your phone number, and confirming your personal information. These steps are crucial for the redemption process.

If you’ve already done these and still see the eligibility barrier, don’t worry. Often, this message appears because the system is checking whether your account qualifies for the free Azure benefits or if there’s another requirement to activate your startup offer.

A good way to proceed is to check your profile details again. Ensure that your startup’s information, such as your business name, registration number, and contact details, are accurate and up to date in the Microsoft portal. Sometimes, incomplete or inconsistent info can cause eligibility checks to fail.

Next, try clearing your browser cache or switching browsers. Sometimes, old data stored in your browser can interfere with the sign-up process.

If the problem persists, your best bet is to contact Microsoft Support directly. Provide them with the details of your attempt, including any error messages or screenshots. They can verify your eligibility and guide you through any additional steps necessary, whether it involves confirming your startup status or making sure you meet all criteria.

Remember, the process isn’t always instant, but with patience and proper verification, most startups find a way to activate their benefits. Just stay persistent and reach out for help if needed!

If you’ve been having trouble with your Azure SRE Agent not authenticate properly with Azure DevOps from your PME tenant, here’s a simple solution that can help you get things working smoothly again.

The issue often comes down to the account being used during the authentication process. In some cases, the agent might try to use a corporate (Corp) account that doesn’t have the right permissions or isn’t linked correctly to your Azure DevOps repositories. When this happens, the agent won’t be able to discover or add your repositories as expected.

To fix this, make sure the agent uses the correct account—specifically, the account associated with your Azure DevOps project. Once you switch to this correct account, the repositories should be discovered and added successfully. This is exactly what should happen if everything is configured properly.

This approach aligns with the official guidance from Microsoft on cross-account Azure DevOps access and OAuth authorization. You can review the detailed instructions here: Microsoft Docs – Cross-Account Azure DevOps OAuth Authorization.

If you find this information helpful, please consider up-voting or leaving feedback. Sharing your experience can help others in the community facing similar issues.

If you’re facing issues with subnet delegation, Azure CNI, or identity roles in Azure, and your portal shows an InternalServerError, here’s a step-by-step guide to troubleshoot and find a solution.

First, verify that your subnet delegation is set up correctly. The subnet you want to associate with the Azure Container Groups (AGC) must be dedicated and empty. Make sure it is in the same region as your other resources and delegated specifically to “Microsoft.ServiceNetworking/trafficControllers.” Keep in mind that Azure currently supports only one association per subnet, so the mapping needs to be precise.

Next, check your AKS cluster’s configuration. It should be using Azure CNI rather than kubenet. The subnet where your AGC resides must be reachable from your cluster’s virtual network. Additionally, the identity used by the Application Gateway (AG) Controller needs proper permissions. You’ll want to ensure it has the “AppGw for Containers Configuration Manager” role assigned along with network permissions. This role grants data actions that go beyond what Owner or Contributor roles provide.

If you’ve confirmed that all these settings are correct and the parent AGC resource still doesn’t reach a “Succeeded” status, the problem might be beyond Terraform and your portal. In this case, check the Activity Log for hidden details. Sometimes, creating a new AGC in a fresh Virtual Network (VNet) and subnet within the same region can resolve the issue. If that still doesn’t work, open a support ticket with detailed correlation and activity IDs. Ask them to investigate the provisioning process for “Microsoft.ServiceNetworking/trafficControllers” in the West Europe region or your specific location.

Taking these steps should help you troubleshoot the problem effectively. If this guide helps you resolve the issue, please consider accepting it to let others know.

Struggling with permissions can be frustrating, especially if you’re trying to manage resources in a cloud environment. Here’s a simple way to give your team the access they need without overdoing it.

First, make sure the resource group containing the virtual machine has the right permissions set. If you’re just trying to let someone view and browse resources in the portal, assigning them the Reader role at the resource group level is a good starting point. This role allows users to see resource details without making changes.

If your goal is for someone to manage or modify resources within that resource group, then you might consider assigning the Contributor role. However, be careful—this role gives more permissions than just viewing, including the ability to make changes.

It’s best practice to follow the principle of least privilege. This means only giving users the minimum permissions they need to do their job. For example, if the user only needs to update network security group rules through the portal, they’ll need permission to browse certain resources and edit rules. But if they’re making changes via command-line tools or APIs, they might need fewer permissions.

Take the time to understand exactly what actions the user needs to perform, and assign permissions accordingly. This way, your resources stay secure, and your team has just what they need—no more, no less.

If you’ve been using Azure Synapse to connect to a SharePoint Online List with a Linked Service and suddenly it stops working, you’re not alone. Many users have faced similar issues where the connection worked perfectly for years and then suddenly fails across both testing and production environments on the same day.

You might see an error message like this:
“Failed to get metadata of OData service,” with an expected status code of 200 but an actual status code of Unauthorized. Sometimes, you’ll see an error indicating “invalid_request.”

So, what’s going on, and how can you fix this? Here’s a straightforward guide to troubleshoot and resolve the problem.

First, check the sign-in logs of your service principal—ensure they show success. If the logs indicate a successful sign-in, then the authentication process is likely fine from the service’s perspective. You should verify that the resource you’re connecting to is correct, such as Office 365 SharePoint Online. Also, confirm that API endpoints like _api/web and _api/web/lists are accessible and returning data properly.

Next, review the app permissions assigned to your Azure AD app registration. The permissions should include:
– Sites.Read.All
– Sites.Manage.All
– Sites.FullControl.All

These are necessary to access and manage SharePoint data through the API.

You might also run a manual token test to see if you can acquire a SharePoint token using the client credentials grant. If this test is successful and SharePoint responds with a token, then the problem may be related to how the token is used or interpreted by the service.

In some cases, SharePoint may return a message like “Unsupported app only token.” This usually indicates that SharePoint is rejecting the token because of recent changes, such as the retirement of the Azure Container Service (ACS) or SharePoint’s rejection of Entra app-only tokens.

Have you seen failure messages like this after those changes? It’s a common issue when SharePoint online begins enforcing stricter authentication policies or updates its token requirements.

To fix this, you should:

1. Verify your app registration in Azure AD and make sure it has the correct permissions.
2. Check that your app is configured to use the latest authentication standards required by SharePoint Online.
3. If you’re using app-only tokens, consider re-registering your app or updating the app permissions. Sometimes, SharePoint online has shifted to use different token types or authentication flows post-ACS retirement.

It is also helpful to consult with your SharePoint administrator or support to ensure that your app’s registration aligns with current security policies.

If the problem persists after these steps, consider creating a new app registration with fresh permissions and try connecting again. This often resolves issues caused by outdated or misconfigured app settings.

In summary, when your Azure Synapse SharePoint connector suddenly fails, double-check permissions, ensure your app registration is up to date, and verify the use of correct token types as per the latest SharePoint requirements. Staying on top of recent SharePoint and Azure updates will help maintain a smooth connection.

When working with a site collection, it’s important to have the right permissions set up to read data properly. Specifically, you need both “Sites.Selected” and “Sites.Read.All” permissions.

First, “Sites.Selected” is an endpoint that allows an administrator to grant specific permissions—such as Read, Write, or both—to an application for a particular site collection. Think of it as giving the app the keys to access that site.

To get started, develop your application with “Sites.Selected” permission. Once your app is ready, you’ll use the “Sites.Selected” endpoint to give the application Read permission to access the site collection. This way, the app can read data from the site without needing full control.

Make sure to follow these steps carefully to ensure your application has the proper access. If you find this advice helpful, please consider accepting the answer and giving it an upvote. If you have more questions, don’t hesitate to leave a comment.

Also, if you want to receive email updates about this topic, check out the instructions in the official documentation to enable email notifications.

If you’re noticing that your Azure App Service is restarting at about the same time every day, it might seem concerning. However, there’s usually a simple explanation related to how Azure manages its platform and resources.

These daily restarts are most often caused by Azure performing routine platform updates, infrastructure maintenance, or reallocating workers. This isn’t typically a sign that something is wrong with your app or deployment. Instead, it’s part of the normal maintenance process that Azure performs to keep everything running smoothly.

When these updates happen, Azure may restart your site, recreate the application container, or move your app to a different worker. You might see the application start fresh with no errors, the deployment version remains the same, and no activity log entries are generated for a restart. The only clue is that the worker (or the machine powering your app) has changed, and the site begins again without issues.

Since your app is running on a single instance, you might experience a brief downtime during these updates because there’s no other instance to handle traffic temporarily. You may also notice that “SiteStarted” events happen around the same time daily, but no direct actions in the Activity Log, like a restart or deployment, are recorded.

To verify if these restarts are part of normal platform operations, you can use several free tools inside Azure:

– Check “Diagnose and Solve Problems” for insights on web app restarts.
– Review container logs and the live Log Stream to confirm the app starts cleanly each time.
– Monitor activity around the restart times using Azure Monitor for metrics like CPU, Memory, Requests, and HTTP responses.
– Look into “Resource Health” and “Azure Service Health” to see if there are scheduled platform events matching those times.

If minimizing downtime is critical, consider these steps:

– Increase your app to run on at least two instances. This way, if one instance is undergoing maintenance, the other can keep serving your users.
– Enable “Health Check” in your App Service, setting it to a lightweight endpoint that confirms your app’s health. This helps Azure route traffic only to healthy instances during updates.
– Turn on “Always On” if your plan supports it, reducing cold starts and helping your app stay ready during moves or updates.

As for the regular daily restart pattern, Azure doesn’t publish a fixed maintenance schedule, so these restarts are not guaranteed to happen at the same time every day. The fact that your Test and Production environments show the same pattern suggests it’s more likely related to platform processes rather than issues with your app or deployment.

Keep monitoring these restarts with Resource Health and “Diagnose and Solve Problems” tools. If you’re concerned about downtime, scaling your app to multiple instances is the most reliable way to ensure continuous availability during platform updates.

For further details, check Microsoft’s official documentation on managing App Service restarts and best practices for high availability. If you need more personalized help, consider reaching out to Azure Support, especially for recurring issues or significant downtime concerns.

Let us know if this guidance helps or if you have additional questions. And if this advice proves useful, don’t forget to upvote or share so others can benefit too!