Azure-infrastruktur & DevOps
Why Azure infrastructure deserves the same rigor as your product
Most Azure estates do not fail because someone picked the wrong service. They degrade slowly: unowned resource groups, exceptions clicked into the portal, secrets nobody dares to rotate, and a pipeline only one engineer understands. Azure infrastructure and DevOps, treated as an engineering discipline rather than a side effect of shipping features, is what separates teams that deploy calmly on a Friday afternoon from teams that schedule change windows and hope.
The stakes have risen for European engineering leaders in particular. AI workloads have moved out of the experiment phase and into production, which turns GPU capacity, model serving, autoscaling, and agent isolation into infrastructure problems rather than data-science problems. At the same time, regulation such as NIS2 and sector rules like DORA have made operational maturity a board-level question: incident response times, supply-chain controls, and evidence of tested recovery are now things you may be asked to prove. Infrastructure choices that used to be internal engineering preferences now carry compliance weight.
The decisions that shape an Azure platform
Infrastructure as code: the tooling question
Everything in a serious Azure estate starts from declared, versioned infrastructure. The practical question is which language to declare it in. Bicep offers day-one support for new Azure resource types and no state file to manage; Terraform offers a mature module ecosystem, multi-cloud reach, and a larger hiring pool. Teams also inherit this decision: many estates carry years of Terraform state and now weigh whether migrating to Bicep is worth the disruption. Whichever direction you take, the underlying goals are the same. Every resource should be reproducible from a repository, drift should be detected rather than discovered, and policy should be enforced in code instead of in review comments.
Compute: managed simplicity or Kubernetes control
For containerized workloads, the central Azure decision is between Container Apps and AKS. Container Apps gives you scale-to-zero, event-driven autoscaling, and a platform that a small team can operate without a dedicated Kubernetes specialist. AKS gives you the full Kubernetes surface: custom schedulers, service meshes, GPU node pools, and the operational patterns (GitOps controllers, progressive delivery, network policy) that large platform teams rely on. AI workloads sharpen this choice, because serving open-source models at scale involves GPU quotas, cold-start behavior, and cost profiles that differ sharply between the two. The real driver is rarely the technology; it is how much platform engineering capacity you actually have.
Identity and secrets: eliminate credentials before you rotate them
The strongest secret is the one that does not exist. Managed identity lets Azure workloads authenticate to databases, storage, and Key Vault without any stored credential, and workload identity federation extends the same idea to CI pipelines, removing long-lived service principal secrets from GitHub and Azure DevOps. What remains in Key Vault (third-party API keys, certificates, legacy connection strings) needs a rotation story that does not cause outages: versioned secrets, dual-key patterns, and applications that reload credentials without redeploying. Most Azure incidents traced to leaked credentials were preventable with patterns that are, by now, well documented and free.
Delivery: pipelines, runners, and deployment safety
A pipeline is only as trustworthy as its gates. Automated testing at the right layers, environments promoted through code rather than manual approval theatre, and deployment strategies (blue-green, canary, progressive rollout) that make rollback a routine action rather than an emergency. Two economic questions come up repeatedly. Self-hosted runners on Azure can cut CI costs and unlock private networking, but only past a certain build volume, and they add patching and isolation duties, which matter more now that AI coding agents execute untrusted code inside pipelines. GitOps, where a controller reconciles the cluster against a repository, shifts deployment from push to pull and gives you an audit trail regulators increasingly expect.
Observability and resilience: prove it works when things break
Dashboards are not observability. What matters is whether an on-call engineer can go from alert to cause quickly, which requires deliberate service-level objectives, metrics and traces that share correlation context, and alerts tuned to symptoms rather than causes. Azure Monitor, managed Prometheus, and Grafana cover most needs without third-party spend. Resilience deserves the same empiricism: chaos experiments, dependency failure drills, and tested restore procedures turn "we think it fails over" into evidence, which is exactly the form regulators and customers now ask for.
The EU dimension: for Swedish and European organizations, region selection (Sweden Central, North Europe), the Microsoft EU Data Boundary, NIS2 incident-reporting duties, and documented exit strategies are not afterthoughts. Encode residency and compliance constraints in policy as code from the start; retrofitting them across a live estate is far more expensive than declaring them on day one.
How to approach it
Sequence matters more than tool choice. Get the estate reproducible first: every resource in code, every change through a pipeline. Then remove standing credentials with managed identity and federation, because identity debt compounds faster than any other kind. Then invest in deployment safety and observability, which convert every subsequent change from a risk into a routine. Sophistication such as service meshes, chaos programs, and multi-cluster GitOps belongs after those foundations, not before.
Keep the platform team small and opinionated. A handful of golden paths that developers actually use beats a menu of options nobody maintains. The articles below go deep on each of these decisions, from IaC migrations and container platform choices to secret rotation, runner economics, and the operational patterns that hold up under European regulatory scrutiny.
Alla artiklar i ämnet
Guiden växer i takt med att vi publicerar — nya artiklar dyker upp här automatiskt.
Moving Azure infrastructure from Terraform to Bicep is less about converting HCL files and more about replacing a state-file workflow with a deployment-based one. This field guide covers when migration pays off, inventorying tfstate, incremental coexistence patterns, the decompile tooling that exists, deployment stacks as the lifecycle answer, and the what-if validation and rollback discipline that keeps the cutover safe.
A published attack chain achieved remote code execution against Claude Code in auto mode, with the safety classifier approving the steps that led to compromise and then blocking the cleanup command. What the break teaches teams running AI coding agents, and how to build real isolation on Azure with Hyper-V sandboxes, default-deny egress and short-lived credentials.
The MCP core maintainers published a new roadmap on 22 August 2026, four weeks after the 2026-07-28 spec made the protocol core stateless: five priorities covering agentic messaging, HTTP-native transport unification, agent identity with DPoP and Workload Identity Federation, improved primitives, and SDK developer experience. Here is how Azure-first EU teams should sort that list into adopt now, prepare, and watch.
Next.js 16.3 shipped on 3 August 2026 with build disk caching on by default, up to 90% lower dev-server memory through eviction, TypeScript 7 type checking, and native Node.js streams that handle up to 22% more SSR requests under load. Here is what an Azure-hosted enterprise app gains from the upgrade, how to verify the wins in your own CI pipeline, and a decision guide for the opt-in Instant Navigations suite.
The Model Context Protocol specification version 2026-07-28 shipped on 28 July with a stateless core, Multi Round-Trip Requests, required routing headers, cacheable list results and a hardened authorization model that deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. All four Tier 1 SDKs shipped support on release day, so Azure teams running MCP servers on Container Apps, AKS or behind API Management can start migrating immediately.
TypeScript 7.0 reached general availability on 8 July 2026 with the Go-native compiler, cutting full builds by 8x to 12x and memory use by up to a quarter on Microsoft's published benchmarks. The release ships without a stable programmatic API until 7.1, which blocks typescript-eslint, framework template checking and Next.js detection, so the right move depends on which of three migration profiles your repo fits.
GitHub’s new Copilot desktop app runs multiple coding agents in parallel, each session isolated in its own git worktree, and is already included in Copilot Pro, Pro+, Business and Enterprise subscriptions. Getting value from it depends less on prompting than on task selection, worktree hygiene, supervision cadence and engineered review capacity, because five agents can open pull requests faster than one reviewer can read them.
MCP's 2026-07-28 release candidate removes the initialize handshake and the Mcp-Session-Id header, so every request is self-contained and Azure-hosted MCP servers can run behind plain load balancers without sticky sessions or Redis session stores. Tasks and MCP Apps land as formal extensions, six SEPs harden authorization around OAuth 2.0 and OpenID Connect, and Roots, Sampling and Logging enter a 12-month deprecation window.
A practical pattern for rotating Azure secrets with zero downtime using Managed Identity, Key Vault rotation policies, and versioned references — including the common mistakes that cause rotation-induced outages.
A decision matrix for running AI workloads on Azure Container Apps versus AKS — GPU support, scale-to-zero economics, networking, blast radius, operational overhead, and when graduating from Container Apps to AKS actually pays off.
A 2026 comparison of Bicep and Terraform for Azure — state management, provider coverage, drift detection, module ecosystems, team-scale considerations, and an honest recommendation matrix for different team shapes.
The honest cost model for self-hosted GitHub Actions runners on Azure — break-even math against hosted runners, when self-hosting is a trap, and the ephemeral scaleset architecture that keeps them safe in production.
Microsoft Ignite BRK117: Deploy open-source AI models (Llama 3.3, Mistral) with Azure Container Apps serverless GPUs, AKS with Kaido workflows, and on-premise infrastructure. Cost reduction 60-85%, data sovereignty, and hybrid architectures with Azure Arc.
Teams with strong DevOps practices are best positioned to harness AI power. Discover how GitHub Copilot and AI agents bring unprecedented speed, scale, and security across the software development lifecycle—from planning to production.
A comprehensive guide to container orchestration with kubernetes for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to infrastructure as code with terraform and azure for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to chaos engineering for resilient systems for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to monitoring and observability with grafana and prometheus for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to building resilient microservices for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to gitops: the future of continuous deployment for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to automated testing in ci/cd pipelines for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to blue-green deployments on kubernetes for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to docker best practices for production for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
A comprehensive guide to service mesh: istio vs linkerd for Swedish B2B enterprises. Learn best practices, implementation strategies, and real-world examples.
Vanliga frågor
Should we use Bicep or Terraform for Azure infrastructure?
If you are Azure-only and starting fresh, Bicep is the simpler choice: no state file to manage, day-one support for new Azure resource types, and it is free and maintained by Microsoft. Terraform remains the better fit for multi-cloud estates, teams with existing Terraform expertise, or organizations that depend on its module and provider ecosystem. Migrating an existing Terraform estate to Bicep is possible but is a project in itself, so weigh the disruption against the maintenance you actually save.
When is AKS worth it over Azure Container Apps?
Choose AKS when you need capabilities Container Apps does not expose: custom node pools and GPU scheduling control, service meshes, advanced network policy, or GitOps tooling that expects a full Kubernetes API. Container Apps covers most API, worker, and event-driven workloads with far less operational overhead, including scale-to-zero. A useful test is whether you can staff Kubernetes operations as an ongoing responsibility; if not, Container Apps is usually the right default.
How do we remove secrets from our Azure CI/CD pipelines?
Use workload identity federation so GitHub Actions or Azure DevOps authenticate to Azure with short-lived OpenID Connect tokens instead of stored service principal secrets. Inside Azure, give workloads managed identities so they reach databases, storage, and Key Vault without any credential in configuration. What cannot be eliminated, such as third-party API keys, belongs in Key Vault with versioning and a rotation procedure your applications can survive without redeployment.
Are self-hosted GitHub runners on Azure worth the effort?
They pay off when build volume is high, builds need private network access to Azure resources, or you need specific hardware such as GPU or large-memory machines. Below that threshold, GitHub-hosted runners are usually cheaper once you account for patching, scaling, and image maintenance. Isolation also matters: runners execute code from pull requests and, increasingly, from AI coding agents, so ephemeral, single-use runner instances are the safer pattern.
What do EU data residency requirements mean for our Azure setup?
Azure lets you pin workloads to EU regions such as Sweden Central, and Microsoft's EU Data Boundary commits to storing and processing customer data for core services within the EU. Residency alone is not compliance: NIS2 and sector rules also expect incident-reporting readiness, supplier risk management, and tested recovery. Encode region and policy constraints with Azure Policy and infrastructure as code so residency is enforced automatically rather than checked manually.