Christoffer Klarskov Jakobsen – Microsoft Architect Microsoft Architect — notes on Azure, Microsoft 365, and modern cloud engineering. https://chkja.dk/ 2026-05-07T00:00:00.000Z Azure Local - Assign Microsoft Cloud Security Benchmark v2 across multiple subscriptions https://chkja.dk/blog/azure-local-azure-policy-mcsb-multi-subscription/ 2026-05-07T00:00:00.000Z 2026-05-07T00:00:00.000Z\ +\t\tHow to assign the Microsoft Cloud Security Benchmark v2 Azure Policy initiative at Management Group scope to audit both Azure Local nodes and virtual machines across your entire tenant + Public Speaking: Data Sovereignty MicroHack at Microsoft Lyngby https://chkja.dk/blog/public-speaking-sovereignty-microhack-microsoft-lyngby/ 2026-04-29T00:00:00.000Z 2026-04-29T00:00:00.000Z\ +\t\tFellowmind joined a Microsoft-hosted Data Sovereignty MicroHack in Lyngby, focused on how to protect the privacy of European data + Azure Virtual Desktop - Entra ID joined session host - Microsoft Edge SSO issue https://chkja.dk/blog/azure-virtual-desktop-entraidsessionhost-egde-ssoissue/ 2026-04-25T00:00:00.000Z 2026-04-25T00:00:00.000Z\ +\t\tWhy are users prompted for password then logging on to Microsoft services in their Edge browser, then working on Entra ID joined session hosts + Azure Virtual Desktop – Entra ID SSO – Complete Guide https://chkja.dk/blog/wp/azure-virtual-desktop-entra-id-sso-complete-guide/ 2024-09-22T00:00:00.000Z 2026-04-24T00:00:00.000Z\ +\t\tThis guide will walk through all the steps required for SSO to work, both within AVD session hosts (auto login to Microsoft applications running within AVD) and from clients to AVD + Azure Local - How to connect to Kubernetes cluster https://chkja.dk/blog/azure-local-kubernetes-connect-to-cluster/ 2026-04-04T00:00:00.000Z 2026-04-04T00:00:00.000Z\ +\t\tYou just deployed your first Kubernetes cluster on Azure Local, but how to generate the SPN needed to see namespaces and workloads in from the Azure portal? This article will show you how! + Azure Local - How to extend storage space and volumes in Azure Local stack https://chkja.dk/blog/azure-local-extend-storagespace-storagevolume/ 2026-04-02T00:00:00.000Z 2026-04-02T00:00:00.000Z\ +\t\tHere is how to extend storage space and volume in Azure Local stack - lab mode included + Azure Local - LENS https://chkja.dk/blog/azure-local-lens/ 2026-03-29T00:00:00.000Z 2026-03-29T00:00:00.000Z\ +\t\tWhy you should use Azure Local LENS in your environment + Azure Local - Insights, logging and alerts - Series https://chkja.dk/blog/azure-local-insights-series/ 2026-02-20T00:00:00.000Z 2026-03-28T00:00:00.000Z\ +\t\tHow to configure insights, collect logs and create alert rules + Azure Local – Best places to gain information https://chkja.dk/blog/wp/azure-local-best-places-to-gain-information/ 2025-07-22T00:00:00.000Z 2026-03-22T00:00:00.000Z\ +\t\tIntro I use a lot of different places when I need to search new information regarding Azure Local. I have created a list of all the common sites I turn to, when in need of informat + Solution for WssdAgent service entering stopped state https://chkja.dk/blog/azure-local-fix-wssdagent-service-stopped-state-error/ 2026-03-11T00:00:00.000Z 2026-03-11T00:00:00.000Z\ +\t\tIf we cannot communicate with Azure Local from Azure Portal, and we get MOC errors, check if WssdAgent service is running + Solution for VM-Switch looses binding to physical network adapters https://chkja.dk/blog/azure-local-fix-vmswitch-looses-binding/ 2026-03-09T00:00:00.000Z 2026-03-09T00:00:00.000Z\ +\t\tWe see an issue once we start installed NetworkATC. I have written a workaround before, but now finally a solution is available + Azure Local - Storage Design - Nested Resiliency https://chkja.dk/blog/azure-local-storage-design-nested-resiliency/ 2026-03-08T00:00:00.000Z 2026-03-08T00:00:00.000Z\ +\t\tBefore buying hardware and deploying, you need to understand Azure Local storage design decisions to make, to ensure your stack is configured to your requirements + Workaround for network bug in Azure Local 23H2 https://chkja.dk/blog/wp/workaround-for-network-bug-in-azure-local-23h2/ 2025-07-04T00:00:00.000Z 2026-03-08T00:00:00.000Z\ +\t\tI wanted to share my recent work with a customer that have multiple Azure Local 23H2 stacks that have been upgraded from 22H2. We see an issue once we start installing NetworkATC + Azure Local - Insights and Logging - Part 2 - Log Alerts https://chkja.dk/blog/azure-local-insights-part2-logalert/ 2026-02-28T00:00:00.000Z 2026-02-28T00:00:00.000Z\ +\t\tHow to configure insights and collect logs + Azure Local – create alert rules using code (IaC) https://chkja.dk/blog/wp/azure-local-create-alert-rules-using-code-iac/ 2025-10-15T00:00:00.000Z 2026-02-28T00:00:00.000Z\ +\t\tIf you want to deploy any alert rules to multiple Azure Local Stacks, it is very time consuming because you would have to create the same alert rules for each Azure Local Stack. Bu + Azure Local - Insights and Logging - Part 1 https://chkja.dk/blog/azure-local-insights-part1/ 2026-02-21T00:00:00.000Z 2026-02-21T00:00:00.000Z\ +\t\tHow to configure insights and collect logs + Azure Local - Homelab - Part 3 - Deployment and custom deployments https://chkja.dk/blog/azure-local-homelab-part3-deploy/ 2026-02-14T00:00:00.000Z 2026-02-14T00:00:00.000Z\ +\t\tThis is the story about my homelab - 2026 edition + Azure Local – VM Guest License Activation - Fix https://chkja.dk/blog/azure-local-vm-guest-license-activation-fix/ 2026-02-14T00:00:00.000Z 2026-02-14T00:00:00.000Z\ +\t\tHow to fix license activation on VMs running on Azure Local + Azure Local – Design the infrastructure https://chkja.dk/blog/wp/azure-local-design-the-infrastructure/ 2025-07-16T00:00:00.000Z 2026-02-07T00:00:00.000Z\ +\t\tI have seen many designs of Azure Local stacks that have encountered issues that could have been prevented if the design was changed to follow some best practices. I wanted to shar + Azure Local - Homelab - Part 2 - Configuration pre-requisites https://chkja.dk/blog/azure-local-homelab-part2-config/ 2026-02-01T00:00:00.000Z 2026-02-01T00:00:00.000Z\ +\t\tThis is the story about my homelab - 2026 edition + Azure Local - Homelab - Part 1 - Intro https://chkja.dk/blog/azure-local-homelab-part1-intro/ 2026-01-27T00:00:00.000Z 2026-01-27T00:00:00.000Z\ +\t\tThis is the story about my homelab - 2026 edition + Azure Local - Homelab - Series https://chkja.dk/blog/azure-local-homelab-series/ 2026-01-26T00:00:00.000Z 2026-01-26T00:00:00.000Z\ +\t\tThis is the story about my homelab - 2026 edition + Azure Local - Change LCM User https://chkja.dk/blog/azure-local-change-lcm-user/ 2026-01-22T00:00:00.000Z 2026-01-22T00:00:00.000Z\ +\t\tIf your LCM User stopped working, or you need to change it due to issues with current LCM User, this guide is for you to follow + Azure Local - Add Scheduled task using PowerShell https://chkja.dk/blog/azure-local-scheduledtask/ 2026-01-15T00:00:00.000Z 2026-01-15T00:00:00.000Z\ +\t\tHow to add Scheduled task to Azure Local stack using PowerShell + New layout on my website https://chkja.dk/blog/wp/new-layout-on-my-website/ 2026-01-14T00:00:00.000Z 2026-01-14T00:00:00.000Z\ +\t\tI have chosen to update the design of my website. I hope the new design enhances reader experience. I like to write blog posts, but layout and design is not my main focus and not s + Azure Local – change physical network adapter cards in existing Network Intent https://chkja.dk/blog/wp/azure-local-change-physical-network-adapter-cards-in-existing-network-intent/ 2026-01-12T00:00:00.000Z 2026-01-12T00:00:00.000Z\ +\t\tThis guide tells you have to carry out the swap of network adapter cards in nodes in Azure Local stack. Maybe not something everybody ever has to do, but funny enough I have had to + Azure Local – Extend data disk on virtual machine using code https://chkja.dk/blog/wp/azure-local-extend-disk-on-virtual-machine-using-code/ 2026-01-07T00:00:00.000Z 2026-01-07T00:00:00.000Z\ +\t\tVirtual machine data disks in Azure Local can be extended with Azure CLI. I’m a fan of every task that can be performed using code over GUI, and here is a simple script written in + Azure SQL Managed Instance Link – Useful PowerShell commands https://chkja.dk/blog/wp/azure-sql-managed-instance-link-useful-powershell-commands/ 2026-01-06T00:00:00.000Z 2026-01-06T00:00:00.000Z\ +\t\tIf you work with Azure SQL Managed Instance and you have configured Managed Link to a secondary replica (SQL Server e.g.), these PowerShell commands could be useful for you to know + Azure Local – How to keep stack up to date https://chkja.dk/blog/wp/azure-local-how-to-keep-stack-up-to-date/ 2025-12-18T00:00:00.000Z 2025-12-18T00:00:00.000Z\ +\t\tIntro Keeping Azure Local environments up to date is a critical part of maintaining a secure, stable, and high-performing hybrid infrastructure. As Azure Local continues to evolve, + Azure Virtual Desktop – 0x0 error on sign in https://chkja.dk/blog/wp/azure-virtual-desktop-0x0-error-on-sign-in/ 2025-12-12T00:00:00.000Z 2025-12-12T00:00:00.000Z\ +\t\tI came across this error then trying to sign in a user to AVD. The configuration consists of hybrid joined session hosts, synced users from Active Directory to Entra ID, and SSO co + Azure Local – SDDC Management Failed https://chkja.dk/blog/wp/azure-local-sddc-management-failed/ 2025-12-11T00:00:00.000Z 2025-12-11T00:00:00.000Z\ +\t\tOn Azure Local, the SDDC Management (or Health for that matter), can break and go offline. Here is how to verify and fix it (will fix most common issues at least) How to check if S + Azure SQL Managed Instance – Windows Authentication – Cannot generate SSPI context https://chkja.dk/blog/wp/azure-sql-managed-instance-windows-authentication-cannot-generate-sspi-context/ 2025-12-04T00:00:00.000Z 2025-12-04T00:00:00.000Z\ +\t\tIntro I had configured all the pre-requisites I could read about in the articles for configuring Windows Authentication support via Entra ID for Azure SQL Managed Instance. But whe + Azure Local – Custom location in failed provision state https://chkja.dk/blog/wp/azure-local-custom-location-in-failed-provision-state/ 2025-11-30T00:00:00.000Z 2025-11-30T00:00:00.000Z\ +\t\tThis one was not something I was working on myself, but I got this from a customer of mine. The problem was and the customer could not choose several of their Azure Local custom lo + Azure Local – CPU reservations on virtual machines https://chkja.dk/blog/wp/azure-local-cpu-reservations-on-virtual-machines/ 2025-11-18T00:00:00.000Z 2025-11-18T00:00:00.000Z\ +\t\tSome application vendors require a CPU core reservation to be configured. However, this configuration can conflict with pre-update health checks. It you encounter this error during + Azure Local – AzStackHci Environment Checker https://chkja.dk/blog/wp/azure-local-azstackhci-environment-checker/ 2025-11-14T00:00:00.000Z 2025-11-14T00:00:00.000Z\ +\t\tThis is just a very small article about some cool things about the environment checker for Azure Local. I have used it multiple times for troubleshooting scenarios, that did not in + Azure Local – UpgradeArbAndExtensions – arcappliance upgrade failed – line 3345 at UpgradeArbAndExtensionsInternal https://chkja.dk/blog/wp/azure-local-upgradearbandextensions-arcappliance-upgrade-failed-line-3345-at-upgradearbandextensionsinternal/ 2025-11-14T00:00:00.000Z 2025-11-14T00:00:00.000Z\ +\t\tThe error Intro I was updating an Azure Local Stack from 11.2509 to 11.2510. Doing the update, I hit an issue about the MOC ARB update. The error above is not very helpful, but I f + Azure Local – Exception caught in Test-AzStackHciArcIntegration validator https://chkja.dk/blog/wp/azure-local-exception-caught-in-test-azstackhciarcintegration-validator/ 2025-10-27T00:00:00.000Z 2025-10-27T00:00:00.000Z\ +\t\tIntro Below are a few different steps I have got from working with Microsoft Support while we did several troubleshooting sessions on an Azure Local Stack that could not update fro + Microsoft Defender for Cloud – Delete exemptions using REST API https://chkja.dk/blog/wp/microsoft-defender-for-cloud-delete-exemptions-using-rest-api/ 2025-10-15T00:00:00.000Z 2025-10-15T00:00:00.000Z\ +\t\tIn my previous post, I touched on the topic of how to create Microsoft Defender for Cloud recommendation exemptions (also called standard assignments: exempt mode). In this post I + Microsoft Defender for Cloud – Create exemptions using REST API https://chkja.dk/blog/wp/microsoft-defender-for-cloud-create-exemptions-using-rest-api/ 2025-10-15T00:00:00.000Z 2025-10-15T00:00:00.000Z\ +\t\tIn my previous post, I touched on the topic of how to get Microsoft Defender for Cloud recommendation exemptions (also called standard assignments: exempt mode). In this post I wan + Microsoft Defender for Cloud – exemptions using REST API https://chkja.dk/blog/wp/microsoft-defender-for-cloud-exemptions-using-rest-api/ 2025-10-15T00:00:00.000Z 2025-10-15T00:00:00.000Z\ +\t\tThis topic is something I have wanted to dive into for months, but I have found it difficult to wrap my head around how to get started.I wanted to look into how I could get policy + Microsoft Defender for Cloud – Get exemptions using REST API https://chkja.dk/blog/wp/microsoft-defender-for-cloud-get-exemptions-using-rest-api/ 2025-10-15T00:00:00.000Z 2025-10-15T00:00:00.000Z\ +\t\tThis post is part of a series. Navigate to the parent post using this link: In this post, I want to show you how to get (list) standard assignments (exemptions) using PowerShell an + AADSTS1000030 – User authentication fails in Outlook mobile https://chkja.dk/blog/wp/aadsts1000030-user-authentication-fails-in-outlook-mobile/ 2025-10-13T00:00:00.000Z 2025-10-13T00:00:00.000Z\ +\t\tMessage: AADSTS1000030 – (Pii), Domain: MSALCode: -42004Description: MSAL domain error I came across this error on a users iPhone. The user had recently changed password on its Mic + Azure Local – MOC update prechecks failed https://chkja.dk/blog/wp/azure-local-moc-update-prechecks-failed/ 2025-10-09T00:00:00.000Z 2025-10-09T00:00:00.000Z\ +\t\tError in portal and Powershell doing pre-check health of solution update (after pre-check doing prepare had already executed without further errors): Title : MOC Update Precheck Te + Azure Local – Troubleshoot missing log collection https://chkja.dk/blog/wp/azure-local-troubleshoot-missing-log-collection/ 2025-10-07T00:00:00.000Z 2025-10-07T00:00:00.000Z\ +\t\tIf you come across an Azure Local stack where you do not see anything in the Insights overview, it can be because of multiple things. Microsoft source article for reference: https: + Azure Devops – Managed Branch Policies – Default Branch https://chkja.dk/blog/wp/azure-devops-managed-branch-policies-default-branch/ 2025-10-06T00:00:00.000Z 2025-10-06T00:00:00.000Z\ +\t\tWhen working with large Azure DevOps projects containing many repositories, setting up consistent branch policies across all default branches can be a challenge—especially when tar + Windows Admin Center – Bulk enable on servers via PowerShell https://chkja.dk/blog/wp/windows-admin-center-bulk-enable-on-servers-via-powershell/ 2025-09-30T00:00:00.000Z 2025-09-30T00:00:00.000Z\ +\t\tWindows Admin Center is a great tool for managing Windows Servers from the Azure Portal. But how to enable this great tool on many servers at the same time. I have written a small + Azure Virtual Machine – migrate from Azure Disk Encryption https://chkja.dk/blog/wp/azure-virtual-machine-migrate-from-azure-disk-encryption/ 2025-09-27T00:00:00.000Z 2025-09-27T00:00:00.000Z\ +\t\tImportantAzure Disk Encryption for Virtual Machines and Virtual Machine Scale Sets will be retired on September 15, 2028. New customers should use encryption at host for all new VM + Azure Local – Enable Remote Desktop (RDP) https://chkja.dk/blog/wp/azure-local-enable-remote-desktop-rdp/ 2025-09-26T00:00:00.000Z 2025-09-26T00:00:00.000Z\ +\t\tIt is recommended to keep RDP disabled, but sometimes we need RDP access (e.g. troubleshooting around failed updates that require manual install of patches or modules). Here is how + EasyEntra: Review https://chkja.dk/blog/wp/easyentra-review/ 2025-09-24T00:00:00.000Z 2025-09-24T00:00:00.000Z\ +\t\tDisclaimer This review is not in any way sponsored by EasyEntra or any other company. This review is written 100% free of charge, and should not be seen as a commercial, only as a + Azure Local – MOC ARB update failed doing solution upgrade https://chkja.dk/blog/wp/azure-local-moc-arb-update-failed-doing-solution-upgrade/ 2025-09-20T00:00:00.000Z 2025-09-20T00:00:00.000Z\ +\t\tI got this from Microsoft Premium Support. I was working on a Azure Local stack that would not update the MOC ARB to latest version doing the solution update. We ended up skipping + Public Speaking: Azure Arc MicroHack at Microsoft Lyngby https://chkja.dk/blog/public-speaking-azure-arc-microhack-microsoft-lyngby/ 2025-09-19T00:00:00.000Z 2025-09-19T00:00:00.000Z\ +\t\tFellowmind joined a Microsoft-hosted Azure Arc MicroHack in Lyngby, focused on BCDR and hybrid cloud conversations. + Azure Local – Pagefile eats up entire system drive https://chkja.dk/blog/wp/azure-local-pagefile-eats-up-entire-system-drive/ 2025-09-16T00:00:00.000Z 2025-09-16T00:00:00.000Z\ +\t\tI came across a situation where I could not update an Azure Local stack because nodes where running out of diskspace. I used WinDirStat from another management server (map one of t + Quickly migrate multiple virtual machines to Standard SSD https://chkja.dk/blog/wp/quickly-migrate-multiple-virtual-machines-to-standard-ssd/ 2025-09-13T00:00:00.000Z 2025-09-13T00:00:00.000Z\ +\t\tI wanted to get a script to convert multiple virtual machines from Standard HHD to Standard SSD if they were ready for it.By ready I mean; a virtual machine that I have prepared a + Azure Local – Common update issues https://chkja.dk/blog/wp/azure-local-common-update-issues/ 2025-09-01T00:00:00.000Z 2025-09-01T00:00:00.000Z\ +\t\tIntro There can be lots of different errors and issues around patching Azure Local. I have tried to write about all the errors I have come across so far in my work with Azure Local + Azure Local – Update issue – EvalCauRetryApplicability https://chkja.dk/blog/wp/azure-local-update-issue-evalcauretryapplicability/ 2025-09-01T00:00:00.000Z 2025-09-01T00:00:00.000Z\ +\t\tTags: Type ‘EvalCauRetryApplicability’ of Role ‘CAU’ raised an exception: CAU Run failed Updates to this article November 2025 Microsoft has published a fix if Defender is blocking + Azure Local – IaC – AVD – Azure DevOps – Deploy session host https://chkja.dk/blog/wp/azure-local-iac-avd-azure-devops-deploy-session-host/ 2025-08-26T00:00:00.000Z 2025-08-26T00:00:00.000Z\ +\t\tAn essential part of building AVD on Azure Local, is to deploy session hosts. In this article I want to share the template I normally use for this task. It is written in Bicep. Tem + Azure Hybrid Infrastructure – Microsoft Ambassadors to follow https://chkja.dk/blog/wp/azure-hybrid-infrastructure-microsoft-ambassadors-to-follow/ 2025-08-19T00:00:00.000Z 2025-08-19T00:00:00.000Z\ +\t\tAndreas Hartig https://hartiga.de/azure Azure Arc Jumpstart https://www.youtube.com/@azurearcjumpstart Manfred Helber https://www.manfredhelber.de Alexander Ortha Alexander Ortha – + Azure Local – IaC – AVD – Azure DevOps – Configuring the first pipeline file https://chkja.dk/blog/wp/azure-local-iac-avd-azure-devops-configuring-the-first-pipeline-file/ 2025-08-12T00:00:00.000Z 2025-08-12T00:00:00.000Z\ +\t\tThis article is part of a serie. You can navigate to the main page using this link: Intro This guide walks you through how to configure an Azure DevOps Build Pipeline including: Cl + Azure Local – IaC – AVD (Series) https://chkja.dk/blog/wp/azure-local-iac-avd-series/ 2025-08-04T00:00:00.000Z 2025-08-04T00:00:00.000Z\ +\t\tModernizing Azure Virtual Desktop Deployments with Azure Local and Infrastructure as Code As cloud environments evolve, so do the tools and strategies we use to manage them. Azure + Azure Local – IaC – AVD – Azure DevOps – Service Connections https://chkja.dk/blog/wp/azure-local-iac-avd-azure-devops-service-connections/ 2025-08-04T00:00:00.000Z 2025-08-04T00:00:00.000Z\ +\t\tIntro This article is part of a serie. You can navigate to the main page using this link: This guide walks you through how to configure an Azure DevOps Service Connection using Fed + Azure Local – Azure Virtual Desktop – Image disk shrink https://chkja.dk/blog/wp/azure-local-azure-virtual-desktop-image-disk-shrink/ 2025-07-22T00:00:00.000Z 2025-07-22T00:00:00.000Z\ +\t\tAll credits go to Bernhard Frank that have written this script (and others, check out his GitHub repo). This script can be used to shrink the disk of an image that has been downloa + Azure Local – Attestation – Benefits https://chkja.dk/blog/wp/azure-local-attestation-benefits/ 2025-07-10T00:00:00.000Z 2025-07-10T00:00:00.000Z\ +\t\tIn earlier version of Azure Local (Azure Stack HCI 22H2 and earlier) we had to add a separate network adapter to all virtual machines in our stack that should be covered by Azure b + Azure Local – Azure Arc not installed error https://chkja.dk/blog/wp/azure-local-azure-arc-not-installed-error/ 2025-07-10T00:00:00.000Z 2025-07-10T00:00:00.000Z\ +\t\tSource: https://learn.microsoft.com/en-us/previous-versions/azure/azure-local/deploy/troubleshoot-hci-registration If you see that one of your nodes in Azure Local shows as “Not in + Azure Local – Custom Images – Deploy image from compute gallery https://chkja.dk/blog/wp/azure-local-custom-images-deploy-image-from-compute-gallery/ 2025-07-10T00:00:00.000Z 2025-07-10T00:00:00.000Z\ +\t\tIntro In the previous post I created a compute gallery and used custom image builder to prepare my image. Now I want to deploy the image to Azure Local from this compute gallery. T + Azure Local – Custom Images – Compute Gallery and Image Builder https://chkja.dk/blog/wp/azure-local-custom-images-compute-gallery-and-image-builder/ 2025-07-06T00:00:00.000Z 2025-07-06T00:00:00.000Z\ +\t\tThis is the first part of an article series. In this post we will be deploying a compute gallery and image builder config. Compute Image Gallery Use this Bicep template to deploy t + Azure Local – Custom Images https://chkja.dk/blog/wp/azure-local-custom-images/ 2025-07-06T00:00:00.000Z 2025-07-06T00:00:00.000Z\ +\t\tIn this article I wanted to touch on custom images for Azure Local. I have worked alot with Azure Virtual Desktop where images are a vital part of sucessful deployments. So how abo + Azure Local – Failover cluster – Storage Space Direct – Reinstall node in cluster https://chkja.dk/blog/wp/azure-local-failover-cluster-storage-space-direct-reinstall-node-in-cluster/ 2025-06-19T00:00:00.000Z 2025-06-19T00:00:00.000Z\ +\t\tApplies to: Azure Local 21H2, 22H2 (And 23H2 and newer if repair-node does not work) – Windows Server with failover cluster and Storage Space Direct (S2D) I had a case where I need + Azure Local – Failover cluster – Storage Space Direct – The device does not recognize the command https://chkja.dk/blog/wp/azure-local-failover-cluster-storage-space-direct-the-device-does-not-recognize-the-command/ 2025-06-18T00:00:00.000Z 2025-06-18T00:00:00.000Z\ +\t\tEvent Log: SystemEvent ID: 1793Error: 0x16Hint: SyncPoolFailureApplies to: Azure Local 22H2, Azure Local 23H2, Azure Local 24H2, Azure Local (future releases), Windows Server Failo + Active Directory – The Kerberos client received a KRB_AP_ERR_MODIFIED error – RC4 hardening misconfiguration https://chkja.dk/blog/wp/active-directory-the-kerberos-client-received-a-krb_ap_err_modified-error-rc4-hardening-misconfiguration/ 2025-06-06T00:00:00.000Z 2025-06-06T00:00:00.000Z\ +\t\tIntro I was working together with Microsoft support on a customers Active Directory, where users was unable to authenticate towards DFS namespaces, applications and SQL server serv + Azure Local – Windows Admin Center (Preview) – Azure Portal – Howto and troubleshooting https://chkja.dk/blog/wp/azure-local-windows-admin-center-preview-azure-portal-howto-and-troubleshooting/ 2025-05-24T00:00:00.000Z 2025-05-24T00:00:00.000Z\ +\t\tMicrosoft have a complete guide on how to deploy Windows Admin Center from Azure Portal (still in preview), to Azure Local stack. It can be found here: Manage Azure Local clusters + Azure Local – Network ATC – Stuck in validation mode https://chkja.dk/blog/wp/azure-local-network-atc-stuck-in-validation-mode/ 2025-05-20T00:00:00.000Z 2025-05-20T00:00:00.000Z\ +\t\tSource article: https://learn.microsoft.com/en-us/powershell/module/networkatc/update-networkatc?view=windowsserver2025-ps I have worked with a customer that was upgraded from Azur + Azure Local – Create Network ATC Intent https://chkja.dk/blog/wp/azure-local-create-network-atc-intent/ 2025-05-18T00:00:00.000Z 2025-05-18T00:00:00.000Z\ +\t\tTo create a Network ATC Intent via PowerShell (either for the first time, doing upgrade from 22H2 til 23H2 where Network ATC was not configured, or doing troubleshooting), we can c + Azure Local – Lenovo – Firmware and driver patching https://chkja.dk/blog/wp/azure-local-lenovo-firmware-and-driver-patching/ 2025-05-10T00:00:00.000Z 2025-05-10T00:00:00.000Z\ +\t\tIntro It is VERY important to keep physical nodes in an Azure Local Stack up to date with the latest firmware and driver patches. Failing to do so, can lead to network and storage + Azure Local – Recreate VM switch for Network ATC Intent https://chkja.dk/blog/wp/azure-local-recreate-vm-switch-for-network-atc-intent/ 2025-05-03T00:00:00.000Z 2025-05-03T00:00:00.000Z\ +\t\tThis article contains commands for recreating a VM switch with VM Switch Embedded Team for the Converged Switch for management and compute. This assumes that management and compute + Email Communication with Azure Communication Services https://chkja.dk/blog/wp/email-communication-with-azure-communication-services/ 2025-04-30T00:00:00.000Z 2025-04-30T00:00:00.000Z\ +\t\tIntro Sending emails from an application can be very useful. There are also other scenarios where Azure Communication Services can be very useful to implement, e.g. when moving fro + Microsoft Global Secure Access – Private Access – Part 2 – Deploy client software https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-2-deploy-client-software/ 2025-04-22T00:00:00.000Z 2025-04-22T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect Intro Below I have highlighed some crusial t + Microsoft Global Secure Access – Private Access – Part 3 – Configure target application https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-3-configure-target-application/ 2025-04-22T00:00:00.000Z 2025-04-22T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect Configure your first application Once the in + Microsoft Global Secure Access – Private Access – Part 4 – Test configuration and target application https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-4-test-configuration-and-target-application/ 2025-04-22T00:00:00.000Z 2025-04-22T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect Intro I have created an Entra ID joined VM i + Microsoft Global Secure Access – Private Access – Part 5 – Bypass GSA on local corporate network with direct access to target applications https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-5-bypass-gsa-on-local-corporate-network-with-direct-access-to-target-applications/ 2025-04-22T00:00:00.000Z 2025-04-22T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect Intro Global Secure Access protects applicat + Microsoft Global Secure Access – Private Access – Part 6 – Additional Conditional Access Policies https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-6-additional-conditional-access-policies/ 2025-04-22T00:00:00.000Z 2025-04-22T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect Intro Target applications are subject to the + Microsoft Global Secure Access – Private Access – Part 1 – Initial configuration https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access-part-1-initial-configuration/ 2025-04-18T00:00:00.000Z 2025-04-18T00:00:00.000Z\ +\t\tThis article is part of a series: Microsoft Global Secure Access – Private Access – Christoffer Klarskov Jakobsen – Microsoft Architect To get started using Private Access within G + Microsoft Global Secure Access – Private Access https://chkja.dk/blog/wp/microsoft-global-secure-access-private-access/ 2025-04-18T00:00:00.000Z 2025-04-18T00:00:00.000Z\ +\t\tThis will be a series of articles about Microsoft Global Secure Access and specifically Private Access (also called Private Access Profile). Licensing overview Prerequisite to use + Azure subscriptions – limit and monitor Pay-as-you-go subscription https://chkja.dk/blog/wp/azure-subscriptions-limit-and-monitor-pay-as-you-go-subscription/ 2025-04-15T00:00:00.000Z 2025-04-15T00:00:00.000Z\ +\t\tIntro There is not direct way to deny administrators the ability to create free trial, Pay-as-you-go and Azure for Students subscriptions in Azure. However their are a few ways to + SharePoint Online – Get Site URL even if Get-MgReportSharePointSiteUsageDetail is not working https://chkja.dk/blog/wp/sharepoint-online-get-site-url-even-if-get-mgreportsharepointsiteusagedetail-is-not-working/ 2025-04-10T00:00:00.000Z 2025-04-10T00:00:00.000Z\ +\t\tMicrosoft have had an issue for over 1,5 years now, then admins wants to use the Get-MgReportSharePointSiteUsageDetail from Graph API to get info about all SharePoint sites within + Create PIM group for Entra Roles – Visible Assignments https://chkja.dk/blog/wp/create-pim-group-for-entra-roles-visible-assignments/ 2025-03-26T00:00:00.000Z 2025-03-26T00:00:00.000Z\ +\t\tDescription This guide will walk through the proces of creating a security Group combined with a PIM enabled group that will give members eligility to elevate and become User Admin + SharePoint Online – Get tenant storage usage with PowerShell and MgGraph cmdlets https://chkja.dk/blog/wp/sharepoint-online-get-tenant-storage-usage-with-powershell-and-mggraph-cmdlets/ 2025-03-17T00:00:00.000Z 2025-03-17T00:00:00.000Z\ +\t\tI was working on a Microsoft 365 tenant report and had used PowerShell PnP module. But since getting info about total storage capacity within the tenant requires write permissions + Identity Governance – Lifecycle Workflows – Hybrid domain https://chkja.dk/blog/wp/identity-governance-lifecycle-workflows-hybrid-domain/ 2025-03-16T00:00:00.000Z 2025-03-16T00:00:00.000Z\ +\t\tIn my previous blog posts, I was looking into the newer Microsoft Entra Cloud Sync and how to configure it. For customers that have removed tier 2 devices that was hybrid joined,sw + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 4 – Configure Entra ID to Active Directory Sync https://chkja.dk/blog/wp/configure-entra-id-to-active-directory-sync/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect Create a new sync configuration, from + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 3 – Configure Active Directory to Entra ID sync https://chkja.dk/blog/wp/configure-active-directory-to-entra-id-sync/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect In cloud sync, chose to setup new con + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 5 – How to create groups in Entra ID https://chkja.dk/blog/wp/how-to-create-groups-in-entra-id/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect You create groups in Entra ID the nor + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 6 – How to create users in Entra ID and sync to Active Directory https://chkja.dk/blog/wp/how-to-create-users-in-entra-id-and-sync-to-active-directory/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect Since you can actually not have users + Entra Cloud Sync – Lightweight Agent – Cloud Managed https://chkja.dk/blog/wp/entra-cloud-sync-lightweight-agent-cloud-managed/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTable of Sub-pages This series of articles go through the configuration steps to configure Active Directory to Entra ID Sync, and from Entra ID to Active Directory. Cloud Sync is t + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 1 – Install Agents https://chkja.dk/blog/wp/install-agents/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect ImportantYou should install the agent + Entra Cloud Sync – Lightweight Agent – Cloud Managed – Part 2 -On-demand provisioning https://chkja.dk/blog/wp/on-demand-provisioning/ 2025-03-15T00:00:00.000Z 2025-03-15T00:00:00.000Z\ +\t\tTHIS ARTICLE IS PART OF THE SERIES: Entra Cloud Sync – Lightweight Agent – Cloud Managed – Christoffer Klarskov Jakobsen – Microsoft Architect This section is to ensure one underst + Microsoft Entra Domain Services – Tiering – Preventing lateral movement https://chkja.dk/blog/wp/microsoft-entra-domain-services-tiering-preventing-lateral-movement/ 2025-03-12T00:00:00.000Z 2025-03-12T00:00:00.000Z\ +\t\tIntro Implementing 3 tiers in Microsoft Entra Domain Services will greatly enhance the security posture of the domain, and minimize risk of hackers being able to traverse the domai + Azure Virtual Desktop – Enable location Services redirection https://chkja.dk/blog/wp/azure-virtual-desktop-enable-location-services-redirection/ 2025-03-06T00:00:00.000Z 2025-03-06T00:00:00.000Z\ +\t\tEnabling location services for users on Azure Virtual Desktop (AVD) can significantly enhance the user experience and improve the functionality of certain applications. Here’s a de + How to fix common Sysprep issues when capturing AVD Golden Image https://chkja.dk/blog/wp/how-to-fix-common-sysprep-issues-when-capturing-avd-golden-image/ 2025-03-02T00:00:00.000Z 2025-03-02T00:00:00.000Z\ +\t\tIf Azure Devops pipeline for capture of new image version from golden image VM fails, and the failed pipeline is caused by failing “VM Sealing” (also called sysprep), most likely i + Microsoft Teams on AVD – Fix Meeting Add-in https://chkja.dk/blog/wp/microsoft-teams-on-avd-fix-meeting-add-in/ 2025-02-15T00:00:00.000Z 2025-02-15T00:00:00.000Z\ +\t\tIntro Microsoft Teams is a great app for collaboration. On VDI systems like AVD however, it can be a challenge to install and present to users without any issues. This article is a + Prevent sign-in consent prompt on Azure Virtual Desktop (AVD) https://chkja.dk/blog/wp/prevent-sign-in-consent-prompt-on-azure-virtual-desktop-avd/ 2025-02-14T00:00:00.000Z 2025-02-14T00:00:00.000Z\ +\t\tBefore you begin If you have hybrid joined session hosts, remember to first setup SSO using this guide:Azure Virtual Desktop – Entra ID SSO – Complete Guide – Christoffer Klarskov + Exchange Hybrid Migration Cheat Sheet https://chkja.dk/blog/wp/exchange-hybrid-migration-cheat-sheet/ 2025-02-06T00:00:00.000Z 2025-02-06T00:00:00.000Z\ +\t\tDesign It is recommended to create a new Exchange server that is not hosting any databases and mailboxes. This new Exchange server is configured as endpoint for the Hybrid Configur + Physical Data Locations – Microsoft 365 https://chkja.dk/blog/wp/physical-data-locations-microsoft-365/ 2025-01-29T00:00:00.000Z 2025-01-29T00:00:00.000Z\ +\t\tIntro Data within a Microsoft 365 tenant can be placed several places and for a customer it can be challenging to know where data is physically stored. Whenever the abbreviation EU + Password Protection Policy – Hybrid mode to on-premise AD https://chkja.dk/blog/wp/password-protection-policy-hybrid-mode-to-on-premise-ad/ 2025-01-22T00:00:00.000Z 2025-01-22T00:00:00.000Z\ +\t\tSource: Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn Huge credits to Ali Tajran: Configure Microsoft Entra Password Protection for on-premises – ALI T + Password Protection Policy – Custom Banned Passwords List https://chkja.dk/blog/wp/password-protection-policy-custom-banned-passwords-list/ 2025-01-22T00:00:00.000Z 2025-01-22T00:00:00.000Z\ +\t\tSource: Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn CHECK OUT MY OTHER ENTRA ID PASSWORD PROTECTION GUIDE ON HOW TO DEPLOY TO LEGACY ACTIVE DIRECTORY + RDP to Entra ID Joined VM (Workaround then Azure Bastion is not possible to deploy) https://chkja.dk/blog/wp/rdp-to-entra-id-joined-vm-workaround-then-azure-bastion-is-not-possible-to-deploy/ 2025-01-15T00:00:00.000Z 2025-01-15T00:00:00.000Z\ +\t\tWindows server 2025 (and earlier) comes with the feature of being Entra ID joined.In Azure, this is very easy and can be done then deploying, or later by installation the AADLoginF + Entra ID – Passwordless Configuration – Basic https://chkja.dk/blog/wp/entra-id-passwordless-configuration-basic/ 2025-01-07T00:00:00.000Z 2025-01-07T00:00:00.000Z\ +\t\tIntro This guide is devided into two phases. One phase is about preparing the customer’s Microsoft 365 Entra ID to support passwordless implementation.The other phase is about crea + Inbound SMTP DANE with DNSSEC in Exchange Online https://chkja.dk/blog/wp/inbound-smtp-dane-with-dnssec-in-exchange-online/ 2024-11-02T00:00:00.000Z 2024-11-02T00:00:00.000Z\ +\t\tIntro This guide expains how to enable Inbound SMTP DANE with DNSSEC in your customers tenant.Domains to be configured for this, will be domains present in your customers tenant. V + Azure Virtual Deskop – AppAttach and MSIX AppAttach https://chkja.dk/blog/wp/azure-virtual-deskop-appattach-and-msix-appattach/ 2024-10-16T00:00:00.000Z 2024-10-16T00:00:00.000Z\ +\t\tPublished: 24th October 2024.Updated: 03th May 2025. Intro IMPORTANT INFO: Micrcosoft have deprecated MSIX AppAttach in May 2025. Microsoft provided a migration script to migrate f + Windows Hello for Business Cloud Kerberos Trust https://chkja.dk/blog/wp/windows-hello-for-business-cloud-kerberos-trust/ 2024-09-22T00:00:00.000Z 2024-09-22T00:00:00.000Z\ +\t\tPrerequisites and Requirements Link to full Microsoft article: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/#windows-server-requ + Move on from Exchange Online SMTP Basic Authentication with Client Submission https://chkja.dk/blog/wp/move-on-from-exchange-online-smtp-basic-authentication-with-client-submission/ 2024-09-09T00:00:00.000Z 2024-09-09T00:00:00.000Z\ +\t\tIntro Link to full Microsoft article:https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-online-to-retire-basic-auth-for-client-submission-smtp/ba-p/4114750 Microsof + Microsoft Defender for Endpoint – Use Microsoft Security API to export inventory https://chkja.dk/blog/wp/microsoft-defender-for-endpoint-use-microsoft-security-api-to-export-inventory/ 2024-08-07T00:00:00.000Z 2024-08-07T00:00:00.000Z\ +\t\tIntro This guide will assist in the proces of exporting inventory from Defender for Endpoint. This export will both export servers and clients that are registrered in Defender for + Azure Bastion https://chkja.dk/blog/wp/azure-bastion/ 2024-07-14T00:00:00.000Z 2024-07-14T00:00:00.000Z\ +\t\tDeploy Azure Bastion to subscription No hassle of managing Network Security Groups (NSGs)You don’t need to apply any NSGs to the Azure Bastion subnet. Because Azure Bastion connect + Create custom Privileged Identity Management (PIM) group with approver https://chkja.dk/blog/wp/create-custom-privileged-identity-management-pim-group-with-approver/ 2024-07-07T00:00:00.000Z 2024-07-07T00:00:00.000Z\ +\t\tDescription This guide will walk through the proces of creating custom PIM group that will give members eligility to elevate and become global admin. This guide will also outline h + Manage emergency access accounts in Microsoft Entra ID (Break glass) https://chkja.dk/blog/wp/manage-emergency-access-accounts-in-microsoft-entra-id-break-glass/ 2024-06-30T00:00:00.000Z 2024-06-30T00:00:00.000Z\ +\t\tMicrosoft Learn source article: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access This guide was originally written as an interna + Require Multifactor Authentication to register or join devices with Microsoft Entra https://chkja.dk/blog/wp/require-multifactor-authentication-to-register-or-join-devices-with-microsoft-entra/ 2024-06-27T00:00:00.000Z 2024-06-27T00:00:00.000Z\ +\t\tIn Entra ID under Devices, All Devices and then Device Settings, you can enable: Require Multifactor Authentication to register or join devices with Microsoft Entra. However Micros + Migration to Converged Authentication Methods https://chkja.dk/blog/wp/migration-to-converged-authentication-methods/ 2024-06-23T00:00:00.000Z 2024-06-23T00:00:00.000Z\ +\t\tIntro This guide will assist in the proces of migrating from legacy MFA and legacy SSPR, to the new converged authentication methods. On September 30th, 2025, the legacy multifacto + Azcopy https://chkja.dk/blog/wp/azcopy/ 2024-06-23T00:00:00.000Z 2024-06-23T00:00:00.000Z\ +\t\tTo copy data to or from an Azure Storage Account (General-purpose V2 Block Blob), use this guide to understand and perform the copy. ImportantIf you need to share the generated SAS + Robocopy https://chkja.dk/blog/wp/robocopy/ 2024-06-23T00:00:00.000Z 2024-06-23T00:00:00.000Z\ +\t\tRobocopy is a great tool for copying and syncing data between source and destination (and vice-versa).Here you can find both general knowledge about the tool and few examples on ho +