Azure Application Gateway now supports TCP and TLS termination, enabling a single gateway to handle web and non‑HTTP traffic alike. This update simplifies architecture, centralises TLS management, and...

In this week's episode, we look at recent Microsoft Tech updates. By popular request, we're expanding the scope beyond just Azure to include Microsoft 365, Power Platform, and similar Microsoft platforms...

Introduction As organizations increasingly integrate AI into their applications, securing access to Azure OpenAI services becomes a critical priority. By...

A new HTTP/2 vulnerability, CVE-2025-8671 (MadeYouReset), was recently disclosed on August 13, 2025. This attack leverages carefully crafted protocol frames...

Azure Application Gateway provides layer 7 load balancing with integrated Web Application Firewall (WAF) capabilities, enabling traffic distribution across...

This week, we dive deep into security-focused updates from Microsoft. As we've done with more generic tech updates, this time we'll focus on the interesting security updates from Microsoft.(00:00) - Intro...

This post will take you one step further from the hello-world configuration that I described in the first post by adding TLS end-to-end, a scenario described in the public docs here. This blog is p…

Announcing the General Availability of custom block response code and body for WAF integrated with Application Gateway Azure WAF integrated with Application Gateway now supports customizable response status codes and bodies for blocked requests, enabling greater flexibility and control. By default, when the WAF blocks a request due to a matched rule, it returns a 403 status code with a "The request is blocked" message.

If you deploy Azure Application Gateway with minimum instances set to 0, don't expect the bill to come in at zero-cost. You're still paying a fixed hourly charge whether 0 or 100 instances are running. From a FinOps perspective, Application Gateway v2 (Standard_v2 and WAF_v2) has a dual-component billing model: - Component 1: Fixed hourly gateway charge. Billed 24/7 from the moment the gateway is provisioned, regardless of traffic, instance count, or autoscale settings. It's deployed with a minimum of two instances with automatic health monitoring and failover, independent of the autoscale minimum you set for capacity unit billing. - Component 2: Capacity unit (CU) hourly charge. A capacity unit is measured across three dimensions and billed on whichever is highest: 2,500 persistent connections, 2.22 Mbps throughput, or 1 compute unit. Compute unit capacity is SKU-dependent — roughly 50 TLS connections/second on Standard_v2, roughly 10 concurrent requests/second on WAF_v2. Setting minimum instances to 0 means you only pay CU costs when traffic is present. Where the real savings come from: - Minimum instances = 0: eliminates reserved CU costs. You pay CU costs only when traffic shows up. Fixed cost remains. - Minimum instances = 2: reserves 20 capacity units (2 instances × 10 CUs/instance) 24/7, billed regardless of traffic. That's significant variable cost on top of the always-on fixed cost. The recommended design: - Delete idle Application Gateways entirely. Zero traffic, 24/7 fixed charge, every hour. Redeploy from IaC when needed. - Minimum instances = 0 for non-production. You pay the fixed charge plus real traffic only. Trade-off: a spike takes 3–5 minutes to provision a new instance. - Minimum instances = 2 for production. Two warm instances, no cold start, immediate spike handling. The extra CU cost is the price of production readiness. - Pre-warm predictable spikes with Azure Automation. Application Gateway doesn't support scheduled autoscaling natively. If your traffic spikes weekday mornings and drops overnight, use an Automation runbook on a timer to raise the minimum before the spike and drop it after. The metrics to monitor: - Estimated Billed Capacity Units (what Azure is actually charging this hour) - Current Capacity Units (what traffic is actually using) - Fixed Billable Capacity Units (what your minimum instance setting reserves). If Fixed Billable Capacity Units are consistently higher than Current Capacity Units, you're paying for headroom nobody is using. #Azure #FinOps #ApplicationGateway #MVPbuzz

Learn how to configure Application Gateway with a frontend public IPv6 address.

The Layer 4 TCP/TLS Proxy capability in Azure Application Gateway expands ingress possibilities for organizations modernizing TCP-based workloads on...

🔍 What Is Private Application Gateway? Historically, Application Gateway v2 required a public IP address to communicate with the Azure control plane...

I’m writing this article to document a real-world scaling issue we hit while exposing many applications from an Azure Kubernetes Service (AKS) cluster using...

Introduction Azure Application Gateway for Containers is a managed Azure service designed to handle incoming traffic for container-based applications. It...

Learn how to enable and configure FIPS 140-2 compliance on Azure Application Gateway v2, including TLS policy restrictions, backend compatibility, and troubleshooting 502 errors.