# CloudGuru Practical guides for cloud and identity engineers. ## Site navigation - [Articles](https://learncloud.guru/blog) - [Topics](https://learncloud.guru/topics) - [PAW role planner](https://learncloud.guru/paw) - [Sitemap](https://learncloud.guru/sitemap.xml) - [RSS](https://learncloud.guru/feed.xml) ## Privileged Access Workstation research - [What is a Privileged Access Workstation?](https://learncloud.guru/paw/what-is-a-privileged-access-workstation): The purpose, trust boundary, and practical value of a dedicated device for high-impact administration. - [Which roles need a PAW? Build a role-based access model](https://learncloud.guru/paw/paw-roles-and-access-model): How to prioritize identities, separate daily and administrative work, and avoid giving every administrator the same level of access. - [PAW controls: from a good idea to an enforceable design](https://learncloud.guru/paw/paw-controls-and-rollout): A practical control stack for devices, identities, applications, rollout, and evidence that the design works. - [Operating a PAW: tests, evidence, and exceptions](https://learncloud.guru/paw/paw-validation-and-operations): How I would prove the protected path works after rollout and keep it useful as roles, devices, and tools change. ## Published articles - [Building a Unified AI Gateway with OmniRoute, Ollama, Cloudflare and Nginx Proxy Manager](https://learncloud.guru/blog/building-a-unified-ai-gateway-with-omniroute-ollama-cloudflare-and-nginx-proxy-manager) | [plain text](https://learncloud.guru/blog/building-a-unified-ai-gateway-with-omniroute-ollama-cloudflare-and-nginx-proxy-manager/content.txt): From Local Ollama Models to a Public OpenAI-Compatible API Running multiple AI models locally is becoming increasingly practical. With Ollama, you can run models such as Llama, Qwen, and DeepSeek on your own hardware. At the same time, cloud providers such as Anthropic, OpenAI, and Google provide access to much larger hosted models. The problem … - [The 4 Critical Entra ID Policies to Deploy Today (with Terraform)](https://learncloud.guru/blog/the-4-critical-entra-id-policies-to-deploy-today-with-terraform) | [plain text](https://learncloud.guru/blog/the-4-critical-entra-id-policies-to-deploy-today-with-terraform/content.txt): If you’re managing Entra ID (Azure AD), you’re facing constant attacks. The single most effective way to protect your tenant is with Conditional Access. But don’t just click around in the portal-deploy your security as code. We’ll build a simple, modular, and production-ready Terraform framework to deploy this “Top 4” set. The “Top 4” Critical … - [How to Permanently Disable Windows Defender on Windows 11](https://learncloud.guru/blog/how-to-permanently-disable-windows-defender-on-windows-11) | [plain text](https://learncloud.guru/blog/how-to-permanently-disable-windows-defender-on-windows-11/content.txt): Disabling Windows Defender (now called Microsoft Defender Antivirus) may be necessary for developers, software testers, or IT professionals. Deactivation allows for testing applications without interference or for installing a third-party antivirus solution. Important: Disabling Defender leaves a system unprotected. Always re-enable security features after testing to protect against viruses and malware. When Should You Disable Defender? … - [CVE-2025-55241 (Actor Token / Entra ID) - What You Need to Know](https://learncloud.guru/blog/cve-2025-55241-actor-token-entra-id-what-you-need-to-know) | [plain text](https://learncloud.guru/blog/cve-2025-55241-actor-token-entra-id-what-you-need-to-know/content.txt): Introduction A critical flaw in Microsoft Entra ID (formerly Azure Active Directory) - CVE-2025-55241 - reminds us how fragile cloud identity can be when legacy token flows linger. While Microsoft has already patched the issue, the lessons go far beyond a single CVE. At Terait, we help organizations secure Entra ID and Azure identity services. … - [How to Access Vaultwarden via a Custom Domain on CyberPanel (with SSL)](https://learncloud.guru/blog/how-to-access-vaultwarden-via-a-custom-domain-on-cyberpanel-with-ssl) | [plain text](https://learncloud.guru/blog/how-to-access-vaultwarden-via-a-custom-domain-on-cyberpanel-with-ssl/content.txt): If you’ve deployed Vaultwarden in Docker and want to access it securely via a custom domain (like vault.yourdomain.com) instead of an IP and port, this step-by-step guide will help you achieve it using CyberPanel and OpenLiteSpeed. In this tutorial, I’ll show you how to expose Vaultwarden (running on http://<server-ip>:8062) under a subdomain with SSL encryption. … - [Crafting a Robust Naming Convention in Microsoft Entra ID](https://learncloud.guru/blog/crafting-a-robust-naming-convention-in-microsoft-entra-id) | [plain text](https://learncloud.guru/blog/crafting-a-robust-naming-convention-in-microsoft-entra-id/content.txt): In today’s rapidly evolving digital landscape, a sound identity governance strategy is paramount. Central to this strategy is a clear and consistent naming convention for Microsoft Entra ID (formerly Azure Active Directory) objects-ranging from Security Groups and Conditional Access Policies to Applications and Administrative Units. A well-designed naming convention ensures discoverability, automation readiness, security compliance, … - [A Detailed Guide to Locating and Reviewing Logs for Azure Update Manager](https://learncloud.guru/blog/a-detailed-guide-to-locating-and-reviewing-logs-for-azure-update-manager) | [plain text](https://learncloud.guru/blog/a-detailed-guide-to-locating-and-reviewing-logs-for-azure-update-manager/content.txt): When troubleshooting patching issues or assessing update compliance, finding the right log files is critical. The logs provide insights into agent activities, patch assessments, and update installations. This guide covers the various log locations depending on whether you’re working with Azure VMs or Azure Arc‑enabled servers, and explains how to query centralized update assessment results. … - [Access Review vs. Access Package in Microsoft Entra ID: Key Differences and Use Cases](https://learncloud.guru/blog/access-review-vs-access-package-in-microsoft-entra-id-key-differences-and-use-cases) | [plain text](https://learncloud.guru/blog/access-review-vs-access-package-in-microsoft-entra-id-key-differences-and-use-cases/content.txt): Introduction Managing access to resources in any organization is crucial for security, compliance, and operational efficiency. Microsoft Entra ID (formerly Azure AD) provides governance features to help organizations control who has access to what and ensure that access is granted appropriately. Two key features that help with access management are: Although both play a role … - [Managing Enterprise App Registrations in Entra ID](https://learncloud.guru/blog/managing-enterprise-app-registrations-in-entra-id) | [plain text](https://learncloud.guru/blog/managing-enterprise-app-registrations-in-entra-id/content.txt): Why Do You Need This Script? Organizations register applications in Entra ID to authenticate users and grant access to Microsoft services. However, some apps:🔹 Lose valid secrets or certificates and stop working🔹 Remain unused for long periods but retain permissions🔹 Can be exploited if left unmanaged IT administrators need to identify unused applications and those … - [Managing Guest Users in Entra ID with PowerShell](https://learncloud.guru/blog/managing-guest-users-in-entra-id-with-powershell) | [plain text](https://learncloud.guru/blog/managing-guest-users-in-entra-id-with-powershell/content.txt): Why Do You Need This Script? Guest users in Entra ID (formerly Azure AD) are external users invited to collaborate within an organization. However, many guests:🔹 Never accept their invitations🔹 Stop using their accounts after a period of time🔹 Pose a security risk if their access isn’t revoked To maintain security and compliance, IT administrators … - [Azure Alerts vs. Action Rules (Processing Rules): What’s the Difference?](https://learncloud.guru/blog/azure-alerts-vs-action-rules-processing-rules-whats-the-difference) | [plain text](https://learncloud.guru/blog/azure-alerts-vs-action-rules-processing-rules-whats-the-difference/content.txt): When it comes to monitoring and managing your Azure resources, Azure Alerts and Action Rules (formerly known as Processing Rules) are two powerful tools in Azure Monitor. While they both play a role in alert management, they serve different purposes and operate at different stages of the alert lifecycle. Let’s break down the differences and when to use each. … - [PowerShell Script to Export Users’ Last Password Reset Dates to CSV](https://learncloud.guru/blog/powershell-script-to-export-users-last-password-reset-dates-to-csv) | [plain text](https://learncloud.guru/blog/powershell-script-to-export-users-last-password-reset-dates-to-csv/content.txt): If you need to export the list of users in your Active Directory along with their last password reset or update date, here’s a simple PowerShell script that will help you achieve that. The script retrieves the PasswordLastSet property for all users and exports the results into a CSV file for easy analysis. PowerShell Script: … - [PowerShell Script Logging and Debugging: A Comprehensive Guide](https://learncloud.guru/blog/powershell-script-logging-and-debugging-a-comprehensive-guide) | [plain text](https://learncloud.guru/blog/powershell-script-logging-and-debugging-a-comprehensive-guide/content.txt): If you’re working on a PowerShell script and want to log all activities or debug it effectively, here’s a detailed guide to help you. This post will cover how to enable verbose output, handle errors, and implement global settings to streamline your debugging process. Enable Verbose Output PowerShell provides a built-in verbose stream for detailed … - [Guide on Configuring Prometheus Blackbox Exporter and Grafana](https://learncloud.guru/blog/guide-on-configuring-prometheus-blackbox-exporter-and-grafana) | [plain text](https://learncloud.guru/blog/guide-on-configuring-prometheus-blackbox-exporter-and-grafana/content.txt): The Prometheus Blackbox Exporter is a flexible and powerful tool used to monitor endpoints over various protocols such as HTTP, HTTPS, TCP, and ICMP (ping). This guide will walk you through everything you need to know about setting up and configuring the Blackbox Exporter with Prometheus, including writing configurations, setting up Docker Compose, and using … - [Elevate Security: Configuring FIDO2 Security Keys as the Default Login Option for Windows Devices](https://learncloud.guru/blog/elevate-security-configuring-fido2-security-keys-as-the-default-login-option-for-windows-devices) | [plain text](https://learncloud.guru/blog/elevate-security-configuring-fido2-security-keys-as-the-default-login-option-for-windows-devices/content.txt): As organizations embrace the transition to passwordless authentication, FIDO2 security keys have emerged as a robust, user-friendly solution. These keys not only enhance security but also streamline the login experience for end-users. This guide explores how to configure FIDO2 security keys as the default login option for Windows devices, utilizing Microsoft Intune to simplify deployment and management. Why Choose … - [How to Install DietPi on Proxmox Server: A Step-by-Step Guide](https://learncloud.guru/blog/how-to-install-dietpi-on-proxmox-server-a-step-by-step-guide) | [plain text](https://learncloud.guru/blog/how-to-install-dietpi-on-proxmox-server-a-step-by-step-guide/content.txt): If you’re looking to run DietPi on your Proxmox server, you’re in the right place! This lightweight, optimized Linux distribution is perfect for a range of applications and is easy to set up on Proxmox. In this guide, we’ll walk you through downloading the DietPi image, decompressing it, and configuring it as a virtual machine … - [Setting up the Microsoft Entra Connect Health Agent on multiple servers.](https://learncloud.guru/blog/3385-2) | [plain text](https://learncloud.guru/blog/3385-2/content.txt): Step 1: Create a Dedicated User Account in Microsoft Entra ID Step 2: Download the Health Agent Setup Step 3: Run PowerShell Script to Install and Register the Health Agent Use the following PowerShell script to silently install and register the health agent on multiple servers. You’ll use PowerShell Remoting (Invoke-Command) to perform this on … - [How to Check and Update Azure VM Extensions for the Azure Monitor Agent](https://learncloud.guru/blog/how-to-check-and-update-azure-vm-extensions-for-the-azure-monitor-agent) | [plain text](https://learncloud.guru/blog/how-to-check-and-update-azure-vm-extensions-for-the-azure-monitor-agent/content.txt): If you’re working with Azure VM extensions like the Azure Monitor Agent and want to ensure your extensions are up-to-date, here’s a quick guide on verifying the current version and updating to the latest. Step 1: Check the Current Version of the VM Extension You can check which version of an extension is installed on … - [Azure AD or Entra ID Connect Configuration Documenter](https://learncloud.guru/blog/azure-ad-or-entra-id-connect-configuration-documenter) | [plain text](https://learncloud.guru/blog/azure-ad-or-entra-id-connect-configuration-documenter/content.txt): In today’s post, I’ll explain how to use the Azure AD or Entra ID Connect Configuration Documenter to compare configurations between two Azure AD Connect servers. This tool is valuable for documenting, troubleshooting, and ensuring configuration consistency in environments that use Azure AD Connect for identity synchronization. The Azure AD Connect Configuration Documenter is a … - [How to Install Entra ID Connect using Interactive Authentication Mode](https://learncloud.guru/blog/how-to-install-entra-id-connect-using-interactive-authentication-mode) | [plain text](https://learncloud.guru/blog/how-to-install-entra-id-connect-using-interactive-authentication-mode/content.txt): Entra ID Connect (formerly Azure AD Connect) helps you sync on-premises identities with Entra ID (Azure Active Directory), providing a seamless sign-in experience for users. Below is a step-by-step guide on how to install Entra ID Connect using Interactive Authentication mode. Step 1: Open Command Prompt as Administrator First, open a command prompt with elevated … - [PowerShell script that provides two main options for setting up a Kerberos Server object](https://learncloud.guru/blog/powershell-script-that-provides-two-main-options-for-setting-up-a-kerberos-server-object) | [plain text](https://learncloud.guru/blog/powershell-script-that-provides-two-main-options-for-setting-up-a-kerberos-server-object/content.txt): Below is a streamlined PowerShell script that provides two main options for setting up a Kerberos Server object in Active Directory and publishing it to Microsoft Entra ID. This approach simplifies the process by offering distinct choices, ensuring clarity and ease of use. Options: Prerequisites: Complete PowerShell Script Save the following script as Setup-EntraIDKerberosServer.ps1: <#.SYNOPSIS … - [Cloud Kerberos Trust for Windows Hello for Business : A Step-by-Step Guide](https://learncloud.guru/blog/how-to-set-up-and-configure-whfb-cloud-trust-deployment-a-step-by-step-guide) | [plain text](https://learncloud.guru/blog/how-to-set-up-and-configure-whfb-cloud-trust-deployment-a-step-by-step-guide/content.txt): In today’s world, securing access to corporate devices is more crucial than ever. Windows Hello for Business provides an advanced and user-friendly solution to enhance security through biometrics like facial recognition, fingerprint, or PIN-based authentication. In this post, I’ll guide you through setting up and configuring Windows Hello for Business for your organization. What is … - [Bulk assignment of an Access Package](https://learncloud.guru/blog/bulk-assignmnet-of-an-access-package) | [plain text](https://learncloud.guru/blog/bulk-assignmnet-of-an-access-package/content.txt): To assign an Access Package to 1,000 users in Azure Active Directory (Entra ID) using Entitlement Management in Azure Identity Governance, you can either use the Azure Portal or automate it via PowerShell or Microsoft Graph API, which is more efficient for large-scale assignments. Here are the steps for each method: Method 1: Using Azure … - [Automating User Photo Management in Microsoft Entra ID using Microsoft Graph API and PowerShell](https://learncloud.guru/blog/automating-user-photo-management-in-microsoft-entra-id-using-microsoft-graph-api-and-powershell) | [plain text](https://learncloud.guru/blog/automating-user-photo-management-in-microsoft-entra-id-using-microsoft-graph-api-and-powershell/content.txt): Managing user profile photos within Microsoft Entra ID (formerly Azure AD) can be tedious if done manually, especially for large organizations. In this post, I will walk you through automating two key tasks using PowerShell and the Microsoft Graph API: By the end of this guide, you’ll be able to retrieve all users, identify those … - [Managing TLS 1.2 on Microsoft Entra Connect: A Comprehensive PowerShell Script for Enable, Disable, Check, and Uninstall](https://learncloud.guru/blog/managing-tls-1-2-on-microsoft-entra-connect-a-comprehensive-powershell-script-for-enable-disable-check-and-uninstall) | [plain text](https://learncloud.guru/blog/managing-tls-1-2-on-microsoft-entra-connect-a-comprehensive-powershell-script-for-enable-disable-check-and-uninstall/content.txt): Here’s a PowerShell script that allows you to enable, check, disable, or uninstall TLS 1.2 on your Microsoft Entra Connect server. It prompts the user for an option and performs the corresponding action: Get-ADSyncToolsTls12RegValue { [CmdletBinding()] Param( [Parameter(Mandatory = $true, Position = 0)] [string]$RegPath, [Parameter(Mandatory = $true, Position = 1)] [string]$RegName ) $regItem = Get-ItemProperty … - [TLS 1.2 enforcement for Microsoft Entra Connect](https://learncloud.guru/blog/tls-1-2-enforcement-for-microsoft-entra-connect) | [plain text](https://learncloud.guru/blog/tls-1-2-enforcement-for-microsoft-entra-connect/content.txt): Enforcing TLS 1.2 in Microsoft Entra Connect involves configuring your server to use this secure communication protocol exclusively. This step is essential for environments using versions 2.3.20.0 or later of Microsoft Entra Connect, as these versions require TLS 1.2 for secure communication with Azure. Checking TLS 1.2 Configuration: Use the following PowerShell script to verify … - [Implement Multi-Factor Authentication (MFA)](https://learncloud.guru/blog/implement-multi-factor-authentication-mfa) | [plain text](https://learncloud.guru/blog/implement-multi-factor-authentication-mfa/content.txt): Convincing an organization to implement Multi-Factor Authentication (MFA) involves focusing on security, user experience, and compliance while addressing common concerns about cost, complexity, and user resistance. Below is a structured approach to convince and implement MFA within an organization: Step 1: Understand the Organizational Needs Before recommending MFA, assess the organization’s current environment: Step 2: … - [Implementing Privileged Identity Management (PIM)](https://learncloud.guru/blog/implementing-privileged-identity-management-pim) | [plain text](https://learncloud.guru/blog/implementing-privileged-identity-management-pim/content.txt): Implementing Privileged Identity Management (PIM) in an organization requires both technical justification and strategic communication to highlight the benefits. Convincing an organization to adopt PIM typically involves focusing on security, compliance, and operational efficiency while addressing potential concerns like costs and complexity. Here’s a structured approach to convincing and implementing PIM in an organization: Step … - [Remove a Domain from Azure AD Connect Sync](https://learncloud.guru/blog/remove-a-domain-from-azure-ad-connect-sync) | [plain text](https://learncloud.guru/blog/remove-a-domain-from-azure-ad-connect-sync/content.txt): In today’s post, I would like to explain how to properly remove a domain from the Azure AD Connect synchronization process without causing errors, such as the missing-partition-for-run-step error. Specifically, we’ll discuss removing contoso.com from the sync process in Azure AD Connect. Steps to Remove a Domain from Azure AD Connect Sync: Backup Configuration:Before making … - [PowerShell Script to Check TLS 1.2 and .NET Framework Version](https://learncloud.guru/blog/powershell-script-to-enable-and-verify-tls-1-2-and-check-net-framework-version) | [plain text](https://learncloud.guru/blog/powershell-script-to-enable-and-verify-tls-1-2-and-check-net-framework-version/content.txt): This PowerShell script allows you to check if TLS 1.2 is enabled on both the client and server, and also verifies that strong cryptography is enabled for the .NET Framework. Additionally, the script checks for the latest installed .NET Framework version on the system. Script Overview: PowerShell Script: # Define registry paths for .NET Framework … - [Steps to Enable TLS 1.2 on Windows](https://learncloud.guru/blog/steps-to-enable-tls-1-2-on-windows) | [plain text](https://learncloud.guru/blog/steps-to-enable-tls-1-2-on-windows/content.txt): 1. Modify the Registry to Enable TLS 1.2 TLS 1.2 must be enabled for both client and server components in the Windows registry. These components determine whether applications and services running on your system can use TLS 1.2. You can apply the following steps either manually through the Registry Editor or by running a PowerShell … - [Powershell Script to Enable TLS 1.2 for Server and Client in the registry](https://learncloud.guru/blog/powershell-script-to-enable-tls-1-2-for-server-and-client-in-the-registry) | [plain text](https://learncloud.guru/blog/powershell-script-to-enable-tls-1-2-for-server-and-client-in-the-registry/content.txt): What the Script Does: 1. Enable TLS 1.2 for the Server Side 2. Enable TLS 1.2 for the Client Side 3. Enable Strong Cryptography for .NET Framework 4. Output Confirmation Explanation of Registry Values: Conclusion: This script ensures that TLS 1.2 is enabled for both the client and server roles in Windows and configures the … - [Azure B2B (Business-to-Business) VS Entra ID Cross-Tenant Synchronization](https://learncloud.guru/blog/azure-b2b-business-to-business-vs-entra-id-cross-tenant-synchronization) | [plain text](https://learncloud.guru/blog/azure-b2b-business-to-business-vs-entra-id-cross-tenant-synchronization/content.txt): Azure B2B (Business-to-Business) and Entra ID Cross-Tenant Synchronization are both features related to managing identity and access across different organizations, but they serve different purposes and work in distinct ways. Here’s a breakdown of the differences: 1. Purpose: 2. User Experience: 3. Management: 4. Use Cases: 5. Security: Summary: - [Comparing On-Premises KMS with Azure KMS: A Shift to Simplified Windows Activation](https://learncloud.guru/blog/comparing-on-premises-kms-with-azure-kms-a-shift-to-simplified-windows-activation) | [plain text](https://learncloud.guru/blog/comparing-on-premises-kms-with-azure-kms-a-shift-to-simplified-windows-activation/content.txt): The main differences between the old KMS endpoint (used in on-premises environments) and the new KMS endpoint provided by Azure for activating Windows VMs are summarized below: 1. KMS Endpoint Location 2. Activation Process 3. Port Used 4. Responsibility and Maintenance Summary of Changes: These changes simplify the activation process, reduce the need for internal … - [SLIs, SLOs, SLAs, DevOps and SRE](https://learncloud.guru/blog/slis-slos-slas-devops-and-sre) | [plain text](https://learncloud.guru/blog/slis-slos-slas-devops-and-sre/content.txt): DevOps Earlier Dev and Operation teams used to work as silos. There used to be barriers between the Developers and Operations team. Developers used to focus on coding/testing the features where as operations focus on maintenance and stability. DevOps is a set up practices and culture to break this barrier. SRE Site Reliability Engineer. If DevOps … - [Agile Testing](https://learncloud.guru/blog/agile-testing) | [plain text](https://learncloud.guru/blog/agile-testing/content.txt): What is Agile? Agile project management is an iterative approach to managing software development projects that focuses on continuous releases and customer feedback and requirements keep changing as per the customer needs. What is Agile Testing? Its a software testing practice that follows principles of Agile software development. How Agile testing is different from the conventional waterfall … - [Agile Ceremonies Format and Sample Agenda](https://learncloud.guru/blog/agile-ceremonies-format-and-sample-agenda) | [plain text](https://learncloud.guru/blog/agile-ceremonies-format-and-sample-agenda/content.txt): 1. Daily StandupDaily Standups are not status meetings. Team swarms everyday and ensures the delivery. Links Daily-Standup Protocol: 2. Backlog Refinement: 1. Discuss the stories for next sprint including requirements/scope and architecture. a. Identify the dependencies b. Estimate the Story … - [Scrum Team Best Practices – Organization, Communication and Documentation](https://learncloud.guru/blog/scrum-team-best-practices-organization-communication-and-documentation) | [plain text](https://learncloud.guru/blog/scrum-team-best-practices-organization-communication-and-documentation/content.txt): Organization Communication Documentation Cite the canonical HTML URL and check the article date. Additional pages are listed in the sitemap.