Keep the prior Recovery Services encryption key available through rotation
When can the previous key version be retired after Recovery Services vault key autorotation?
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 99 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,777 articlesGuidance and analysis from DSE
Generate confidential-container enforcement policy through the supported tooling
Can a handwritten enforcement policy substitute for generated policy on confidential Azure Container Instances?
Read the guide
Treat a custom DDoS threshold as a replacement for that protocol's autotuning
Does a preview Azure DDoS custom threshold supplement or replace adaptive tuning?
Read the guide
Do not assume every Service Fabric node retains the same old certificates
Certificate rotation through the Key Vault VM extension can leave different certificate histories on existing and newly added nodes.
Read the guide
Fix the Site Recovery appliance's address choice before registration
Which appliance identity and installation choices should be settled before configuring modernized VMware or physical-server recovery?
Read the guide
Do not use blob tag search as a complete inventory of previous versions
Tags can remain attached to an older blob version without being available to the blob index query engine.
Read the guide
Treat secondary-region storage reads as potentially inconsistent across related updates
A successful read from a geo-redundant secondary can combine changes that have not yet arrived in their original order.
Read the guide
Distinguish an SSH default reset from restoration of the previous configuration
Will Azure VMAccess reset-ssh restore the SSH configuration that existed before recovery?
Read the guide
Match exploit-protection scope to executable names and paths, not assumed versions
Can an exploit-protection application target distinguish versions or architectures sharing one executable name?
Read the briefing
Check directory synchronization before relying on a Cloud Apps user suspension
Can on-premises directory synchronization reverse a Cloud Apps suspension applied through Microsoft Entra ID?
Read the guide