Page 135 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Microsoft applies safeguard holds to stop affected devices from being offered a feature update when a known issue may cause serious failure; bypass requires explicit testing and risk acceptance.
Read the briefing
Cluster-Aware Updating orchestrates node maintenance, role movement, patching, restart, and return, but many clustered workloads can still experience a planned-failover interruption.
Read the playbook
Shielded VMs use Host Guardian Service attestation and key protection to limit host-administrator access, which also makes guardian, owner-key, and disaster-recovery design part of availability.
Read the guide
ReFS supplies metadata integrity and documented resiliency features, while repair capability, data integrity streams, storage layout, hardware certification, and application support determine the actual outcome.
Read the explainer
Key Vault soft delete makes deleted vaults and objects recoverable for a retention period, while purge protection prevents permanent purge during that period and cannot be disabled after enablement.
Read the guide
Azure resource locks can block deletion or modification at management scope and inherit to child resources, but authorized users can remove locks and data-plane operations may not be affected.
Read the explainer
Disallowing Shared Key rejects account-key and dependent SAS authorization while allowing supported Microsoft Entra authorization, so caller discovery and migration must precede enforcement.
Read the playbook
Azure Backup soft delete delays permanent deletion for a configured retention period, but workload and vault support, regional state, recovery-point limits, and restore procedure still require verification.
Read the playbook
Azure Update Manager scheduled patching uses maintenance configurations and requires compatible machine orchestration; a visible schedule can fail to patch a machine whose orchestration state does not match.
Read the checklist
Azure Bastion Premium can record graphical RDP and SSH sessions to Blob storage, but it records all sessions through an enabled host and has storage, identity, client, and immutability constraints.
Read the guide