$ whoami christoph # Senior Cloud Architect · Microsoft Azure MVP
I’m Christoph, Senior Cloud Architect for Azure. I design and build landing zones, policies, VNETs, routing, DNS, firewalls and Private Endpoints for enterprise customers, and ship them as code. Along the way I write down what I learn: the fixes, the gotchas and the occasional rabbit hole.
20+ years in IT · Azure since 2019 · Microsoft MVP Azure Networking since 2025 · Speaker at community events
Entra joined session hosts need a few FQDNs for sign-in. AD DS and hybrid joined hosts bring the domain controller port list back, and hybrid join adds device registration in the system context. Plus FSLogix on Azure Files.
VPN or ExpressRoute into Azure: without further configuration, UDP over a private path was luck in my lab. With the RDP Shortpath listener for managed networks, 11 of 11 sessions ran on UDP.
Which firewall rules Azure Virtual Desktop needs, and what Azure Firewall, a NAT gateway, and a bypass route do to RDP Shortpath: less than you would expect, and three traps along the way. Measured in my lab and checked against the docs.
What the RDP Shortpath switches on the host pool and the session host change, and what they don't: turning off STUN or TURN alone left my Windows client on TCP, and the AVD agent needed a restart after every egress change.
Every Azure Virtual Desktop session starts on TCP and tries to add RDP Shortpath over UDP, direct or through a relay. How to see which path you got, and why two clients in the same network can end up on different ones.
A terminal UI that streams Azure Firewall logs live from an Event Hub and explains which rule decided a flow, so you stop waiting for Log Analytics during troubleshooting.
Small open-source tools for Azure, mostly things I needed myself in projects and figured others might need too.
A terminal UI for live log monitoring of Azure Firewall: tail -f for your firewall, with instant filters and a trace of which rule matched.
Checks from macOS or Linux whether RDP Shortpath works for Azure Virtual Desktop and Windows 365. An unofficial avdnettest.exe counterpart.
Wildcard certificates via the ACME dns-01 challenge. A maintained drop-in replacement for certbot-dns-azure.
No talk this time, just coffee and good conversations about Azure, networking and whatever keeps you busy. At the SoftwareOne Innovation Summit 2026, Pyramide Mainz.
Öffentlich oder privat? Die richtige Netzwerkanbindung für Azure-Dienste
Azure Firewall im Betrieb: Traffic, Routing und die häufigsten Fehler
Deep Dive into Azure Service Endpoints and Azure Private Links