$ whoami christoph # Senior Cloud Architect · Microsoft Azure MVP
I’m Christoph, Senior Cloud Architect for Azure. I design and build landing zones, policies, VNETs, routing, DNS, firewalls and Private Endpoints for enterprise customers, and ship them as code. Along the way I write down what I learn: the fixes, the gotchas and the occasional rabbit hole.
20+ years in IT · Azure since 2019 · Microsoft MVP Azure Networking since 2025 · Speaker at community events
How to find out from Log Analytics which path every Azure Virtual Desktop session took: which columns lie while a session is running, which checkpoints tell the truth, and a query that classifies sessions as TCP, direct, or relay.
Entra joined session hosts need a few FQDNs for sign-in. AD DS and hybrid joined hosts bring the domain controller port list back, and hybrid join adds device registration in the system context. Plus FSLogix on Azure Files.
VPN or ExpressRoute into Azure: without further configuration, UDP over a private path was luck in my lab. With the RDP Shortpath listener for managed networks, 11 of 11 sessions ran on UDP.
Which firewall rules Azure Virtual Desktop needs, and what Azure Firewall, a NAT gateway, and a bypass route do to RDP Shortpath: less than you would expect, and three traps along the way. Measured in my lab and checked against the docs.
What the RDP Shortpath switches on the host pool and the session host change, and what they don't: turning off STUN or TURN alone left my Windows client on TCP, and the AVD agent needed a restart after every egress change.
Every Azure Virtual Desktop session starts on TCP and tries to add RDP Shortpath over UDP, direct or through a relay. How to see which path you got, and why two clients in the same network can end up on different ones.
Small open-source tools for Azure, mostly things I needed myself in projects and figured others might need too.
A terminal UI for live log monitoring of Azure Firewall: tail -f for your firewall, with instant filters and a trace of which rule matched.
Checks from macOS or Linux whether RDP Shortpath works for Azure Virtual Desktop and Windows 365. An unofficial avdnettest.exe counterpart.
Wildcard certificates via the ACME dns-01 challenge. A maintained drop-in replacement for certbot-dns-azure.
No talk this time, just coffee and good conversations about Azure, networking and whatever keeps you busy. At the SoftwareOne Innovation Summit 2026, Pyramide Mainz.
What sits between your users and the model: the layers Azure offers for identity, token limits, logging and private access, and where they get in each other’s way. Live in my lab. At the ECS Summit & Community 2027.
Three years after my first AVM talk: where Azure Verified Modules stand in real projects, what the move away from the older landing zone templates means, and the parts that still hurt. At the ECS Summit & Community 2027.
Öffentlich oder privat? Die richtige Netzwerkanbindung für Azure-Dienste
Azure Firewall im Betrieb: Traffic, Routing und die häufigsten Fehler
Deep Dive into Azure Service Endpoints and Azure Private Links