Even experienced Azure engineers cannot know everything. Here are some lesser-known capabilities and surprising platform behaviors hiding inside Microsoft Azure and Entra ID.
Nobody knows it all, and nobody is greater than all of us.
The more you know, the better you understand how much you still don't know.
Learning is continuous for life.
Not knowing one of these capabilities doesn't mean someone lacks Azure experience. Azure and Microsoft Entra ID are enormous, continuously evolving platforms. Engineers naturally become experts in the technologies they design, deploy, and troubleshoot regularly while other capabilities can remain completely outside their daily work for years.
Some features in this list are new. Others have existed for years. Some are obscure. And some are familiar features with behaviors that aren't obvious until you encounter them in a real environment.
The question isn't whether you know it all. The question is how many make you stop and say: “Wait... Azure does WHAT?”
Some of these may be familiar to you. Some may not. Finding even one you didn't know yesterday means you've learned something today.
Azure Networking & Routing
1. Azure Virtual Network Routing Appliance (VNRA)
A relatively new Azure networking capability that many experienced Azure engineers may never have encountered. This is an excellent opening because somebody could have worked with Azure networking for years before VNRA even existed.
7. Azure Virtual Network Manager Security Admin Rules
Centralized security rules can be applied across virtual networks and evaluated separately from the workload NSGs administrators are accustomed to managing.
8. Azure Virtual Network Manager IP Address Management (IPAM)
Azure has native capabilities for centrally managing address spaces and allocations—something many network engineers still handle through spreadsheets or external IPAM products.
9. Azure Private Link Service
Many Azure engineers know Private Endpoints extremely well but have never deployed Private Link Service, which enables privately exposing your own service to consumers through Private Link.
10. Azure DNS Private Resolver
Hybrid DNS resolution can be provided without maintaining traditional DNS-forwarder VMs solely for forwarding between Azure and other networks.
11. Azure Route Server
Azure Route Server enables dynamic route exchange using BGP between Azure virtual networks and supported network virtual appliances, reducing the need to manually maintain routing information through UDRs.
12. Effective Security Rules
The NSG displayed on a subnet or NIC isn't necessarily the complete answer to “What security rules actually affect this NIC?” Azure can calculate the resulting effective security rules.
13. Effective Routes
Likewise, the UDR table an administrator created isn't necessarily the complete routing picture. System routes, BGP-learned routes and UDRs contribute to the effective routing state.
14. Network Watcher Next Hop
Rather than manually reasoning through every possible route, Azure can determine the next-hop type and address for traffic from a VM toward a specified destination.
Azure Governance & Resource Management
3. A Resource Group Delete Lock Doesn't Necessarily Prevent a Resource from Being Moved
A CanNotDelete lock inherited from a Resource Group prevents deletion, but an authorized administrator can move supported resources to another unlocked Resource Group. The inherited lock is then gone and the resource can be deleted. This specifically concerns Delete locks, not ReadOnly locks.
15. Azure Resource Graph
Azure resources across large environments can be queried using Resource Graph rather than building scripts that enumerate every subscription and resource individually.
16. Azure Resource Graph Change Analysis
Azure Resource Graph can expose resource change information that helps answer the classic troubleshooting question, “What changed?” Administrators can use change data to investigate how supported resource properties changed over time instead of relying only on manual configuration comparisons.
17. Azure Policy Modify Effect
Policy isn't limited to reporting violations or denying deployments. Supported properties can be modified through policy processing.
18. Azure Policy DeployIfNotExists
Policy can identify missing configurations and trigger remediation deployments rather than merely reporting noncompliance.
Microsoft Entra ID & Identity Security
2. Microsoft Entra Security Group Soft Delete
Supported deleted cloud security groups can be retained for recovery rather than immediately disappearing permanently. Administrators who learned Entra group management years ago may have completely missed the addition of this capability.
4. Global Administrators Can Elevate Their Access to Azure Resources
Entra Global Administrator does not normally equal Azure subscription Owner. But Access management for Azure resources allows a Global Administrator to elevate access so they can manage access across Azure subscriptions and management groups associated with the tenant.
5. Conditional Access Can Show Options You Aren't Licensed to Use
Seeing a condition or control in the Conditional Access designer doesn't establish that the organization possesses the required licensing. Risk-based conditions such as User risk and Sign-in risk, for example, have licensing requirements.
6. Conditional Access Device Compliance Has a Dependency Outside Conditional Access
Selecting Require device to be marked as compliant is easy. Actually having a device evaluated and marked compliant depends on an appropriate device-management/compliance infrastructure and licensing, commonly Microsoft Intune.
19. Microsoft Entra Authentication Strengths
Conditional Access can go beyond simply requiring MFA and specify acceptable authentication-method combinations, including phishing-resistant requirements.
20. Microsoft Entra Authentication Context
Conditional Access protection can be associated with particularly sensitive actions or application contexts rather than treating every interaction with an application identically.
21. Continuous Access Evaluation (CAE)
Access isn't always simply authenticate → receive token → wait until token expiration. Supported critical events can result in access being reevaluated much sooner.
22. Microsoft Entra Cross-Tenant Synchronization
Identity synchronization between tenants can automate B2B collaboration-user lifecycle operations that organizations otherwise handle manually.
23. Microsoft Entra Lifecycle Workflows
Joiner-Mover-Leaver processes can be automated around identity lifecycle events rather than being entirely dependent on administrators and scripts.
24. Microsoft Entra Entitlement Management Access Packages
Groups, applications, and other resources can be packaged into governed access experiences with requests, approvals, expiration, and lifecycle controls.
25. Microsoft Entra Administrative Units
Administrative responsibility can be scoped to subsets of directory objects instead of giving every delegated administrator tenant-wide reach.
Azure Storage
26. Azure Blob Storage Supports SFTP
Azure Blob Storage with hierarchical namespace can provide an SFTP endpoint, allowing supported clients to transfer data using SFTP without deploying and maintaining a traditional SFTP server VM.
27. Azure Blob Storage Supports NFS 3.0
Azure Blob Storage can expose containers through the NFS 3.0 protocol in supported configurations. Administrators who think of Blob Storage exclusively as REST/API-based object storage may not realize that NFS access is available.
28. Azure Storage Account Failover
Supported geo-redundant Storage Accounts can be failed over to their secondary region. Many administrators understand GRS replication but may never have encountered customer-managed Storage Account failover.
29. Azure Blob Storage Object Replication
Block blobs can be asynchronously replicated between source and destination Storage Accounts using Object Replication policies. This is separate from the geo-redundancy configuration of the Storage Account itself.
30. Azure Blob Storage Point-in-Time Restore
Azure Blob Storage can restore supported block blob data to an earlier state within a configured retention period, providing account-wide recovery from accidental changes, overwrites, or deletions when the required data-protection features are configured.
31. Azure Immutable Blob Storage
Azure Storage supports Write Once, Read Many (WORM) protection through time-based retention policies and legal holds. Protected data cannot simply be modified or deleted because an administrator has powerful Azure permissions.
32. Azure Storage User Delegation SAS
A Shared Access Signature for Blob Storage can be secured using a user delegation key obtained through Microsoft Entra credentials rather than being signed with a Storage Account access key.
33. Azure Storage Actions
Azure Storage Actions provides a serverless mechanism for performing large-scale data operations across Blob Storage based on defined conditions and operations, reducing the need to build custom scripts that enumerate enormous numbers of objects.
Azure Key Vault & Cryptography
34. Azure Key Vault Purge Protection
With purge protection enabled, even a highly privileged administrator cannot permanently purge a soft-deleted vault or protected object before its retention period expires.
35. Azure Key Vault Automatic Key Rotation
Azure Key Vault supports key rotation policies that can automatically rotate supported cryptographic keys according to defined schedules instead of requiring administrators to build the entire rotation process externally.
36. Azure App Service Key Vault References
Azure App Service configuration can use Key Vault references, allowing applications to consume secret values without storing the actual secret directly in application settings or requiring application code to retrieve it from Key Vault.
37. Azure Managed HSM
Azure Managed HSM provides a fully managed, highly available, single-tenant Hardware Security Module service for cryptographic keys. It is a distinct service and security model rather than simply a more expensive Key Vault SKU.
38. Azure Key Vault Supports Two Authorization Models
Azure Key Vault can use traditional Vault Access Policies or Azure RBAC for data-plane authorization. Administrators familiar with the original Access Policy model may not realize that Key Vault access can now be governed through Azure RBAC.
Azure Site Recovery & Azure Migrate
39. Azure Site Recovery Test Failover
Azure Site Recovery can perform a Test Failover into an isolated environment without disrupting the production workload or committing to an actual disaster-recovery failover.
40. Azure Site Recovery Recovery Plans
Site Recovery can orchestrate recovery of multi-tier applications through Recovery Plans, allowing workloads to be grouped and started in a defined sequence rather than treating disaster recovery as a collection of unrelated VM recoveries.
41. Azure Site Recovery Re-Protect and Reverse Replication
After a workload has failed over, Site Recovery can establish replication in the opposite direction through re-protection, supporting the process required to eventually fail workloads back to their original location.
42. Azure Migrate Dependency Analysis
Azure Migrate can identify communication dependencies between discovered servers, helping administrators determine which systems belong to the same application and should potentially be migrated together.
43. Azure Migrate Performance-Based Sizing
Azure Migrate assessments can recommend Azure VM sizes based on observed CPU, memory, storage, and performance utilization rather than simply reproducing the hardware configuration assigned to the existing VM.
44. Azure Migrate Agentless VMware Discovery
Azure Migrate can discover and assess supported VMware environments without requiring an agent to be installed inside every individual virtual machine.
45. Azure Migrate Business Cases
Azure Migrate can go beyond technical discovery and assessment by creating migration business cases that estimate costs and potential savings associated with moving workloads to Azure.
Azure Kubernetes Service (AKS)
46. AKS Azure CNI Overlay
Azure CNI Overlay allows Kubernetes pods to use IP addresses from a separate overlay address space rather than consuming an address from the Azure VNet for every pod, significantly changing how AKS IP capacity can be designed.
47. AKS Node Auto-Provisioning
AKS can automatically determine and provision appropriate node capacity based on pending workload requirements rather than requiring administrators to anticipate every capacity requirement through predefined node pools.
48. AKS Virtual Nodes
In supported configurations, AKS can use Virtual Nodes backed by Azure Container Instances to rapidly provide additional pod capacity without requiring those workloads to run on conventional AKS worker nodes.
49. AKS Workload Identity
AKS workloads can use Microsoft Entra Workload ID to access supported Azure resources without applications storing conventional service principal credentials or secrets.
50. AKS Automatic Upgrade Channels
AKS provides automatic upgrade channels that allow administrators to define how Kubernetes cluster and node upgrades are delivered instead of manually initiating every platform upgrade.
ExpressRoute & Hybrid Networking
51. ExpressRoute Does Not Automatically Encrypt Your Traffic
ExpressRoute provides private connectivity to Microsoft services, but private connectivity and encryption are not the same thing. Administrators should not assume that traffic is cryptographically protected simply because it travels through an ExpressRoute circuit.
52. ExpressRoute FastPath
ExpressRoute FastPath can send supported traffic directly between the ExpressRoute circuit and virtual network resources while bypassing the traditional ExpressRoute Virtual Network Gateway data path.
53. ExpressRoute Global Reach
ExpressRoute Global Reach can connect supported on-premises networks through Microsoft's global backbone, allowing locations connected through different ExpressRoute circuits to communicate with each other.
54. ExpressRoute Microsoft Peering
ExpressRoute is not limited to private connectivity between an on-premises network and Azure VNets. Microsoft Peering provides connectivity to supported Microsoft public services through the ExpressRoute infrastructure.
55. ExpressRoute Direct
ExpressRoute Direct allows customers to connect directly to Microsoft's global backbone at supported peering locations using very high-bandwidth physical connectivity rather than relying exclusively on a conventional connectivity-provider model.
Hub-and-Spoke Architecture
56. Hub-and-Spoke VNet Peering Does Not Provide Transitive Routing
Peering Spoke A to a Hub and Spoke B to the same Hub does not automatically allow Spoke A to communicate with Spoke B through the Hub. VNet peering itself is non-transitive.
57. Putting Azure Firewall in the Hub Does Not Automatically Route Traffic Through It
Deploying Azure Firewall or another Network Virtual Appliance in a Hub VNet does not automatically make it the transit path for spoke traffic. Routing must be deliberately designed to direct the required traffic through the appliance.
58. Hub-and-Spoke Gateway Transit
A spoke VNet can use a compatible VPN or ExpressRoute gateway located in a peered Hub VNet through Gateway Transit rather than requiring every spoke to deploy and operate its own gateway.
59. Peered Azure VNets Do Not Become One Network
VNet peering provides private connectivity between VNets, but the VNets remain separate Azure resources with independent address spaces, subnets, security configurations, routing constructs, DNS considerations, and administrative lifecycles.
Found this Article Useful? 😊
If this Article saved you an hour of Troubleshooting, a few minutes of searching, or one Microsoft documentation Rabbit Hole, consider turning some of that saved time into a Coffee. ☕ Your support helps keep new Technical Guides coming.
0 comments