Architecture and Design
TOGAF, DDD, target-state, strangler-fig, C4, ADRs — not a glossary, a sequence.
Sep 12, 202615 min read4
Command Palette
Search for a command to run...
Latest articles
Onboarding a Partner to Your API: A Step-by-Step Entra Runbook
Part 6 of 6 in the Entra ID Authentication: A Field Guide series. Every article on this topic explains the pieces. Very few say what order to do them in, or what you actually put in the email to the p
Sep 12, 202617 min readValidating Entra Tokens in Azure API Management
The validate-jwt policy, client certificates, and the v1/v2 issuer trap that costs everyone an afternoon.
Sep 12, 20265 min readSecretless Azure: Managed Identities and Workload Identity Federation
Why a secret in Key Vault is not the answer, and what to use instead.
Sep 12, 20269 min read4OAuth 2.0 Grant Types in Azure: Which to Use, and Which Are Dead
Authorization code with PKCE, client credentials, on-behalf-of — and the two flows to stop reaching for.
Sep 12, 20266 min readThe One Line of Token Validation Everyone Skips
A valid signature does not mean the token was meant for you.
Sep 12, 20269 min readHow a Service Proves Its Identity to Microsoft Entra ID
Certificate authentication, explained from the one question it always comes down to.
Sep 12, 20269 min read14