Welcome And Today’s Focus

SPEAKER_01 0:10

Hello, welcome to Microsoft Community Insight Podcast where we share insights and stories from community experts as we are today with Microsoft. Today we dive into securing cloud application best practice for Azure with TI guest Tiago Costa. Can you please

Meet Tiago Costa

SPEAKER_01 0:26

introduce yourself?

SPEAKER_00 0:27

Hey, hi Nicholas. It's a pleasure, you know, just uh to be here. Yes, my name is Tiago, and I mainly work as an AI and cloud architect for Azure or Azure, like I like to say it. Yes. More Azure for the UK audience. Um, and you know, I'm I've been in the industry for more years than I would like to confess, but I think my gray hair here tells a story about that. Um, and I've been you know involved in a lot of uh different architectures uh for you know top companies around the world where I just basically create um architectures for them for like cloud native solutions, AI solutions. So basically that's kind of my it has been my life. Okay.

Consulting Training And Content Work

SPEAKER_01 1:16

Okay, so before we dive into the main topic, could you just quickly tell us about your day-to-day job and what's involved?

SPEAKER_00 1:25

No, yeah, sure. So, like I was saying, I basically help I work for myself to start, okay, and I have several customers. And in my customers, I help them, you know, changing um sometimes the way that they work, building them architectures for their new projects, migrations. Um, so basically that's one of the verticals that I do. There's a second one which I train people, so I also like to be in the classroom being, you know, uh virtual or in person, and you know, just helping people uh acquiring new knowledge so that they can just go there and put in practice right away. Uh, those are the two main things. I also create content and you know, like to uh also create content for my platform, which is Learn with Tiago, where I share a lot of uh videos and exam prep uh courses and things like that. So it's always a fun, uh, you know, a fun time here in the office. Yeah.

AI Hype Versus Data Readiness

SPEAKER_01 2:26

You know, what for your experience like talking to customers about architect solution, do you have lots of like AI-driven scenarios?

SPEAKER_00 2:36

Yeah, with customers. No, definitely. That's the that's the thing now, right? Yeah, we're we're recording this in July 2026, and that's that's the odd, hot, hot conversation right now. But there's also a lot of customers that you know they want something, you know, they want to have AI because they have to have because all their friends are having AI in their in in the applications in their companies, and but they're still not ready for it. Okay, so there's a lot of those customers where um they don't even have any kind of governance when it comes to data. Uh, or I just remembering the other day I was in a meeting with uh, you know, a new prospect, so uh probably a new customer if everything goes well, and they wanted to do something, you know, doesn't matter what it is. And I was like, okay, where do you have data so that I can train a model so that we can build this? And you know, there was silence on the other side of data, we need that. I was like, Well, yeah, you know, or else for more that I want, I can't I can't do that much around this. So that was kind of my proposal was let's start building something to collect data for a while until we see that we have enough data. Yeah, let's start working on it. So it's always fun, you know, and um between customers that they are in very different parts in their journey. Also, I have customers that we have been doing AI for the past 10 years there, okay. Not generative AI for sure, yeah. Okay, but um, but you know, like using the Azure AI services um to summarize some stuff, you know, just to detect things in images, etc. You know, Microsoft has been in the uh front edge when it comes to this, and we had amazing services for the past years already, and you know, they're there, they're just building like amazing things today because they already have an e stream that is very long with AI. Okay, so there's always this big difference between organizations.

Landing Zones And Ending Click Ops

SPEAKER_01 4:43

Okay, do you so do you think that some of the customer that you work with doesn't start with like a landing zone first? Because at the moment it is new AI landing zone, or you just want AI?

SPEAKER_00 4:56

Well, yeah, that's that's depends a lot on you know uh where those customers are. Um definitely, you know, landing zones is is I we don't need to explain that is definitely a best practice, and that's the way that you should go. Um, but there are customers that you know they just got a subscription, they just started to uh play around with Azure, and they have like now three, four subscriptions, and it's zero organization on that. They just build stuff mainly to the portal. I call them click ops, by the way. So they don't even have kind of a DevOps approach, they don't use infrastructure as code, like literally nothing. Okay, they just go on the portal, they click, click, click, and they build something. I have customers like this that, of course, my job there, my big role there is change the mentality, change the way that they they they apply things, and definitely lending zones. It is, you know, a big, big part on how we're going to you know make sure that they do things the right way. Um, and I also have customers that you know, from day one, that's the way that we're doing things. Uh, we have lending zones, we have proper governance when it comes to Azure, like with all the policies that you can imagine. Okay, so and then and very big restrictions for like some subscriptions. I have some subscriptions that you can't do anything from the portal. Um, I have users that they can't even log in into the Azure portal or any other admin portal. So, yeah, we we we fortunately, I'm fortunately enough to have customers in different spectrums, okay, um, and their adoption on how they are adopting things, and it's very fun to see the differences.

SPEAKER_01 6:54

And of course, trying to bring you know the ones that are doing click ops to do you know things in a much much better way because it's not being more productive, it's also being more secure, okay, which is kind of there might not be saving costs low are you doing because if you automate it, use infrastructure as codes, you be might might be saving a bit more.

SPEAKER_00 7:18

Well, yeah, definitely. There's there's also the the saving bits of it because um definitely we can we can also work out that. But I I'm uh for me, I think the most important part in all of this is actually not the savings, okay? It's actually a lot the cost perspective that we have in all of this, okay. So definitely, you know, there is tons of money that you can save, okay, by you know uh going in a better way, but security for me, it is the um you know the highlight here, okay. Uh I'll I'll I'll say security first, cost then.

SPEAKER_01 7:58

Okay, it's more a FinOps approach, so I always try to look considered cost when you design a solution. Yeah, agree, agree, agree. Okay, so have you is there any like any like do you learn any have you got any

Security First With FinOps Thinking

SPEAKER_01 8:21

like for example uh challenges when you design solutions and trying to apply AI to it for each customer?

Why LLM Costs Surprise Teams

SPEAKER_00 8:31

Yeah, and then bringing the cost, by the way, that you you brought that on. Yeah, you know, customers that want to have a very fixed price on how much is this going to cost me per month? And they wanted me to give them a number, like, oh, it's going to be I don't know, just throwing a number here, 2,000 pounds a month. Okay, that's it. That's that's that's how much you're going to pay for this, and and we can't do that. Okay, there is so much um you know variables when it comes to specifically more when we start to talk about LLMs. Um, that is actually pretty hard to to bring a number like a specific number. Of course, it's my job to try to give them like an interval, um, that we try to narrow the interval as much as we can. Um, but there's a lot of conditions for net that narrowing, right? I had a customer, and I remember this because it it's it's still an ongoing email threat, okay? And uh some some calls. I think we're already like in five or six hours of calls because of this um, let's just call it issue, okay. Uh let's call it challenge, okay, which was uh the numbers that I got uh from the customer regarding uh the number of users that were using the app was let's just say it's not this, but let's just say 10. Okay. And when when you know people started to use this for the first month, yeah, there were 10. But on the second month, someone saw, oh, this app is so cool, it's so good, we love it. Let's bring this to the whole company, and they opened up to the whole company without asking me to recalculate, okay, how much that was going to um you know be built more because they were hoping that hey, that's just hosted in the server, and you know, this will handle the load, and that's it, like a normal uh application. But the problem is on the other on the other side, we have an LLM that gets context, you know, spends tokens, yeah, and then and then we are billed by by that. Um, so that was uh one that was a fun uh that is still an ongoing discussion, okay, because so that you understand the the series of this, we we have a cost that is more than 10x what was originally uh on the first month. Okay um so yeah, it is it is fun, and of course, yeah, there is the the the now traditional one, which is we got to the end of the month um with GitHub credits, so full month uh in GitHub that we have AI credits

Copilot Tokens And Model Choice

SPEAKER_00 11:31

instead of having that fixed price per per developer. Um, that's also some fun conversations over there, you know, regarding that, which also leads me to talk a little bit more with customers about the importance of you know governance, the importance of reaching out to the users, this case developers, but in the end, users of this, and and talked about like, hey, depending on what you're trying to accomplish, you know, there are models that will be much, much better off than others, correct? So uh yeah, there is there is those those conversations. Uh even the other day I had someone on a call using Fable 5, uh just to query some very, very basic stuff in GitHub, Copilot. And I was like, Well, don't don't don't do that. Like you're going you just spend, see the amount of tokens that you spend, and uh it just showed up their AI credit.

SPEAKER_01 12:34

Yeah, they can see the token though on GitHub if you're using Copilot, they can see the token in general.

SPEAKER_00 12:40

And then I asked the person, just do the exact, just launch a new session, just do the exact session, just put it in auto, please. And the difference was like, wow, the person's like, oh, but we pay this. I was like, Yes, you pay this. And there is still a lot of you know people that actually don't know how things are being built. And it's up to us, you know, just to basically talk them and uh and explain this to them. Because when people explain that when you explain this and people understand, they're like, oh yeah, yeah, that makes all sense, you know. Sometimes it's much more of awareness, you know, on how things work and etc. than actually teaching stuff to people.

Prompting Well With Better Context

SPEAKER_01 13:24

Yeah, it's the same, like if you do instead of like doing multiple prompt, if it's right big big prompt and with lots of like context of what you want, then it's easier otherwise to be smaller prompt and then you'd be wasting tokens. So it's like teaching them prompt engineering.

SPEAKER_00 13:41

Yeah, that too. You know, sometimes there are people that oh, why this is not giving me the answer that I'm looking for. Oh, the tool is bad. No, it's the tool is awesome, you know. Probably the problem is is you, you know. Uh, in a nice way, sometimes we have to tell that to them, let's see how you're prompting this, because maybe um, you know, this needs a little bit more context, or you know, needs uh some other way of asking um this. And you know, sure enough, uh you will get there. Okay, and and it's the same thing if you just walk someone, uh you're walking on the street, you see someone, and you just ask something to that person. You need to give context, right? To that person so that that person understands what you're asking for. Um, so I was the other day uh in the city center, and someone asked me, uh, like a tourist, just asked me, Hey, where's the restaurant? Just this. And I thought it was this is a new scam, you know. They're trying to rob me something. I was like, no, it was just a family of tourists, they were totally lost, and they wanted to know a specific restaurant, but the guy was so lost that he just asked me, Where is the restaurant? I don't know what restaurant are you looking for. I need I need information. I don't know, it's the first time I'm seeing you in my life. Just give me some information, just yeah, that's that's exactly the same thing that we need to give the model.

SPEAKER_01 15:18

Yeah, because if eLife is unfortunate, that's narrow. If the per if you don't know what the name of the restaurant, where it is, then you can't help. Uh you need to give uh the context as well.

SPEAKER_00 15:29

So yeah, exactly, exactly. So that's uh that's you know what exactly what we need to do when when we're prompting, you know, something. Yeah, yeah.

Hidden Azure Costs From Idle Resources

SPEAKER_01 15:39

Yeah, it's the same for like the foundry. If you deploy more than one module in a local region and don't use it, it will still charge you the uh if you don't delete it because it's still deployed.

SPEAKER_00 15:52

Yeah, there's still some charges, not that much, but there are always still some charges. I had customers, you know, leaving all sorts of resources in Azure from very large virtual machines for from app services, uh container apps, I don't know, clusters um on AKS, and there's like, oh, but AKS is free. You don't pay well, you pay the compute, and yeah, you have 10 VMs running for a full month. So yeah, there's some charge there, you know. So that there's still um some charges there, and we need to be careful and and and learn how to use the services properly, yeah.

SPEAKER_01 16:34

Okay, so it's kind of your job to quite educate them in some of the like best practice, what they can do, what you can't do.

SPEAKER_00 16:42

Yeah, so a lot of my customers they rely on me exactly for that, which is you know, first telling them what's hot right now. What where where should they direct their efforts uh when it comes to innovation and all. Um, and then yay, let's talk about how we can use this in the best way for your scenarios, and at least for my regular customers, I know their business already quite well. Uh, and I can actually do a very, very good job in exactly translate tech into you

Choosing Simpler Platforms Over Kubernetes

SPEAKER_00 17:16

know their reality, okay? Uh, and how they can move faster uh with within you know within the tech world, uh, with the right tech that makes sense for their case, okay? Because there's sometimes, you know, look, amazing things, right? Amazing tools, but sometimes they're just too complex for their business, okay? It just doesn't matter for them. Um, and for example, Kubernetes is a great example of that. I love Kubernetes, don't get me wrong, okay? Um, but I I I've seen lots and lots of customers implementing very simple solutions with Kubernetes. And I'm like, why are you doing this?

SPEAKER_01 17:57

You know, this it might not be a need for Kubernetes, you might just use App Service as a container.

SPEAKER_00 18:04

Just use you know a container app, okay, like Azure Container App, look, whatever. I don't know now, but depends, of course, on the use case that we're talking about. But something that is less complex, uh, because you don't need that complexity, that's it. Um, because you know it's a departmental solution that it's never going to grow to the needs of scalability, reliability, and all that. That you know, a true Kubernetes cluster will allow you to do that, which is great. Look, and again, I say I love my my Kubernetes clusters, and I I have lots of them um deployed out there, but let's be honest, you know, sometimes that's just not the best fit.

SPEAKER_01 18:50

Yeah, maybe he wants to learn Kubernetes.

SPEAKER_00 18:53

Yeah, sometimes sometimes, and and that's actually in one of my customers, we actually actually did exactly that. We had a very large project, okay, that we're going to use Kubernetes, but the team didn't have any knowledge on Kubernetes. So we had another project that Kubernetes was probably not the best fit when it comes to you know the size of the project and all that, but we actually took the decision of doing that in Kubernetes so that the team could actually learn ANZO with something that, if they mess up, eh, was an internal app, no big deal. Okay. Um, and then you know they learn, they use this to learn, and then we build the that that that very large app uh, you know, a few months later in Kubernetes. And it that was actually super useful uh for them to have all that pre-knowledge that they gain from that real world app, but very much, much smaller. But we knew this, and it was kind of a wise decision that we took, and it was a decision based on numbers. Uh, and we knew that later on it just made sense to just kill that Kubernetes cluster and move to something else, which we did, by the way. Okay, so that first application was actually um basically converted in some other service, okay? Uh, but that was super useful for that one, that large one. Okay, so yeah, sometimes this we can actually on on purpose, you know, and and in a very conscious way, actually do that just to learn about the tech.

SPEAKER_01 20:37

Yeah, yeah. So maybe you can just like instead of like teaching them but the best practice, try to show them what it is so they know what it is. So, like on a portal or uh the token-wise as well. So that could be another ways.

SPEAKER_00 20:55

Yeah, yeah, definitely. There's so many

Learning By Building Safe Pilot Projects

SPEAKER_00 20:58

ways, you know. And I always like to give them, you know, when we're going for a new tech, I always like to give them like a short workshop on hey, there's this, this is the capabilities, you know, and showing them off some of the things that we can do with with it, get a lab that they can, you know, just kind of play around with it. Um, we kind of you know need to build something all together. We build something together, kind of a hackathon style thing. And after that, hey, now let's let's go for the real thing, you know, and each one of us have we have our our own roles, of course. And then hey, let's let's build something, okay. And then we go and we build together, okay. We build something. Um, that that's usually one of the approaches, no, not the only one, but one of the approaches that I actually know lots and lots of demos, okay, today. Yeah, but I think this is so easy to do, you know, having the secret and integrated with an Azure server. service using something called key vault references. Okay. Yeah.

SPEAKER_01 22:05

So that's uh plus another way that you can use to another way that it used to govern it your resources add your policies. So when you deploy something you can see whether meet your policy for your company your company before you you're like deployed. So whether you have a high skew and things as well. Those are some of the best practices.

SPEAKER_00 22:28

Yeah if if if if you go to be super you know governed like I have most of my customers in in in that level um we have for example subscriptions that that's an internal subscription only for internal apps that for example only people that are connected to a specific network can actually access those apps. If you try to configure an application in that subscription that goes imagine allows internet access or so from the internet to the app or the app to the internet if such it's just not going to work okay because we

Workshops Key Vault And Azure Policy

SPEAKER_00 23:09

have lots of Azure policies in place so that those things are just not not allowed. Okay and look there there is so much more that we could talk about I have customers that for for us you know to do certain actions we need to be in specific machines got it so it's not like for my machine I can't do certain things I have especially like a jump box I passed a yeah yeah that I need to take off and you know um to use to do that so look there is so much that we could talk and it's one of those things that it's unfortunate that we have to do this this stuff um but it's it's needed much much much needed okay yeah I I think I had a snarel when someone thought Baston was actually a VM and just going the internet but didn't think it was a jump box. So it's it's our job to educate them where it's the client side as well because yeah and and and look sometimes it's not people are not doing this okay to arm the company or something but they are putting the company in jeopardy by yeah doing certain actions okay and again uh it is up to us to to kind of uh I don't like to say teach them okay but guide them into the best behaviors that they should have okay yeah I agree so as this episode is coming to an end we're all glad to get to know guests uh Tiago are you going to any you going to any events or are you going to doing anything we're gonna community or you just uh yeah but it's later in the year I think I'm doing experts live switzerland uh

Tight Access Controls And Jump Boxes

SPEAKER_00 25:03

in November okay yeah I think it's November something like that and uh I still need to do see what what's in up in October because only now I have my agenda for the next few months is actually um you know organized because this this past months have been like totally crazy in terms of work and yeah I need to see you know now that I'm a little bit more free I can do stuff like this today with you um and also be available to go to other places and speak which is actually something that I I love to do yeah yeah because tend to like June July August tend to be like a pause for people or when it'd be afterwards it'd be like conference season so it's it's normal I think yeah yeah it's usually conference season like April May beginning of June then things slow down a lot they evolve like you said and then yeah September October is going to be like a lot of a big push October I'm actually doing um in Porto um I'm actually organizing okay that one collab days uh Portugal it's going to be in Porto which is the second largest city in Portugal and um we're doing that um I'm also going to speak at the Web Summit in Lisbon too uh which is a small conference of 90 000 people 100 000 people uh so it's really nice really large um so yeah is that is that the web developer one or is it uh it's more about uh you know basically

Community Events And Speaking Plans

SPEAKER_00 26:47

innovation and uh uh there's a lot of hype around you know also around like um companies to getting uh you know funded and things like this so actually my my talk is going to be a little bit different than than the usual it's not so much of a technical one okay because the audience is quite a mixed audience you have some tech people but actually they are not the majority right so my talk is actually slightly different this time it's about to use soft skills yeah yeah things like soft skill talk is good so what you've learned experience those you find more more insights from as well so no yeah yeah because you know yeah I'm not going to show them you know how to build an agent in foundry or something like that it's it's just not the right audience for that uh but yeah I'll I'll I'll show other stuff you know and it's hopefully it's

Formula One 3D Printing And Closing

SPEAKER_00 27:44

going to be it's going to be nice.

SPEAKER_01 27:46

Okay thanks uh t I don't do you have do you have any hobbies because I remember before I we were speaking offline so you would love to like renovate stuff.

SPEAKER_00 27:58

Yeah no so hobbies for me is watching formula one okay so uh that's kind of one of my big my big hobbies because I actually watch uh you know not just the race but practice qualification everything and I'm very connected into the the world of formula one and I actually started a few months ago you know a new hobby which is 3D printing I'm still learning it okay yeah but I bought a 3D printer and I'm you know printing some you know some cool stuff like you know like I like a small tray here and you know stuff like this um and I like to keep my desk super organized super clean and all that so it it helps me doing this and just doing some fun stuff you know for for the house etc so it's always uh not now it's my big hobby it's basically that and the rest is just sometimes it's just relax hanging out with the family that's usually where I spend most of my time my free time yeah yeah 3D printer is is quite amazing because you can build stuff with it everything you can either build stuff that you haven't imagined and then maybe just use it as stuff yeah and then and and there's also another thing which is uh just repurpose some stuff that for example the other day I had a surface headphones that I broke that that part that that you put here on the top of the head you know that it just broke and there was a model you could 3D print that okay is it as good as the original one of course not okay uh but it's working I still have my headphones and I can still use them okay and then it's it's good for the environment right because you're not throwing something into the bin that is still properly working you just broke a little bit a little part okay so I think it's it's actually quite cool. Okay.

SPEAKER_01 30:04

Uh so thank you Tiago so hope everyone learned how how it's fundamental and to secure and important to secure cloud application so whether it's moving on-prem to the cloud and try to follow best practices someone like Q Vault Tiago mentioned about the key vault or so so we're here some like himself are there to educate people on as a trainer or speaker to help people to follow the practice the best practice so any question just drop me a message and then he would expand on it and how you can do it with some okay thank you thank you bye bye