Katabarwa Labs

Guides for Azure and Atlassian admins

Blog

Straight, practical answers to the operations questions we kept seeing, from cost caps and expiring secrets to audit-log retention and orphaned-resource cleanup.

Microsoft Entra ID

Get alerted before Entra app registration secrets and certificates expire

Entra ID shows the expiry date of every app registration secret and certificate but never alerts anyone before one expires. Here is the DIY Graph scan and a packaged in-tenant option.

August 29, 2026

Azure operations

Get alerted before TLS certificates expire on Azure App Gateway and App Service

Azure has no native near-expiry alerting for TLS certificates on Application Gateway listeners, App Service, or API Management. Here is how to sweep them yourself, and a ready-made daily digest.

August 29, 2026

Azure security

Get one digest of every expiring Key Vault secret, key, and certificate

Key Vault expiry notifications are per vault, fire once, and ignore objects with no expiry date. Here is how to get a single daily digest across every vault in a subscription.

August 29, 2026

Azure security

Find dangling DNS records in Azure before someone takes over your subdomain

A CNAME pointing at a deleted Azure resource is a subdomain takeover waiting to happen, and the official answer is a one-off PowerShell script. Here is how to scan for dangling records daily.

August 29, 2026

Azure security / IAM

Find and clean up stale Azure RBAC role assignments

Deleted identities leave orphaned Identity not found role assignments that clutter IAM and count against the hard 4,000-per-subscription limit. Here is how to find and remove them safely.

August 29, 2026

Azure security / IAM

How to detect when someone changes an Azure custom role definition

Azure fires no alert when a custom role definition quietly gains dangerous permissions. Here is how to detect owner-equivalent custom roles and permission creep.

August 29, 2026

Azure security

Find the Azure storage accounts putting your data at risk

Anonymous blob access, shared-key auth, weak TLS, open networks: Azure has no recurring report that grades every storage account. Here is how to build one with Resource Graph.

August 29, 2026

Azure governance

Keep Azure Policy exemptions from living forever (or expiring silently)

Azure Policy exemptions expire without any notification, and exemptions with no expiry quietly become permanent gaps. Here is how to inventory and track exemption lifecycles.

August 29, 2026

Azure monitoring

How to find Azure resources with no alert coverage

Azure Monitor lists the alert rules you have, but has no view of the resources no rule watches. Here is how to build a zero-alert coverage report with Resource Graph.

August 29, 2026

Azure operations

How to find Azure VMs and file shares with no backup coverage

Azure has no native alert for a resource that was never enrolled in any backup policy, so coverage silently drifts. Here is how to find unprotected, failing, and stale resources.

August 29, 2026

Atlassian compliance

How to keep Jira audit logs past the retention window (SOC 2 / ISO evidence)

Jira Cloud audit logs age out after about 180 days, right when auditors ask for a year of history. Here is how to retain audit records long-term, in your own tenant.

August 29, 2026

Jira administration

Find Jira filters, dashboards, and issues owned by deactivated users

Deactivating a Jira Cloud user does not clean up their saved filters, dashboards, issues, or project leads. Here is how to inventory everything a departed user left behind.

August 29, 2026

Confluence administration

Find what is eating your Confluence storage and clean it up safely

Confluence Cloud has no site-wide view of attachment storage waste, so unused, orphaned, and oversized files pile up against your quota. Here is how to build the inventory and clean up safely.

August 29, 2026

Jira Service Management

How to audit who can access your Jira Service Management portals

JSM has no single view of who can reach each service desk portal: customers, organization grants, and agent access all live in different places. Here is the DIY audit and a Forge-native option.

August 29, 2026

Azure cost management

Azure Anomaly Detector is retiring. How to keep per-team cost-spike alerts.

Azure Anomaly Detector retires October 1, 2026. If you used it to catch cost spikes, here is a native, per-resource-group and per-team way to keep those alerts after it is gone.

August 27, 2026

Azure cost management

How to put a hard spending cap on Azure (and actually stop the bill)

Azure has no native hard spending limit on pay-as-you-go. Here is what the platform does and does not do, the DIY options, and how to make compute actually stop at your cap.

August 26, 2026

Microsoft Entra ID

How to set a Microsoft Entra ID account to expire on a date

On-prem Active Directory has accountExpires. Entra ID still does not. Here is how to add automatic account expiry for contractors, interns, and temps.

August 26, 2026

Azure cost management

Find and delete orphaned Azure resources that are still costing you money

Unattached disks, NICs, public IPs, and empty App Service plans keep billing after the thing they belonged to is gone. Here is how to find them and what they cost.

August 26, 2026

Azure management

How to see who created an Azure resource and when (CreatedBy / CreatedOn)

Azure has no native creator or creation-date property on resources. Here is how to capture who created a resource and when, using the Activity Log and tags.

August 26, 2026

Azure security / IAM

Just-in-time Azure role elevation without paying for PIM

PIM gives just-in-time role activation but requires Entra ID P2 per user. Here is the DIY approach and a flat-fee alternative for Azure resource roles.

August 26, 2026