Networking

Azure Landing Zone with Palo Alto NVA: Lessons Learned

Jonathan Aerts
Networking
12 Apr, 2026

Deploying Palo Alto VM-Series as a Network Virtual Appliance in an Azure Landing Zone sounds straightforward — until you actually do it. This article covers the hard-won lessons from building the fire

SubnetWithNsg: How Azure Policy Deny Forced Me to Use azapi

Jonathan Aerts
Networking
05 Apr, 2026

The Problem Every production Azure Landing Zone deploys a Deny policy: "Subnets must have a Network Security Group." It is a security best practice — no subnet should exist without an NSG cont