Technology · Platform

Microsoft Azure

Azure hosts the Windows side of my Teams integration: a media bridge with managed identity, vault-held secrets and authenticated access.

Helix · Auth and access planeWindows media bridge and per-run jobs
Teams callraw audio
Azure VM.NET media bridge
My GPUsspeech, conversation
  • 91,643buffers carried in a 30-minute soak, Azure to my host
  • 50.001/sbuffer rate held across the soak
  • 11job definitions removed and credentials revoked by one cleanup

A media bridge on a Windows VM

Microsoft Teams hands raw call audio only to a Windows application built on Microsoft's real-time media SDK. The speech models and conversation engine behind Helix run on Linux GPUs, and I was not going to send call audio to someone else's AI service to get around that. I put the smallest possible piece in Azure and kept the brain on my own hardware.

That piece is a .NET 8 media bridge on an Azure Windows Server virtual machine. The region turned down two smaller VM sizes for lack of capacity, so it runs on a larger general-purpose size. It carries call audio to my GPU host over one authenticated full-duplex WebSocket per call and plays the agent's voice back into the call; a long soak ran with zero receive stalls and zero reconnects.

In Azure
On my hardware
The bridge holds no AI or business logic, so one conversation engine serves a desk microphone and a Teams call alike.

The whole path is in A self-hosted colleague in a Teams call.

Held without open ports

A system-assigned managed identity and vault-held secrets keep everything sensitive out of images and configuration. I reach the VM only through Azure's control plane.

Managed identitysystem-assigned
Key Vaultevery secret
Run commandadministration
No inbound port is open: remote desktop, remote management and media all closed.

Jobs that exist only for their run

The second Azure piece serves the Teams working service. A user hands a coding job to an AI worker, and I did not want a cloud VM sitting idle between jobs. A job runs on an enrolled local host or as an Azure Container Apps Job that exists only for that run, with the infrastructure defined in Bicep. A real frontier-model job ran in Azure through this path, and the service estimates the price of each run before submission.

Start claim: claimed
persisted; an ambiguous start is reconciled, never blindly retried
Container Apps Job
Cleanup check
nothing left behind

Container Apps also hosts the weather MCP server I built for Microsoft Copilot Studio in the Auth and access plane, packaged as a versioned container image with a deployment guide.

In the cloud I keep identity, secrets and cost under control. This work covers VMs, Key Vault, managed identity, Container Apps Jobs and Bicep for specific workloads in one subscription. The engineering that matters is the voice path on the Helix page and in Real-time audio pipeline engineering.

I use the cloud for exactly the part of a system that has to live there.