11 / 11 FIXES VERIFIED LIVE

az storage account update -n titanlivecdfwpub -g titan-live-20260420 --allow-blob-public-access false

az storage account update -n titanlivecdfwpub -g titan-live-20260420 --allow-blob-public-access true

{
 "accessTier": "Hot",
 "accountMigrationInProgress": null,
 "allowBlobPublicAccess": false,
 "allowCrossTenantReplication": false,
 "allowSharedKeyAccess": null,
 "allowedCopyScope": null,
 "azureFilesIdentityBasedAuthentication": null,
 "blobRestoreStatus": null,
 "creationTime": "2026-04-19T15:40:43.218946+00:00",
 "customDomain": null,
 "defaultToOAuthAuthentication": null,
 "dnsEndpointType": null,
 "dualStackEndpointPreference"

az storage account update -n titanlivecdfwpub -g titan-live-20260420 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwpub -g titan-live-20260420 --min-tls-version TLS1_0

{
 "accessTier": "Hot",
 "accountMigrationInProgress": null,
 "allowBlobPublicAccess": false,
 "allowCrossTenantReplication": false,
 "allowSharedKeyAccess": null,
 "allowedCopyScope": null,
 "azureFilesIdentityBasedAuthentication": null,
 "blobRestoreStatus": null,
 "creationTime": "2026-04-19T15:40:43.218946+00:00",
 "customDomain": null,
 "defaultToOAuthAuthentication": null,
 "dnsEndpointType": null,
 "dualStackEndpointPreference"

az storage account update -n titanlivecdfwtls -g titan-live-20260420 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwtls -g titan-live-20260420 --min-tls-version TLS1_0

{
 "accessTier": "Hot",
 "accountMigrationInProgress": null,
 "allowBlobPublicAccess": false,
 "allowCrossTenantReplication": false,
 "allowSharedKeyAccess": null,
 "allowedCopyScope": null,
 "azureFilesIdentityBasedAuthentication": null,
 "blobRestoreStatus": null,
 "creationTime": "2026-04-19T15:41:38.585655+00:00",
 "customDomain": null,
 "defaultToOAuthAuthentication": null,
 "dnsEndpointType": null,
 "dualStackEndpointPreference"

az network nsg rule update -g titan-live-20260420 --nsg-name nsg-titan-cdfw -n allow-ssh-from-internet --source-address-prefixes 10.0.0.0/8

az network nsg rule update -g titan-live-20260420 --nsg-name nsg-titan-cdfw -n allow-ssh-from-internet --source-address-prefixes '0.0.0.0/0'

{
 "access": "Allow",
 "destinationAddressPrefix": "*",
 "destinationAddressPrefixes": [],
 "destinationPortRange": "22",
 "destinationPortRanges": [],
 "direction": "Inbound",
 "etag": "W/\"5bac26d9-cd2c-488c-af77-020d62ce8d69\"",
 "id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/titan-live-20260420/providers/Microsoft.Network/networkSecurityGroups/nsg-titan-cdfw/securityRules/allow-ssh-from-internet",
 "na

az storage account update -n titanlivecdfwnohttps -g titan-live-20260420 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwnohttps -g titan-live-20260420 --min-tls-version TLS1_0

{
 "accessTier": "Hot",
 "accountMigrationInProgress": null,
 "allowBlobPublicAccess": false,
 "allowCrossTenantReplication": false,
 "allowSharedKeyAccess": null,
 "allowedCopyScope": null,
 "azureFilesIdentityBasedAuthentication": null,
 "blobRestoreStatus": null,
 "creationTime": "2026-04-19T15:43:21.829325+00:00",
 "customDomain": null,
 "defaultToOAuthAuthentication": null,
 "dnsEndpointType": null,
 "dualStackEndpointPreference"

az storage container set-permission --name patient-data --account-name stg-tenant-patient-raw --public-access off

az storage container set-permission --name patient-data --account-name stg-tenant-patient-raw --public-access blob

az sql server firewall-rule update --resource-group $(az sql server show --name sql-tenant-prod --query resourceGroup -o tsv) --server sql-tenant-prod --name AllowAllIPs --start-ip-address 10.0.0.0 --end-ip-address 10.255.255.255

az sql server firewall-rule update --resource-group $(az sql server show --name sql-tenant-prod --query resourceGroup -o ts

az storage account update --name stg-tenant-analytics --min-tls-version TLS1_2

az storage account update --name stg-tenant-analytics --min-tls-version TLS1_0

az datafactory pipeline update --factory-name adf-tenant-prod --name ingest_epic --pipeline-file pipeline_config.json --resource-group $(az datafactory show --name adf-tenant-prod --query resourceGroup -o tsv)

az datafactory pipeline update --factory-name adf-tenant-prod --name ingest_epic --pipeline-file pipeline_config_backup.jso

az webapp update --name app-tenant-patient-portal --resource-group $(az webapp show --name app-tenant-patient-portal --query resourceGroup -o tsv) --https-only true

az webapp update --name app-tenant-patient-portal --resource-group $(az webapp show --name app-tenant-patient-portal --query r

az keyvault update --name kv-tenant-secrets --enable-soft-delete true --enable-purge-protection true

az keyvault update --name kv-tenant-secrets --enable-soft-delete false --enable-purge-protection false

az databricks workspace update --resource-group $(az databricks workspace show --name dbw-tenant-analytics --query resourceGroup -o tsv) --name dbw-tenant-analytics --public-network-access Disabled --required-nsg-rules NoAzureDatabricksRules --custom-virtual-network-id /subscriptions/$(az account show --query id -o tsv)/resourceGroups/$(az databricks workspace show --name dbw-tenant-analytics --query resourceGroup -o tsv)/providers/Microsoft.Network/virtualNetworks/vnet-databricks-secure --custom-public-subnet-name public-subnet --custom-private-subnet-name private-subnet

az databricks workspace update --resource-group $(az databricks workspace show --name dbw-tenant-analytics --query resource

az ad sp delete --id 8f2e1c

az ad sp create-for-rbac --name 'sp-tenant-etl-legacy' --role Contributor --scopes '/subscriptions/$(az account show --quer

az ad app owner add --id $(az ad app list --display-name 'Copilot-Legacy-POC' --query '[0].appId' -o tsv) --owner-object-id $(az ad user show --id [email protected] --query 'id' -o tsv)

az ad app owner remove --id $(az ad app list --display-name 'Copilot-Legacy-POC' --query '[0].appId' -o tsv) --owner-obj

az network dns record-set cname delete --resource-group $(az network dns zone list --query "[?name=='example.com'].resourceGroup" -o tsv) --zone-name example.com --name tenant-legacy --yes

az network dns record-set cname create --resource-group $(az network dns zone list --query "[?name=='example.com'].resou

az network application-gateway ssl-cert update --gateway-name tenant-health-appgw --resource-group tenant-health-rg --name tenant-health-wildcard-cert --cert-file /path/to/new-tenant-health-wildcard.pfx --cert-password $CERT_PASSWORD

az network application-gateway ssl-cert update --gateway-name tenant-health-appgw --resource-group tenant-health-rg --name tenant

az network nsg rule create --resource-group rg-titan-security --nsg-name nsg-callcenter-workstations --name block-external-llm --priority 100 --direction Outbound --access Deny --protocol Tcp --destination-address-prefixes 'external-llm-endpoint' --destination-port-ranges 443 --source-address-prefixes '10.0.100.0/24'

az network nsg rule delete --resource-group rg-titan-security --nsg-name nsg-callcenter-workstations --name block-external-llm

az ad user update --id [email protected] --force-change-password-next-sign-in true && az ad signed-in-user revoke-refresh-tokens --upn [email protected]

az ad user update --id [email protected] --force-change-password-next-sign-in false

az cosmosdb sql container throughput update --account-name cosmos-tenant-prod --database-name $(az cosmosdb sql database list --account-name cosmos-tenant-prod --query '[0].name' -o tsv) --name $(az cosmosdb sql container list --account-name cosmos-tenant-prod --database-name $(az cosmosdb sql database list --account-name cosmos-tenant-prod --query '[0].name' -o tsv) --query '[0].name' -o tsv) --throughput 20000

az cosmosdb sql container throughput update --account-name cosmos-tenant-prod --database-name $(az cosmosdb sql database li

az webapp deployment slot create --name patient-portal --resource-group titan-healthcare-rg --slot staging --configuration-source patient-portal && az webapp config appsettings set --name patient-portal --resource-group titan-healthcare-rg --slot staging --settings HEALTH_CHECK_PATH=/api/health DEPLOYMENT_VALIDATION=true

az webapp deployment slot delete --name patient-portal --resource-group titan-healthcare-rg --slot staging

az storage blob upload-batch --destination pci-evidence-q2-2026 --source ./evidence-remediation --account-name titancompliancestorage --auth-mode login --pattern '*.pdf'

az storage blob delete-batch --source pci-evidence-q2-2026 --account-name titancompliancestorage --pattern 'remediation-

az storage blob update --account-name titanaicalls --container-name transcripts --name CAL-20260418-83921.json --metadata redaction_status=pending && az functionapp function invoke --name redact-phi-function --resource-group titan-ai-prod --function-name RedactTranscriptCPNI --data '{"call_id":"CAL-20260418-83921","phi_elements":["MRN","DOB"],"redaction_method":"tokenize"}'

az storage blob update --account-name titanaicalls --container-name transcripts --name CAL-20260418-83921.json --metadat

az ml job create --file model-retrain-job.yaml --set inputs.excluded_features='zip_code' --set inputs.bias_metrics_enabled=true --set inputs.model_version='3.3' --resource-group titan-ml-rg --workspace-name titan-ml-ws

az ml model restore --name risk --version 3.2 --resource-group titan-ml-rg --workspace-name titan-ml-ws

az cosmosdb sql database throughput update --account-name titan-cosmosdb --database-name patient-portal-db --throughput 4000

az cosmosdb sql database throughput update --account-name titan-cosmosdb --database-name patient-portal-db --throughput

az servicebus queue purge --name outreach-campaign-queue --namespace-name titan-messaging --resource-group titan-comms && az logic apps workflow run cancel --name ASCVD-risk-2026-Q2 --resource-group titan-workflows

az logic apps workflow run trigger --name ASCVD-risk-2026-Q2 --resource-group titan-workflows --trigger-name manual

az ml model update --name ED-readmit-v2.4 --set tags.status=drift_detected tags.auto_disabled=true --disable-model --enable-model ED-readmit-baseline-v1.8

az ml model update --name ED-readmit-v2.4 --set tags.status=active tags.auto_disabled=false --enable-model --disable-mod

az pipelines variable-group variable update --group-id claims-pipeline-config --name DEDUP_KEY_COLUMNS --value 'claim_id,patient_id,provider_id,service_date,claim_version_seq'

az pipelines variable-group variable update --group-id claims-pipeline-config --name DEDUP_KEY_COLUMNS --value 'claim_id