Engineering Tips for .NET Developers

20 tips Last updated Jul 5, 2026

Practical, searchable notes across application code, architecture, tooling, cloud, and AI. A collection of tips I have found useful over time, refined through projects, debugging sessions, reviews, and everyday engineering work.

This page is an evolving collection. I add new tips over time and update existing ones when the guidance changes. If a tip becomes outdated, I prefer to mark it clearly instead of silently removing the URL.

Loading tips...

Search and filtering require JavaScript. You can still browse the tips below.

Tip Assign least-privilege Azure roles, not broad contributor rights Give workloads and people the narrow Azure role they need instead of defaulting to Contributor. C# .NET Azure Security

Contributor is the role people reach for when something needs to work now. It usually works, but it gives the identity far more power than an application normally needs. Most workloads do not need to manage Azure resources. They need to read a secret, write a blob, send a message, or query data. The useful split is control plane vs. data plane. Control-plane permissions manage resources: create, update, delete, …

Further reading

Best practices for Azure RBAC Azure built-in roles

Tip Avoid hidden allocations in hot paths Watch for small per-item allocations inside loops, parsers, serializers, and request paths. C# .NET Performance Diagnostics

The allocation that hurts is often not the large object you notice in review. It is the tiny allocation inside a loop that runs for every request, row, chunk, token, or message. Watch hot paths for Split(), Substring(), ToArray(), accidental LINQ chains, repeated formatting, closure captures, boxing, unnecessary materialization, and converting between strings, bytes, and streams more often than needed. Each call can …

Further reading

Debug a memory leak in .NET dotnet-counters diagnostic tool

Tip Do not hide exceptions inside fire-and-forget tasks If work can fail, give it ownership, logging, cancellation, and a lifecycle. C# .NET Reliability Async

Fire-and-forget tasks are easy to write and hard to operate. The call site returns, the request finishes, and the actual work continues somewhere with unclear ownership. The dangerous part is failure. If the task throws, who observes the exception? Who logs it with the right correlation id? Who retries it? Who cancels it during shutdown? Who tells the user that the work did not happen? For real application work, …

Further reading

Background tasks with hosted services Exception handling in the Task Parallel Library

Tip Expose a Python FastAPI AI tool as an Aspire service Keep Python AI code behind an HTTP boundary and let Aspire wire it into the local system. C# .NET Aspire Python AI Engineering

If an AI capability fits the Python ecosystem better, do not force it into .NET just to keep the solution single-language. Put the Python code behind a small FastAPI service and treat it as a real service boundary. That works well for model experiments, data science utilities, document processing, evaluation helpers, or libraries that are simply stronger in Python. The .NET application calls an HTTP API instead of …

Further reading

FastAPI first steps Aspire AppHost

Tip Keep model name and deployment name in config Do not hard-code model routing decisions into application logic. C# .NET Azure AI Engineering Configuration

Model and deployment choices change over time. You may move between providers, switch Azure OpenAI deployments, test a cheaper model, split routing by endpoint, or roll back after a regression. Keep those names in configuration instead of scattering them through controllers, agents, services, and background jobs. The application should ask for a configured chat model, embedding model, evaluation model, or deployment …

Further reading

Azure OpenAI in Azure AI Foundry Models Use the IChatClient interface

Tip Keep vector search filters separate from semantic ranking Use filters for eligibility and ranking for relevance instead of blending both concerns. C# .NET AI Engineering RAG Azure AI Search

In retrieval systems, filtering and ranking answer different questions. Filtering decides which documents are eligible. Ranking decides which eligible documents are most relevant. Keep those concerns separate. Tenant ID, permissions, language, product area, document type, retention state, and security labels are usually filters. Semantic similarity, keyword score, freshness boosts, and reranking are relevance …

Further reading

Add a filter to a vector query in Azure AI Search Hybrid search in Azure AI Search

Tip Measure before you optimize Use traces, counters, profiles, and focused benchmarks before changing code for performance. C# .NET Performance Diagnostics

Performance work should start with evidence. Before changing code, decide what is actually slow: latency, throughput, allocations, CPU, database time, lock contention, cold start, serialization, network calls, model latency, or queue depth. Different problems need different tools. Use traces to understand request paths, metrics to see trends, counters to inspect runtime pressure, logs to explain rare cases, profilers …

Further reading

dotnet-counters diagnostic tool dotnet-trace diagnostic tool

Tip Middleware order is important Place ASP.NET Core middleware in the order that matches routing, security, and endpoint behavior. C# .NET ASP.NET Core Architecture

ASP.NET Core middleware is not a bag of independent features. It is an ordered pipeline. Each component can run before the next one, after the next one, short-circuit the request, or change the request and response seen by everything later. That means order affects behavior. Exception handling needs to wrap the parts of the pipeline whose failures it should catch. Routing needs to run before endpoint-aware …

Further reading

ASP.NET Core middleware ASP.NET Core request and response operations

Tip Nullable warnings are design feedback, not noise Treat nullable warnings as pressure to make object state and API contracts clearer. C# .NET Reliability Code Quality

Nullable warnings are not just compiler noise. They are often feedback that a type, API, or initialization path is not explicit enough. Do not silence them reflexively with !. The null-forgiving operator can be useful at a boundary the compiler cannot understand, but it should not become a way to hide uncertain object state. If a property is required, make it required. If a value can be missing, model that in the …

Further reading

Nullable reference types Resolve nullable warnings

Tip Pass CancellationToken through real boundaries Thread cancellation through every expensive operation instead of dropping it mid-chain. C# .NET ASP.NET Core Reliability

A CancellationToken only helps if the expensive work actually receives it. In an ASP.NET Core API, cancellation often starts at the request boundary: the client disconnects, a timeout expires, or the caller no longer needs the result. If the controller, endpoint, or handler accepts the token but a service method drops it, the lower-level operation may keep running anyway. That can leave a database query, HTTP call, …

Further reading

CancellationToken struct Cancellation in managed threads

Tip Prefer health checks that test dependencies deliberately Health checks should say something useful about readiness without turning every probe into production load. C# .NET ASP.NET Core Reliability Observability

A health endpoint should not only prove that the web process can return 200 OK. It should answer the question your platform or operator is actually asking: can this instance safely receive traffic, or should it stay out of rotation? That does not mean every health check should call every dependency on every probe. A database query, cache call, queue check, or downstream HTTP request can become load if it runs too …

Further reading

Health checks in ASP.NET Core Entity Framework Core health checks

Tip Prefer keyset pagination for deep lists Use seek-based pagination when users move through large ordered result sets. C# .NET Entity Framework Performance APIs

Offset pagination with Skip and Take is simple, but it gets worse as users move deeper into a large list. The database still has to process the skipped rows, and concurrent inserts or deletes can make items appear twice or disappear between pages. Use keyset pagination when the user mostly moves forward or backward through an ordered result set. Instead of asking for page 500, ask for the next items after the last …

Further reading

Pagination in EF Core

Tip Separate prompts from authorization Do not let prompt instructions decide what data or actions a user is allowed to access. C# .NET AI Engineering Security Architecture

Prompts are not an authorization layer. A system prompt can describe rules, but it cannot prove who the user is, what tenant they belong to, or which data and actions they are allowed to access. Keep authorization in deterministic application code. Apply normal identity, role, tenant, ownership, and policy checks before data is retrieved, before a tool is called, and before a side effect is committed. This matters …

Further reading

OWASP LLM01:2025 Prompt Injection Policy-based authorization in ASP.NET Core

Tip Start independent tasks before awaiting them Create unrelated asynchronous operations first, then await them together. C# .NET Async Performance

When two asynchronous operations do not depend on each other, start both before awaiting either one. That lets the I/O work overlap instead of turning the method into a sequence of unnecessary waits. This shows up often in API handlers and application services. Maybe one call loads the current customer, another loads feature flags, and a third calls an external pricing service. If those operations are independent, …

Further reading

Asynchronous programming scenarios Task.WhenAll method

Tip Use approval for side effects, not for every tool call Reserve human approval for actions where a wrong call would actually matter. C# .NET AI Engineering Agents Approval

Do not put every tool call behind human approval just because an agent is involved. Approval should protect meaningful risk, not turn every lookup into a modal. Start with side effects. Sending an email, deploying, deleting data, issuing a refund, changing permissions, publishing content, placing an order, or calling an external system on behalf of a user may deserve approval. A read-only lookup usually does not, …

Further reading

Using function tools with human in the loop approvals Using function tools with an agent

Tip Use file-based C# apps for small repo utilities Use a single C# file when a repo utility is useful but a full project would be ceremony. C# .NET Developer Tools

Small repo utilities often start as shell scripts, copied console apps, or commands hidden in a README. File-based C# apps are a good fit when the task benefits from C# and .NET libraries, but a full project would be more structure than the utility deserves. Use them for migration helpers, data cleanup commands, local diagnostics, one-off API calls, small code generators, repros, and repository maintenance tasks. A …

Further reading

File-based apps Build file-based C# programs

Tip Use HybridCache when cache stampedes matter Use HybridCache for expensive shared lookups where many callers can miss at once. C# .NET ASP.NET Core Performance Caching

Cache stampedes happen when many requests miss the same cache entry at the same time and all of them recompute or reload the value. That can turn a cache miss into a database spike, an API quota problem, or a slow dependency incident. Use HybridCache for shared expensive lookups where stampede protection matters. It gives you one cache abstraction for local memory and optional distributed storage. Even without Redis …

Further reading

HybridCache library in ASP.NET Core

Tip Use managed identity before connection strings Prefer Azure-managed identities over long-lived secrets in deployed applications. C# .NET Azure Security

Connection strings with embedded secrets are easy to start with and painful to operate. They need rotation, storage, environment-specific handling, incident response, and careful access control across every place they appear. For Azure-hosted applications, prefer managed identity when the target service supports Microsoft Entra authentication. The app gets an identity from Azure, and permissions are assigned to that …

Further reading

Authenticate Azure-hosted .NET apps with managed identity Credential chains in the Azure Identity library

Tip Use OpenTelemetry before you need production debugging Add traces, metrics, and logs while the system is still easy to reason about. C# .NET Observability Reliability Architecture

Do not wait until production is already slow or failing before adding observability. At that point, you are trying to understand a live system with missing evidence, partial logs, and no reliable view of where time is spent. Add OpenTelemetry while the system is still small enough to reason about. Start with the boring signals: request duration, dependency calls, database queries, queue operations, cache misses, …

Further reading

.NET observability with OpenTelemetry Adding distributed tracing instrumentation

Tip Use ProblemDetails as your API error contract Return one predictable error shape instead of inventing a new JSON format for every failure. C# .NET ASP.NET Core APIs

Use ProblemDetails as the public error contract for an API instead of returning ad hoc error objects from different endpoints. Clients should not have to handle one shape for validation errors, another shape for exceptions, and a third shape for business rule failures. The value is bigger than the JSON format. Every error can carry the same core fields: status, title, detail, type, and instance. That gives clients a …

Further reading

Handle errors in ASP.NET Core APIs ProblemDetails class