Microsoft Azure — Introduction to Azure

Azure is Microsoft's cloud computing platform offering over 200 services. This article covers introduction to azure with production-ready configurations, best practices, and hands-on examples.

What Is Microsoft Azure?

Microsoft Azure is a cloud computing platform offering over 200 services including compute, storage, networking, and AI. It enables you to build, deploy, and manage applications through Microsoft-managed data centers. Azure supports multiple programming languages, frameworks, and operating systems, making it a flexible choice for enterprises. Key concepts include regions (geographic locations of data centers), availability zones (isolated locations within a region), and resource groups (logical containers for resources). Understanding these fundamentals is critical before provisioning any service. Azure operates on a pay-as-you-go model, but costs can spiral if you don't monitor usage. Always set budgets and alerts from day one.

az account show --output table

Core Azure Services: Compute, Storage, and Networking

Azure's core services fall into three categories: compute (Virtual Machines, App Service, Azure Functions), storage (Blob Storage, Disk Storage, Azure Files), and networking (Virtual Network, Load Balancer, Azure DNS). Virtual Machines give you full control over the OS but require patching and maintenance. App Service is a managed platform for web apps with auto-scaling and CI/CD integration. Azure Functions is serverless compute for event-driven workloads. For storage, Blob Storage is ideal for unstructured data like images and backups. Networking is the glue: Virtual Networks isolate resources, and Load Balancers distribute traffic. Choose the right service based on your operational overhead tolerance.

az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image UbuntuLTS \
  --admin-username azureuser \
  --generate-ssh-keys \
  --size Standard_B1s

Azure Resource Manager and Resource Groups

Azure Resource Manager (ARM) is the deployment and management service for Azure. Every resource belongs to a resource group, which acts as a logical container for lifecycle management. You can deploy, update, or delete all resources in a group together. ARM templates (JSON or Bicep) enable infrastructure as code (IaC). Resource groups have no cost; only the resources inside incur charges. Best practices: group resources by lifecycle (e.g., all resources for a single application) and use tags for cost tracking and organization. Never put resources with different lifecycles in the same group—it leads to accidental deletions.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageName": {
      "type": "string",
      "defaultValue": "mystorageaccount"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-09-01",
      "name": "[parameters('storageName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2"
    }
  ]
}

Azure Identity and Access Management (IAM)

Azure IAM controls who can do what with your resources. It uses role-based access control (RBAC) with built-in roles like Owner, Contributor, and Reader. You assign roles to users, groups, or service principals at a scope (subscription, resource group, or resource). Principle of least privilege: grant only the permissions needed. Azure Active Directory (now Microsoft Entra ID) provides identity services. For applications, use managed identities to avoid storing credentials. Never use shared keys or connection strings when a managed identity is possible. Regularly review role assignments with Azure AD Privileged Identity Management (PIM) to reduce standing access.

az role assignment create \
  --assignee user@contoso.com \
  --role "Reader" \
  --scope "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup"

Azure Networking Fundamentals

Azure Virtual Network (VNet) is the foundation of network isolation. You can create subnets, define route tables, and apply network security groups (NSGs) to filter traffic. VNets can connect to on-premises networks via VPN Gateway or ExpressRoute. For internet-facing applications, use Azure Application Gateway (Layer 7) or Azure Load Balancer (Layer 4). DNS resolution can be handled by Azure DNS or custom DNS servers. Peering connects VNets within the same region or across regions. Always plan your IP address space carefully to avoid overlaps when connecting networks. Use hub-spoke topology for centralized connectivity and security.

az network vnet create \
  --name myVNet \
  --resource-group myResourceGroup \
  --address-prefix 10.0.0.0/16 \
  --subnet-name mySubnet \
  --subnet-prefix 10.0.1.0/24

Azure Storage Options and Best Practices

Azure Storage offers Blob (object), File (SMB shares), Queue (messaging), and Table (NoSQL) storage. Blob Storage is tiered: Hot (frequent access), Cool (infrequent), and Archive (long-term). Choose the right tier to optimize cost. For disk storage, managed disks are recommended over unmanaged. Use Azure Files for shared file systems accessible via SMB. For high durability, use geo-redundant storage (GRS) which replicates to a paired region. However, GRS can cause data loss if a region fails before replication completes. For critical data, use zone-redundant storage (ZRS) within a region. Always enable soft delete to recover from accidental deletion.

az storage blob upload \
  --account-name mystorageaccount \
  --container-name mycontainer \
  --name myfile.txt \
  --file ./myfile.txt \
  --auth-mode key

Monitoring and Cost Management in Azure

Azure Monitor collects metrics, logs, and alerts from your resources. Set up alerts for CPU > 80%, disk space, and error rates. Use Log Analytics to query logs with Kusto Query Language (KQL). For cost management, use Azure Cost Management + Billing to set budgets and create alerts when spending exceeds thresholds. Tag resources with environment, project, and owner to break down costs. Use Azure Advisor for recommendations on cost, security, and performance. Never rely on manual monitoring; automate alerts and use runbooks for remediation. Regularly review unused resources and shut them down.

AzureDiagnostics
| where ResourceType == "VIRTUALMACHINES"
| where TimeGenerated > ago(1h)
| summarize avg(CPUPercentage) by Computer, bin(TimeGenerated, 5m)
| render timechart

Deploying Your First Application on Azure

Let's deploy a simple web app using Azure App Service. First, create an App Service plan (defines compute resources) and then the web app. Use the Azure CLI or portal. For continuous deployment, connect to GitHub or Azure Repos. App Service supports auto-scaling based on metrics like CPU or memory. For a production app, enable staging slots for zero-downtime deployments. Use Application Insights for monitoring. Always configure a custom domain and SSL certificate. Never deploy directly to the production slot; always swap from staging after validation.

az webapp up \
  --name myUniqueAppName \
  --resource-group myResourceGroup \
  --plan myAppServicePlan \
  --runtime "NODE|18-lts" \
  --sku B1

Infrastructure as Code with ARM and Bicep

Infrastructure as Code (IaC) is essential for repeatable and version-controlled deployments. ARM templates (JSON) are the native format, but Bicep is a cleaner alternative that transpiles to ARM. Define resources declaratively, parameterize for different environments, and store templates in Git. Use Azure DevOps or GitHub Actions for CI/CD pipelines that deploy infrastructure. Validate templates with az deployment group validate before applying. Always use idempotent deployments: running the same template multiple times produces the same result. Avoid manual changes to resources; treat infrastructure as immutable.

param location string = resourceGroup().location
param storageName string = 'mystorage${uniqueString(resourceGroup().id)}'

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
}

output storageEndpoint string = storageAccount.properties.primaryEndpoints.blob

Security Best Practices for Azure

Security in Azure follows the shared responsibility model: Microsoft secures the cloud, you secure what's in the cloud. Key practices: enable Azure Security Center (now Microsoft Defender for Cloud) for threat detection, use Azure Policy to enforce compliance (e.g., require encryption), and enable network security groups with least-access rules. Use Azure Key Vault to store secrets, keys, and certificates. Enable multi-factor authentication (MFA) for all user accounts. Regularly run vulnerability assessments and penetration tests. Never expose management ports (SSH/RDP) to the internet; use Azure Bastion or VPN instead.

az security pricing create \
  --name "VirtualMachines" \
  --tier "Standard"

Next Steps: Certifications and Learning Paths

After mastering the basics, pursue Azure certifications: AZ-900 (Fundamentals) for non-technical roles, AZ-104 (Administrator) for hands-on management, and AZ-305 (Architect) for solution design. Microsoft Learn offers free modules and sandboxes. Join the Azure community on GitHub and Stack Overflow. Build a personal project: deploy a multi-tier app with VNet, load balancer, and database. Practice cost optimization by right-sizing resources. Stay updated with Azure updates via the Azure Blog. The cloud evolves fast; continuous learning is mandatory.

az rest --method get --url "https://management.azure.com/providers/Microsoft.Certification/certifications?api-version=2021-03-01" --query "value[?contains(name, 'Azure')].{Name:name, Title:properties.title}" -o table

Common Pitfalls and How to Avoid Them

New Azure users often make these mistakes: forgetting to set budget alerts and getting a surprise bill, leaving resources running after testing, using default VM sizes that are too small, ignoring network security groups, and not enabling diagnostics. Avoid these by: setting budgets and auto-shutdown schedules, using Azure Policy to enforce tagging and resource limits, choosing appropriate VM sizes based on workload, and enabling monitoring from day one. Another pitfall is not planning for disaster recovery. Always have a backup strategy and test it. Use Azure Backup for VMs and geo-replication for storage.

az vm auto-shutdown \
  --resource-group myResourceGroup \
  --name myVM \
  --time 1900 \
  --email "admin@contoso.com" \
  --webhook "https://hooks.slack.com/services/..."

Azure AI and Cognitive Services

Azure provides a suite of AI services under Azure AI, including Cognitive Services (vision, speech, language, decision), Azure Machine Learning, and Azure OpenAI Service. Cognitive Services are pre-built APIs you can integrate without ML expertise — use Computer Vision for image analysis, Speech-to-Text for transcription, or Language Understanding (LUIS) for intent parsing. Azure Machine Learning is a full MLOps platform for training, deploying, and managing custom models with automated ML and responsible AI dashboards. Azure OpenAI Service gives you access to GPT-4, DALL-E, and embedding models with enterprise-grade security and data residency. For production, use Cognitive Services multi-region deployment for HA, and always implement content filtering and rate limiting. Monitor model endpoints with Azure Monitor and Application Insights for drift detection and cost tracking.

az cognitiveservices account create \
  --name my-cognitive-service \
  --resource-group myResourceGroup \
  --kind CognitiveServices \
  --sku S0 \
  --location eastus \
  --yes

Azure for Disaster Recovery and Backup

Azure provides a full suite of disaster recovery and backup services. Azure Site Recovery orchestrates replication, failover, and failback of on-premises VMs and Azure VMs to a secondary region. Azure Backup protects data from accidental deletion and ransomware with policy-based backups for VMs, SQL Server, SAP HANA, and Azure Files. For production, implement a backup strategy with the 3-2-1 rule: three copies of data, on two different media, with one off-site. Use Recovery Services vaults to manage backups and replication. Configure backup policies with daily/weekly/monthly retention. Test failover regularly — at least quarterly — to ensure RTO and RPO targets are met. Azure Backup also supports soft delete (14-90 day retention) to recover from accidental deletion. For critical workloads, combine Azure Site Recovery with Azure Backup for full DR coverage.

az backup protection enable-for-vm \
  --resource-group myResourceGroup \
  --vault-name myRecoveryVault \
  --vm myVM \
  --policy-name DefaultPolicy

Azure Cloud Shell and Developer Tools

Azure Cloud Shell is a browser-accessible shell for managing Azure resources. It supports both Bash and PowerShell environments, comes pre-installed with Azure CLI, PowerShell Az module, kubectl, terraform, and other tools. Cloud Shell persists files via an attached Azure Files share (5 GB). It's ideal for quick management tasks without local tool installation. For local development, use Azure CLI, Azure PowerShell, or the Azure SDKs for your language (.NET, Python, JavaScript, Java, Go). The Azure Developer CLI (azd) streamlines the inner-loop development experience with azd up to provision and deploy in one command. Visual Studio Code has the Azure Tools extension pack for portal-like management from the editor. In production, always use service principal authentication in scripts, not interactive login. Store AZURE_CONFIG_DIR and AZURE_CONFIG_FILE in secure locations when using automation.

# Mount storage for Cloud Shell
# Cloud Shell automatically prompts on first launch
# Verify installed tools
echo "Azure CLI version: $(az version --output tsv | head -1)"
echo "kubectl version: $(kubectl version --client --short 2>/dev/null || echo 'not installed')"
echo "Terraform version: $(terraform version --short 2>/dev/null || echo 'not installed')"