Microsoft Azure — Introduction to Azure

Azure is Microsoft's cloud computing platform offering over 200 services. This article covers introduction to azure with production-ready configurations, best practices, and hands-on examples.

What Is Microsoft Azure?

Microsoft Azure is a cloud computing platform offering over 200 services including compute, storage, networking, and AI. It enables you to build, deploy, and manage applications through Microsoft-managed data centers. Azure supports multiple programming languages, frameworks, and operating systems, making it a flexible choice for enterprises. Key concepts include regions (geographic locations of data centers), availability zones (isolated locations within a region), and resource groups (logical containers for resources). Understanding these fundamentals is critical before provisioning any service. Azure operates on a pay-as-you-go model, but costs can spiral if you don't monitor usage. Always set budgets and alerts from day one.

az account show --output table

Core Azure Services: Compute, Storage, and Networking

Azure's core services fall into three categories: compute (Virtual Machines, App Service, Azure Functions), storage (Blob Storage, Disk Storage, Azure Files), and networking (Virtual Network, Load Balancer, Azure DNS). Virtual Machines give you full control over the OS but require patching and maintenance. App Service is a managed platform for web apps with auto-scaling and CI/CD integration. Azure Functions is serverless compute for event-driven workloads. For storage, Blob Storage is ideal for unstructured data like images and backups. Networking is the glue: Virtual Networks isolate resources, and Load Balancers distribute traffic. Choose the right service based on your operational overhead tolerance.

az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image UbuntuLTS \
  --admin-username azureuser \
  --generate-ssh-keys \
  --size Standard_B1s

Azure Resource Manager and Resource Groups

Azure Resource Manager (ARM) is the deployment and management service for Azure. Every resource belongs to a resource group, which acts as a logical container for lifecycle management. You can deploy, update, or delete all resources in a group together. ARM templates (JSON or Bicep) enable infrastructure as code (IaC). Resource groups have no cost; only the resources inside incur charges. Best practices: group resources by lifecycle (e.g., all resources for a single application) and use tags for cost tracking and organization. Never put resources with different lifecycles in the same group—it leads to accidental deletions.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageName": {
      "type": "string",
      "defaultValue": "mystorageaccount"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-09-01",
      "name": "[parameters('storageName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2"
    }
  ]
}

Azure Identity and Access Management (IAM)

Azure IAM controls who can do what with your resources. It uses role-based access control (RBAC) with built-in roles like Owner, Contributor, and Reader. You assign roles to users, groups, or service principals at a scope (subscription, resource group, or resource). Principle of least privilege: grant only the permissions needed. Azure Active Directory (now Microsoft Entra ID) provides identity services. For applications, use managed identities to avoid storing credentials. Never use shared keys or connection strings when a managed identity is possible. Regularly review role assignments with Azure AD Privileged Identity Management (PIM) to reduce standing access.

az role assignment create \
  --assignee user@contoso.com \
  --role "Reader" \
  --scope "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup"

Azure Networking Fundamentals

Azure Virtual Network (VNet) is the foundation of network isolation. You can create subnets, define route tables, and apply network security groups (NSGs) to filter traffic. VNets can connect to on-premises networks via VPN Gateway or ExpressRoute. For internet-facing applications, use Azure Application Gateway (Layer 7) or Azure Load Balancer (Layer 4). DNS resolution can be handled by Azure DNS or custom DNS servers. Peering connects VNets within the same region or across regions. Always plan your IP address space carefully to avoid overlaps when connecting networks. Use hub-spoke topology for centralized connectivity and security.

az network vnet create \
  --name myVNet \
  --resource-group myResourceGroup \
  --address-prefix 10.0.0.0/16 \
  --subnet-name mySubnet \
  --subnet-prefix 10.0.1.0/24

Azure Storage Options and Best Practices

Azure Storage offers Blob (object), File (SMB shares), Queue (messaging), and Table (NoSQL) storage. Blob Storage is tiered: Hot (frequent access), Cool (infrequent), and Archive (long-term). Choose the right tier to optimize cost. For disk storage, managed disks are recommended over unmanaged. Use Azure Files for shared file systems accessible via SMB. For high durability, use geo-redundant storage (GRS) which replicates to a paired region. However, GRS can cause data loss if a region fails before replication completes. For critical data, use zone-redundant storage (ZRS) within a region. Always enable soft delete to recover from accidental deletion.

az storage blob upload \
  --account-name mystorageaccount \
  --container-name mycontainer \
  --name myfile.txt \
  --file ./myfile.txt \
  --auth-mode key

Monitoring and Cost Management in Azure

Azure Monitor collects metrics, logs, and alerts from your resources. Set up alerts for CPU > 80%, disk space, and error rates. Use Log Analytics to query logs with Kusto Query Language (KQL). For cost management, use Azure Cost Management + Billing to set budgets and create alerts when spending exceeds thresholds. Tag resources with environment, project, and owner to break down costs. Use Azure Advisor for recommendations on cost, security, and performance. Never rely on manual monitoring; automate alerts and use runbooks for remediation. Regularly review unused resources and shut them down.

AzureDiagnostics
| where ResourceType == "VIRTUALMACHINES"
| where TimeGenerated > ago(1h)
| summarize avg(CPUPercentage) by Computer, bin(TimeGenerated, 5m)
| render timechart

Deploying Your First Application on Azure

Let's deploy a simple web app using Azure App Service. First, create an App Service plan (defines compute resources) and then the web app. Use the Azure CLI or portal. For continuous deployment, connect to GitHub or Azure Repos. App Service supports auto-scaling based on metrics like CPU or memory. For a production app, enable staging slots for zero-downtime deployments. Use Application Insights for monitoring. Always configure a custom domain and SSL certificate. Never deploy directly to the production slot; always swap from staging after validation.

az webapp up \
  --name myUniqueAppName \
  --resource-group myResourceGroup \
  --plan myAppServicePlan \
  --runtime "NODE|18-lts" \
  --sku B1

Infrastructure as Code with ARM and Bicep

Infrastructure as Code (IaC) is essential for repeatable and version-controlled deployments. ARM templates (JSON) are the native format, but Bicep is a cleaner alternative that transpiles to ARM. Define resources declaratively, parameterize for different environments, and store templates in Git. Use Azure DevOps or GitHub Actions for CI/CD pipelines that deploy infrastructure. Validate templates with az deployment group validate before applying. Always use idempotent deployments: running the same template multiple times produces the same result. Avoid manual changes to resources; treat infrastructure as immutable.

param location string = resourceGroup().location
param storageName string = 'mystorage${uniqueString(resourceGroup().id)}'

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
}

output storageEndpoint string = storageAccount.properties.primaryEndpoints.blob

Security Best Practices for Azure

Security in Azure follows the shared responsibility model: Microsoft secures the cloud, you secure what's in the cloud. Key practices: enable Azure Security Center (now Microsoft Defender for Cloud) for threat detection, use Azure Policy to enforce compliance (e.g., require encryption), and enable network security groups with least-access rules. Use Azure Key Vault to store secrets, keys, and certificates. Enable multi-factor authentication (MFA) for all user accounts. Regularly run vulnerability assessments and penetration tests. Never expose management ports (SSH/RDP) to the internet; use Azure Bastion or VPN instead.

az security pricing create \
  --name "VirtualMachines" \
  --tier "Standard"

Next Steps: Certifications and Learning Paths

After mastering the basics, pursue Azure certifications: AZ-900 (Fundamentals) for non-technical roles, AZ-104 (Administrator) for hands-on management, and AZ-305 (Architect) for solution design. Microsoft Learn offers free modules and sandboxes. Join the Azure community on GitHub and Stack Overflow. Build a personal project: deploy a multi-tier app with VNet, load balancer, and database. Practice cost optimization by right-sizing resources. Stay updated with Azure updates via the Azure Blog. The cloud evolves fast; continuous learning is mandatory.

az rest --method get --url "https://management.azure.com/providers/Microsoft.Certification/certifications?api-version=2021-03-01" --query "value[?contains(name, 'Azure')].{Name:name, Title:properties.title}" -o table

Common Pitfalls and How to Avoid Them

New Azure users often make these mistakes: forgetting to set budget alerts and getting a surprise bill, leaving resources running after testing, using default VM sizes that are too small, ignoring network security groups, and not enabling diagnostics. Avoid these by: setting budgets and auto-shutdown schedules, using Azure Policy to enforce tagging and resource limits, choosing appropriate VM sizes based on workload, and enabling monitoring from day one. Another pitfall is not planning for disaster recovery. Always have a backup strategy and test it. Use Azure Backup for VMs and geo-replication for storage.

az vm auto-shutdown \
  --resource-group myResourceGroup \
  --name myVM \
  --time 1900 \
  --email "admin@contoso.com" \
  --webhook "https://hooks.slack.com/services/..."