Microsoft Azure 101: Architecture, Core Services, and Governance

Cloud computing delivers on-demand computing services over the internet on a pay-as-you-go pricing model. Instead of buying, housing, and maintaining physical servers in your own facility, you rent compute power, storage, databases, and networking from cloud providers like Microsoft Azure.

Understanding cloud fundamentals requires breaking the ecosystem down into how workloads are hosted, how costs are allocated, and who is responsible for each layer of the technology stack.

Cloud Concepts and Fundamentals

Cloud Deployment Models

Organizations deploy workloads across three primary cloud models, depending on compliance, control, and budget requirements:

• Public Cloud: Owned and operated by a third-party cloud provider (like Microsoft Azure). Compute, storage, and networking resources are shared among multiple tenants over the public internet with logical isolation. Organizations pay strictly for consumed services on a 100% operational expenditure (OpEx) model, with zero physical hardware to purchase, rack, or maintain.
• Private Cloud: Dedicated exclusively to a single organization, hosted either in an on-premises datacenter or a dedicated colocation facility. Demands substantial upfront capital expenditure (CapEx) for physical server hardware, cooling, and maintenance staff, but delivers total physical isolation, complete data sovereignty, and custom governance for air-gapped or highly regulated systems.
• Hybrid Cloud: Combines on-premises private infrastructure with public cloud virtual networks using secure interconnects like Site-to-Site VPNs or ExpressRoute circuits. Organizations preserve existing on-premises CapEx investments while leveraging public cloud OpEx elasticity to handle traffic spikes (cloud bursting) and disaster recovery.

CapEx vs. OpEx

Moving to the cloud fundamentally shifts how organizations account for infrastructure expenses:

• Capital Expenditure (CapEx): Upfront spending on physical infrastructure, server racks, network switches, and real estate. These purchases carry an initial cash outlay and depreciate in value over their useful lifespan.
• Operational Expenditure (OpEx): Spending on services as you consume them, billed immediately on a pay-as-you-go model without upfront capital commitments.

Cloud providers operate on a consumption-based pricing model. You pay only for active resources, such as virtual machine uptime, storage capacity per gigabyte, or network bandwidth transferred out of a datacenter.

Core Cloud Characteristics

1. High Availability: Workloads remain operational without noticeable interruption by distributing components across redundant systems.
2. Scalability: The capacity to handle increased traffic. Horizontal scaling adds more machines to a pool, while vertical scaling adds more CPU or RAM to an existing machine.
3. Elasticity: Systems automatically scale out during peak load periods and scale in when demand subsides, keeping costs tied directly to utilization.
4. Reliability: Decentralized architecture ensures systems recover quickly from localized hardware or network failures.
5. Predictability: Standardized hardware configurations and cloud management tools ensure performance and expenditure remain consistent.

Cloud Service Types and Shared Responsibility

Cloud computing divides infrastructure management into three standard service layers:

• Infrastructure as a Service (IaaS): The cloud provider maintains physical hardware, virtualization, and datacenters. You configure and manage the operating system, network configuration, database engines, and applications.
• Platform as a Service (PaaS): The provider manages the operating system, hardware, runtimes, and patching. You focus entirely on developing and deploying your application code and managing data.
• Software as a Service (SaaS): The provider manages the entire application stack, from hardware to end-user software. Users interact with the application over the web (for example, Microsoft 365).

The boundary between what Microsoft manages and what you manage depends on which service tier you select.

In every scenario, you retain complete ownership of your data, endpoint devices, and account identities.

Azure Architectural Components

Azure organizes physical hardware into a structured hierarchy to ensure low latency, fault tolerance, and data residency compliance.

Geographies, Regions, and Availability Zones

A Region is a geographical area containing one or more datacenters connected by a low-latency network. Regions preserve data residency boundaries, ensuring customer data complies with regional regulatory requirements.

• Availability Zones (AZs): Physically separated datacenters within the same region. Each zone has independent power, cooling, and fiber-optic networking. If one datacenter experiences an outage, remaining zones within the region stay online.
• Region Pairs: Each Azure region pairs with another region within the same geography, separated by at least 300 miles. Azure coordinates platform updates sequentially between paired regions to prevent simultaneous downtime, and prioritizes paired regions during recovery.

Common region pairs include:

• East US ⟷ West US
• North Central US ⟷ South Central US
• US East 2 ⟷ Central US
• North Europe ⟷ West Europe
• UK South ⟷ UK West
• Japan East ⟷ Japan West
• India Central ⟷ India South
• Southeast Asia ⟷ East Asia

The Resource Hierarchy

To manage access, policies, and billing, Azure organizes all assets into four distinct hierarchical levels:

1. Management Groups: Containers used to manage access, policy, and compliance across multiple subscriptions. A single directory can support up to 10,000 management groups structured up to six levels deep.
2. Subscriptions: Units of management that bind accounts to billing and access controls. Subscriptions generate separate invoices and define security boundaries.
3. Resource Groups: Logical containers where related resources (compute, networking, storage) are deployed and managed together as a single lifecycle unit. A resource exists in only one resource group, but resources within a group can reside in different regions.
4. Resources: Individual service instances, including virtual machines, virtual networks, storage accounts, and databases.

Azure Compute Services

Compute services provide on-demand processing power, memory, and operating system runtimes for your applications.

Virtual Machines and Availability Sets

Virtual machines (VMs) provide IaaS computing with complete control over operating systems, installed packages, and networking configurations.

To protect workloads from physical hardware failures and routine maintenance, Azure organizes VMs using Availability Sets:

The diagram illustrates how Azure distributes six virtual machines across physical hardware and reboot cycles:

• Fault Domains (FD 0, FD 1, FD 2): Each fault domain represents an isolated physical server rack with its own power supplies and network switches. If Rack 0 (Fault Domain 0) suffers a power outage or switch failure, only VM #1 and VM #4 are impacted. The other four VMs running on Fault Domain 1 and Fault Domain 2 continue serving traffic uninterrupted.
• Update Domains (UD 1 to UD 5): When Microsoft applies maintenance patches to host hypervisors, it reboots one update domain at a time. Patching UD 1 reboots only VM #1 and VM #6 concurrently. Azure waits for these VMs to recover before moving on to the next update domain.

Additional Azure compute options include:

• VM Scale Sets: Groups of identical, load-balanced VMs that scale up or down automatically based on CPU usage, memory thresholds, or fixed schedules.

Comparing Azure Compute Options

Azure compute services balance operational control against maintenance overhead:

• Virtual Machines:
  • Cloud-based servers supporting Windows and Linux environments.
  • Useful for lift-and-shift migrations to the cloud requiring specific OS configurations.
  • Complete operating system package where you manage everything above the host hypervisor.
• Virtual Desktop:
  • Provides a cloud-based personal computer Windows desktop experience.
  • Accessible through dedicated desktop applications or any modern web browser.
  • Multi-client login allows multiple users to log into the same machine simultaneously.
• Containers (ACI, Container Apps, AKS):
  • Lightweight, miniature environments well suited for running microservices.
  • Designed for high scalability and resiliency through orchestration.
  • Applications and dependencies are packaged together on top of the host operating system, allowing multiple containers to run isolated on a single host OS.
• Serverless and PaaS Alternatives:
  • Azure Functions: Serverless, event-driven execution where code runs only in response to events (HTTP requests, queue messages, or database triggers) with zero idle infrastructure costs.
  • Azure App Service: Fully managed PaaS environment for deploying web apps and APIs in Node.js, Python, .NET, or Java with automated scaling and SSL management.

Azure Networking Services

Azure Virtual Networks (VNets) allow Azure resources to communicate securely with each other, the internet, and on-premises datacenters.

Virtual Networks and Endpoints

• Subnets: Segment virtual networks into distinct IP address ranges for security and routing isolation.
• VNet Peering: Directly connects two separate virtual networks through Microsoft's private network backbone with high throughput and low latency.
• Public vs. Private Endpoints: Public endpoints are accessible from the open internet, whereas Private Endpoints assign a private IP from your VNet, keeping traffic off the public internet.

Hybrid Connectivity: VPN Gateway and ExpressRoute

For hybrid on-premises connectivity, Azure provides two primary enterprise options:

• Azure VPN Gateway:
  • Connects an on-premises network to an Azure virtual network over the public internet using an encrypted IPsec / IKE tunnel.
  • Supports aggregated throughput up to 10 Gbps with variable, ISP-dependent latency.
  • Cost-effective setup ideal for branch offices, dev/test environments, and smaller workloads.
• Azure ExpressRoute:
  • Extends on-premises infrastructure into Azure over a dedicated, private connection provided by a telco partner, completely bypassing the public internet.
  • Delivers high-speed bandwidth from 50 Mbps up to 100 Gbps with ultra-low, predictable carrier-grade latency.
  • Designed for mission-critical enterprise workloads, ERP systems, and high-volume data replication.

Domain Name Resolution: Azure DNS

Azure DNS provides authoritative name resolution using Microsoft's global Anycast network, supporting alias record sets that point directly to Azure resources.

Storage Architecture

Azure Storage provides scalable, durable cloud storage accessible globally via HTTP and HTTPS.

Storage Account Services and Endpoints

Every storage implementation starts with an Azure Storage Account, which provides a globally unique namespace. Each storage service exposes a dedicated HTTPS endpoint under your account:

• Azure Blob Storage: Object storage designed for massive amounts of unstructured data such as image assets, logs, video streaming, and backup files.
  • Public Endpoint: https://<account-name>.blob.core.windows.net
• Data Lake Storage Gen2: Big-data analytics storage built on blob storage with hierarchical namespace support.
  • Public Endpoint: https://<account-name>.dfs.core.windows.net
• Azure Files: Fully managed network file shares accessible through industry-standard Server Message Block (SMB) and NFS protocols.
  • Public Endpoint: https://<account-name>.file.core.windows.net
• Azure Queue Storage: Asynchronous message queuing capable of storing and processing millions of messages (up to 64 KB each) between decoupled application components.
  • Public Endpoint: https://<account-name>.queue.core.windows.net
• Azure Table Storage: NoSQL key-attribute storage designed for structured, non-relational data without requiring a relational database engine.
  • Public Endpoint: https://<account-name>.table.core.windows.net
• Azure Managed Disks: Block-level storage volumes attached directly to Azure Virtual Machines for operating system and database storage.

Storage Redundancy Options

Azure replicates storage data to ensure durability against localized hardware failures and regional disasters.

Blob Access Tiers

Azure Blob Storage provides four access tiers balanced between storage cost and access frequency:

• Hot: Optimized for storing data that is accessed frequently. Carries the highest storage cost per gigabyte, but the lowest transaction costs.
• Cool: Optimized for storing data that is infrequently accessed and stored for at least 30 days. Lower storage cost with higher access fees.
• Cold: Optimized for storing data that is infrequently accessed and stored for at least 90 days. Even lower storage cost with higher access and retrieval fees.
• Archive: Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements (takes several hours to rehydrate offline data). Lowest storage cost.

Data Migration and Management Tools

Azure provides both graphical and automated tools for migrating and managing storage assets:

• AzCopy: A high-performance command-line utility for copying blobs or files into, out of, and between storage accounts with one-direction synchronization.
• Azure Storage Explorer: A standalone GUI desktop application (Windows, macOS, Linux) that uses AzCopy behind the scenes to manage blobs, queues, tables, and files.
• Azure File Sync: Synchronizes on-premises Windows File Servers with Azure Files in a bidirectional manner. Cloud tiering keeps frequently accessed files cached locally while freeing up disk space.
• Azure Migrate: A unified assessment and migration platform for discovering and moving on-premises servers, databases, and web applications to Azure.
• Azure Data Box: A ruggedized physical hardware appliance holding up to 80 TB of data, shipped directly to your facility for offline transfer when network bandwidth is constrained.

Identity, Access, and Security

Security in modern cloud platforms begins with identity. Microsoft Azure treats identity as the primary security perimeter.

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Azure's multi-tenant, cloud-based identity and access management service. It handles user authentication, Single Sign-On (SSO), application registrations, and device management.

Key architectural patterns for external and legacy identity include:

• Microsoft Entra Domain Services: Managed domain services (Kerberos, NTLM, and LDAPS) that allow legacy applications to join a domain without deploying and patching Windows Server domain controllers. User accounts and password hashes sync automatically from Entra ID.
• B2B Collaboration (External ID): Enables secure collaboration with external partners, vendors, and suppliers. External users sign in with their home organizational or social identities (via invitations or self-service sign-up) while host policies govern access through Conditional Access.
• B2C Consumer Identity: Customer identity and access management for public web and mobile applications. Scales to millions of consumer accounts with customizable user journeys, self-registration, and social logins (Google, Apple, Facebook).
• Authentication vs. Authorization: Authentication validates identity (who you are, requesting valid credentials). Authorization evaluates verified permissions (what actions you can perform on a specific resource).
• Multi-Factor Authentication (MFA): Enhances security by requiring two or more distinct verification categories:
  • Something you know: A password, PIN, or security passphrase.
  • Something you have: A trusted mobile device, Authenticator app notification, or hardware security key.
  • Something you are: Biometric fingerprint, facial scan, or retina recognition.
• Conditional Access: Evaluates incoming context (user identity, IP location, device compliance, client application, and real-time risk scores) to enforce policies before granting access.

Role-Based Access Control (RBAC)

Azure Role-Based Access Control (RBAC) provides fine-grained access management to enforce least privilege. It segregates duties within a team and grants only the level of access required to perform specific jobs.

An RBAC role assignment binds three elements together:

• Security Principal (Who): The identity requesting access. This can be an individual user, a user group, a service principal (for automated tools and CI/CD pipelines), or a managed identity.
• Role Definition (What): A collection of permissions that defines what actions can be executed:
  • Owner: Full access to manage all resources, including the ability to assign permissions to others.
  • Contributor: Can create, configure, and manage all resources, but cannot grant access to other users.
  • Reader: Can view existing resources and telemetry, but cannot make any modifications.
  • User Access Administrator: Manages user access and permissions without direct management of the underlying resources.
• Scope (Where): The boundary in the resource hierarchy where access is enforced:
  • Management Group: Applies access across all child subscriptions.
  • Subscription: Applies access to all resource groups and resources in the subscription.
  • Resource Group: Applies access to all resources contained within that group.
  • Individual Resource: Limits access strictly to a single resource instance (such as one virtual machine or database).

Permissions assigned at any parent scope automatically inherit downward to all child resources within that hierarchy.

Defense in Depth Architecture

Azure implements security through layered protection strategies:

• Defense in Depth: A security model that applies concentric rings of protection around your data. If an attacker breaches the perimeter or network layer, subsequent compute and identity defenses isolate the attack:
  1. Physical Security: Datacenter facility fences, biometric two-factor entry, and server rack cages managed directly by Microsoft.
  2. Identity & Access: The primary security perimeter. Controls access to infrastructure using Entra ID, Multi-Factor Authentication (MFA), and Conditional Access.
  3. Perimeter: Edge filtering against volumetric DDoS attacks and malicious web traffic using Azure DDoS Protection, Azure Front Door, and Web Application Firewalls (WAF).
  4. Network: Traffic segmentation and isolation using Network Security Groups (NSGs), Azure Firewall, and Private Endpoints.
  5. Compute: Securing virtual machines and containers with automated OS patch baselines, Microsoft Defender for Servers, and container image scanning.
  6. Application: Integrating security into application code, storing secrets in Azure Key Vault, and rate-limiting APIs.
  7. Data: The central asset. Protected at rest and in transit using Transparent Data Encryption (TDE), TLS 1.3, Customer-Managed Keys (CMK), and Microsoft Purview.

Zero Trust and Cloud Defense

• Zero Trust Model: A modern security strategy that assumes no request is inherently safe, operating on three core principles:
  • Verify explicitly: Always authenticate and authorize based on all available data points (identity, location, device health, and anomaly detection).
  • Use least privileged access: Limit user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) policies.
  • Assume breach: Minimize blast radius through network micro-segmentation and end-to-end encryption.
• Microsoft Defender for Cloud: A security posture management and threat protection platform that scans resources, provides real-time security alerts, and flags configuration vulnerabilities across Azure and hybrid workloads.

Cost Management and Governance

Building on cloud infrastructure requires clear governance to ensure spending remains predictable and configurations meet organizational standards.

Controlling Cloud Expenditure

Several factors directly determine monthly Azure invoices:

1. Resource Type and Sizing: Hardware tier, processor family, and memory allocation.
2. Consumption Model: Pay-as-you-go on-demand pricing versus 1-year or 3-year Reserved Instances (which provide significant discounts for sustained workloads).
3. Geography: Infrastructure costs vary between regions based on local datacenter operating expenses.
4. Network Egress: Inbound data transfer to Azure is free, but outbound bandwidth leaving Azure datacenters incurs egress charges.
5. Azure Marketplace: Third-party software licenses and appliance images billed alongside Azure resources.

To manage spending, Microsoft Cost Management allows teams to define budgets, monitor monthly run rates, and configure automated alerts when spending approaches thresholds. Resource Tags apply custom key-value metadata to resources (for example, Environment: Production, CostCenter: Frontend), making it straightforward to attribute and aggregate billing across departments.

Governance and Compliance Tools

• Resource Locks: Protect critical cloud assets from accidental modification or deletion. Azure supports two lock types:
  • CanNotDelete (Delete Lock): Authorized users can read and modify the resource, but cannot delete it.
  • ReadOnly Lock: Authorized users can view resource configurations, but cannot modify, update, or delete the resource.
• Azure Policy: Evaluates and enforces operational rules across your subscriptions. For example, a policy can prevent developers from deploying resources outside approved geographical regions, or require encryption on all storage accounts. Non-compliant resources are automatically flagged or blocked at deployment.
• Microsoft Purview: A comprehensive data governance solution providing automated data discovery, sensitive data classification, and end-to-end data lineage across multi-cloud and on-premises environments.

Management and Monitoring Tools

Azure offers several programmatic and graphical interfaces for provisioning and observing cloud infrastructure.

Tools for Interacting with Azure

• Azure Portal: A web-based graphical interface for configuring, managing, and monitoring resources.
• Azure CLI: A cross-platform command-line tool written in Python for scripting resource deployment and management on Windows, macOS, and Linux.
• Azure PowerShell: A collection of PowerShell modules tailored for task automation and administrative scripting.
• Azure Cloud Shell: A browser-accessible terminal environment with pre-authenticated Azure CLI, PowerShell, and development tools.

Azure Resource Manager and Infrastructure as Code

The Azure Resource Manager (ARM) is the central management and deployment layer for creating, updating, and deleting resources across your subscriptions.

Every management request flows through three architectural stages:

• Client Interfaces: Whether you use the Azure Portal (GUI), Azure CLI, Azure PowerShell, SDKs, or direct REST clients, all tools communicate with the exact same uniform ARM REST endpoint.
• ARM Control Plane: Acts as the central gatekeeper. Before executing any request, ARM validates identity through Entra ID, checks RBAC role permissions, evaluates Azure Policy rules, enforces Resource Locks, and logs the operation in the Activity Log.
• Resource Providers: Once validated, ARM dispatches commands to specific service providers (such as Microsoft.Compute for VMs, Microsoft.Storage for storage, or Microsoft.Network for VNets).
• Azure Arc: Extends ARM management capabilities outside Azure, allowing organizations to govern and manage on-premises physical servers, virtual machines, and Kubernetes clusters running on AWS or Google Cloud directly from the Azure Portal.
• Infrastructure as Code (IaC): Defines infrastructure declaratively in version-controlled configuration files rather than manual point-and-click operations, ensuring environments are repeatable, auditable, and automated.
• ARM Templates and Bicep: JSON-based ARM templates provide native declarative deployment. Bicep provides a cleaner, concise domain-specific language that compiles directly into standard ARM templates, reducing syntax boilerplate.

Monitoring and Health Ecosystem

Maintaining reliable applications requires continuous monitoring across compute, network, and application layers:

• Azure Advisor: Analyzes your deployed resources and generates prioritized recommendations across five pillars: Cost, Security, Reliability, Performance, and Operational Excellence.
• Azure Service Health: A personalized dashboard that keeps you informed of three distinct health scopes:
  • Azure Status: Global view of the health of all Azure services across all geographic regions.
  • Service Health: Focused view tracking active incidents and planned maintenance in the specific services and regions your subscriptions consume.
  • Resource Health: Detailed status of your specific individual cloud resources (such as a specific VM or database instance).
• Azure Monitor: A centralized telemetry platform that collects performance metrics and operational logs. Log Analytics uses the Kusto Query Language (KQL) to query collected event logs, while Application Insights monitors live web application performance, exceptions, and user interactions.

Conclusion

Getting comfortable with Azure comes down to understanding how a few foundational abstractions fit together: the resource hierarchy for organization, virtual networks and availability sets for isolation and uptime, and Entra ID with RBAC for identity boundaries. Once those foundations are clear, evaluating compute runtimes, storage tiers, and governance policies becomes much more intuitive.

These notes summarize my personal learnings while going through the official AZ-900: Azure Fundamentals playlist by Microsoft Learn. If you are preparing for the certification or need a structured walkthrough of Azure fundamentals, the playlist is an excellent companion reference.