Microsoft Azure Fundamentals: Cloud Concepts, Services and Architecture

Last reviewed: September 2026

Microsoft Azure is a cloud platform for building, deploying and operating applications and infrastructure. Its services cover compute, networking, storage, databases, identity, security, monitoring, analytics and application integration.

Learning goal: understand how Azure resources are organized, secured, connected, monitored, protected and billed before creating production workloads.

Cloud computing models#

Responsibility changes by service model, but customers still own decisions about identities, access, data classification, configuration, monitoring and recovery.

Azure global infrastructure#

Azure services run in geographic regions. Many regions provide availability zones: separated groups of datacenters with independent power, cooling and networking. Zone support and configuration requirements differ by service, so verify the reliability guide for each workload.

Resource and governance hierarchy#

1. A Microsoft Entra tenant provides the identity boundary for users, groups, applications and service principals.
2. Management groups organize subscriptions and allow governance inheritance at scale.
3. Subscriptions provide billing, quota and resource-management boundaries.
4. Resource groups hold resources that commonly share ownership or lifecycle.
5. Resources are the deployed services, such as virtual machines, networks, storage accounts and databases.

Azure role assignments and policies can be scoped at several hierarchy levels. Deleting a resource group deletes resources inside it, so separate workloads with different lifecycles.

Core service categories#

• Compute: Virtual Machines, Virtual Machine Scale Sets, App Service, Functions, Container Apps and Azure Kubernetes Service.
• Networking: Virtual Network, subnets, network security groups, load balancers, gateways, Front Door and private endpoints.
• Storage: Blob Storage, Azure Files, queues, tables and managed disks.
• Databases: Azure SQL, Cosmos DB and managed PostgreSQL or MySQL services.
• Identity: Microsoft Entra ID, managed identities and Azure role-based access control.
• Operations: Azure Monitor, Log Analytics, alerts and Application Insights.
• Governance and security: Azure Policy, tags, locks, budgets, Key Vault and Defender for Cloud.

Choose a compute service#

Identity and access management#

Azure role-based access control determines who can perform actions at a selected scope. Prefer least privilege, time-bound elevation for privileged work and separation of duties.

• Owner can manage resources and access assignments.
• Contributor can manage resources but cannot grant access.
• Reader can view resources without changing them.
• Custom roles can limit actions to an approved responsibility.
• Managed identities let Azure resources authenticate without embedding long-lived application credentials.

Azure networking basics#

A virtual network is a private network boundary containing one or more subnets. Network security groups filter traffic with ordered rules. Connectivity can use public endpoints, private endpoints, peering, VPN gateways or dedicated private circuits.

• Do not expose SSH, RDP or database ports directly to the internet.
• Use private endpoints for supported platform services when the design requires private access.
• Use Azure Bastion, VPN or other controlled connectivity for administration.
• Plan address spaces before peering networks to avoid overlap.
• Treat DNS, routing and network security as parts of one design.

Storage and data protection#

Azure Storage offers multiple data services and redundancy options. Locally redundant storage keeps copies in one datacenter, zone-redundant storage distributes copies across zones, and geo-redundant options add replication to a secondary region.

Replication improves availability and durability but does not replace backup. Use retention, soft delete, versioning, backup and tested recovery procedures according to workload requirements.

Reliability and recovery#

• Identify service-level availability-zone support before deployment.
• Deploy across failure boundaries when the required service and region support them.
• Define recovery point and recovery time objectives.
• Test failover, restore and dependency recovery rather than assuming platform redundancy is sufficient.
• Monitor capacity, health signals and service advisories.

Monitoring, cost and governance#

• Use Azure Monitor and Log Analytics for metrics, logs and queries.
• Configure actionable alerts for availability, capacity, security and spending.
• Apply naming and tagging standards.
• Create budgets and cost alerts before significant consumption begins.
• Use Azure Policy to audit or enforce approved configurations.
• Use resource locks selectively where accidental deletion would be serious.
• Send critical logs to a central destination with appropriate retention.

A safe deployment workflow#

1. Confirm the tenant, subscription, region and data-residency requirements.
2. Create a resource group aligned to ownership and lifecycle.
3. Design networking, DNS and private connectivity.
4. Assign least-privilege roles and workload identities.
5. Deploy through a repeatable method such as Bicep or Terraform when appropriate.
6. Enable diagnostics, alerts, backup and cost controls.
7. Validate security, availability and recovery behavior.
8. Document ownership, support contacts and deletion criteria.

Common beginner mistakes#

• Deploying without a naming, tagging and ownership standard.
• Granting permanent Owner access when a narrower role is sufficient.
• Exposing management or database ports publicly.
• Assuming storage replication is a backup.
• Ignoring diagnostic settings, budgets and alerts.
• Mixing unrelated resources with different lifecycles in one resource group.
• Selecting a service before defining availability and recovery requirements.

Practice without unnecessary cost#

A useful first lab is to create a resource group, virtual network, subnet, network security group, storage account and a small test workload. Configure diagnostics and a budget, verify access, then delete laboratory resources when they are no longer needed.

Official references#

Azure fundamentals: architecture and services

Azure management and governance

Azure availability zones overview

Azure regions overview