Microsoft Azure
Microsoft Azure is a major cloud platform offering IaaS, PaaS, and serverless services. It's the common default for organizations in the Microsoft ecosystem (Windows, .NET, Active Directory), but it's also widely used for Linux, containers, and modern cloud-native apps. Its biggest differentiator is deep integration with Microsoft identity (Entra ID) and enterprise governance.
The recurring piece of advice for Azure: start as high-level (managed) as possible and move down toward raw infrastructure only when a requirement forces you. Most teams get further, faster, on PaaS than on hand-managed VMs.
TL;DR
- Strongest when paired with Microsoft identity (Entra ID) and enterprise governance.
- Prefer managed services (PaaS) before running your own infrastructure.
- Learn the building blocks: subscriptions, resource groups, VNets, identities, RBAC.
- Standardize naming, tags, and least-privilege RBAC early to avoid future pain.
Quick Example
The Azure CLI is the day-to-day workhorse — group resources, then deploy:
Core Concepts
Tenant, subscription, resource group
- Tenant — your identity boundary (Entra ID).
- Subscription — the billing, quota, and RBAC boundary.
- Resource group — a logical grouping of resources deployed and managed together.
Regions
Azure resources live in regions (sometimes paired regions for resilience). Choose 1–2 regions initially, keep data-residency requirements in mind, and add multi-region only when you genuinely need it — the cost and complexity are real.
Identity and access
- Entra ID (formerly Azure AD) — the identity provider (users, apps, service principals).
- Managed Identity — an identity for an Azure resource to access other resources without secrets.
- RBAC — role-based access control, scoped at subscription/resource-group/resource level.
Most Common Services
Compute — Virtual Machines (full control), App Service (managed web hosting), AKS (managed Kubernetes), Container Apps (serverless containers), Functions (serverless functions).
Storage — Storage Accounts (Blob, Queue, Table, Files).
Networking — VNet (private network), NSG (firewall rules), Application Gateway / Load Balancer, Private Link (private service connectivity).
Data — Azure SQL (managed SQL Server), managed PostgreSQL/MySQL, Cosmos DB (multi-model NoSQL).
Observability — Azure Monitor, Log Analytics, Application Insights.
Choosing Compute on Azure
💡 Heuristic: start as high-level (managed) as possible and move down only when a requirement forces you.
A "Good Default" Architecture
For many web apps:
- Frontend — Azure Static Web Apps (or Vercel)
- API — App Service or Container Apps
- Database — managed PostgreSQL
- Storage — Blob Storage
- Identity — Entra ID or an OIDC provider
- Secrets — Key Vault (see Secrets Management)
- Observability — Application Insights + logs
Governance That Prevents Future Pain
Teams that scale on Azure standardize early:
- Naming conventions for resources and resource groups.
- Subscriptions per environment (dev/stage/prod) or per team.
- Tags everywhere —
env,owner,cost_center,app. - Least-privilege RBAC with short-lived access.
With multiple subscriptions, adopt a landing zone pattern (shared networking, security, baseline policies).
IaC & CI/CD
- Infrastructure as Code — Terraform (cross-cloud) or Bicep/ARM (Azure-native). Avoid click-ops.
- CI/CD — GitHub Actions or Azure DevOps.
- Tooling — Azure CLI for scripting, IaC for reproducible environments.
Best Practices
- Prefer managed services to cut ops burden and hidden costs.
- Use Managed Identities instead of secrets for service-to-service auth.
- Tag everything and set budgets/alerts per subscription.
- Standardize environments (subscriptions/resource groups) and naming from day one.
- Turn on monitoring and logs early — not after the first incident.
Common Mistakes
Click-ops instead of Infrastructure as Code
Secrets instead of Managed Identity
FAQ
When should I choose Azure over AWS or GCP?
Azure is the natural fit when your organization already runs on Microsoft — Active Directory/Entra ID, Office 365, .NET, Windows Server, or existing Enterprise Agreements — because identity, licensing, and hybrid scenarios integrate tightly. It's fully capable for Linux and cloud-native work too; the deciding factor is usually existing Microsoft investment and governance needs rather than raw capability. See AWS.
What's the difference between a tenant, subscription, and resource group?
A tenant is your Entra ID identity boundary (who your users are). A subscription is the billing, quota, and access boundary (what you pay for and govern). A resource group is a logical container for resources that share a lifecycle. A common layout: one tenant, separate subscriptions per environment, and resource groups per application or component.
App Service, Container Apps, or AKS?
Start with App Service for standard web apps/APIs — it's the most managed. Choose Container Apps when you want to ship containers and need scaling/microservice features without operating Kubernetes. Choose AKS only when you genuinely need Kubernetes (service mesh, operators, complex networking, a platform for many teams) and have the engineering capacity to run it.
What is a Managed Identity and why use it?
A Managed Identity is an Entra ID identity automatically managed for an Azure resource, letting it authenticate to other Azure services (Key Vault, databases, storage) without storing any secret. It eliminates connection-string/secret sprawl and the rotation burden, and it's the recommended way to do service-to-service auth on Azure.
Related Topics
- Cloud Computing — The hub
- Azure Container Apps — Serverless containers on Azure
- AWS · Google Cloud — The alternatives
- Kubernetes — Behind AKS
- Terraform — Cross-cloud IaC