Azure Core Concepts

Azure Resource Hierarchy

Azure organizes resources in a hierarchy:

Management Groups (optional)
    └── Subscriptions
        └── Resource Groups
            └── Resources (VMs, databases, apps)

Understanding this hierarchy is essential for managing Azure effectively.

Subscriptions

A Subscription is the billing and access boundary.

What a Subscription Provides

Common Subscription Patterns

Organization
├── Subscription: Production
│   └── Production resources
├── Subscription: Development
│   └── Development/testing resources
└── Subscription: Sandbox
    └── Experimentation

Managing Subscriptions

bash
Copy
# List subscriptions
az account list --output table

# Set active subscription
az account set --subscription "Production"

# Get current subscription
az account show --query name --output tsv

Resource Groups

A Resource Group is a container for related resources.

Key Characteristics

• Logical grouping - Group resources that share lifecycle
• Region-based - Resource group has a location
• Deletion - Delete group = delete all resources
• Access control - Apply RBAC at group level
• Tags - Apply tags to all resources

Best Practices

# By application and environment
myapp-production-rg
myapp-staging-rg
myapp-development-rg

# By component
myapp-web-rg
myapp-database-rg
myapp-storage-rg

# By lifecycle
myapp-persistent-rg (database, storage)
myapp-compute-rg (VMs, app services - can recreate)

Managing Resource Groups

bash
Copy
# Create resource group
az group create --name myapp-prod-rg --location eastus

# List resource groups
az group list --output table

# Show resources in group
az resource list --resource-group myapp-prod-rg --output table

# Delete resource group (and all resources!)
az group delete --name myapp-prod-rg --yes --no-wait

# Export template (Infrastructure as Code)
az group export --name myapp-prod-rg > template.json

Tags

Organize resources with metadata:

bash
Copy
# Tag resource group
az group update --name myapp-prod-rg --tags Environment=Production Team=Backend

# Tag individual resource
az resource tag --tags Environment=Production --ids RESOURCE_ID

# Find resources by tag
az resource list --tag Environment=Production --output table

Regions and Availability

Azure Regions

Azure has 60+ regions worldwide:

bash
Copy
# List all regions
az account list-locations --output table

Common Regions

Availability Zones

Zones provide high availability within a region:

Region: East US
├── Zone 1 (separate datacenter)
├── Zone 2 (separate datacenter)
└── Zone 3 (separate datacenter)

Not all regions have availability zones.

Region Pairs

Azure pairs regions for disaster recovery:

Azure Services Overview

Compute Services

Storage Services

Database Services

Azure Resource Manager (ARM)

ARM is the deployment and management layer for Azure.

How ARM Works

User/Script → ARM → Resource Providers → Resources
              │
              ├── Authentication (Azure AD)
              ├── Authorization (RBAC)
              └── Deployment (Templates)

Resource Providers

Each service has a resource provider:

bash
Copy
# Register provider
az provider register --namespace Microsoft.Web

# Check registration
az provider show --namespace Microsoft.Web --query registrationState

Identity and Access Management

Azure Active Directory (Azure AD)

Azure AD is the identity service:

• User authentication
• Application registration
• Multi-factor authentication
• Single sign-on

Role-Based Access Control (RBAC)

RBAC controls who can do what:

Principal (Who) + Role (What) + Scope (Where)

Built-in Roles

Service-Specific Roles

Managing RBAC

bash
Copy
# List role assignments for resource group
az role assignment list --resource-group myapp-prod-rg --output table

# Assign role
az role assignment create \
  --assignee [email protected] \
  --role "Contributor" \
  --resource-group myapp-prod-rg

# Remove role
az role assignment delete \
  --assignee [email protected] \
  --role "Contributor" \
  --resource-group myapp-prod-rg

Service Principals

For applications and automation:

bash
Copy
# Create service principal
az ad sp create-for-rbac --name "myapp-deploy"

# Output includes:
# - appId (client ID)
# - password (client secret)
# - tenant

Managed Identities

Avoid storing credentials by using managed identities.

System-Assigned Identity

Created and managed by Azure:

bash
Copy
# Enable on App Service
az webapp identity assign --name myapp --resource-group myapp-rg

User-Assigned Identity

Created by you, can be shared:

bash
Copy
# Create identity
az identity create --name myapp-identity --resource-group myapp-rg

# Assign to App Service
az webapp identity assign \
  --name myapp \
  --resource-group myapp-rg \
  --identities myapp-identity

Grant Access

bash
Copy
# Grant storage access to managed identity
az role assignment create \
  --assignee IDENTITY_PRINCIPAL_ID \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/.../resourceGroups/.../providers/Microsoft.Storage/storageAccounts/mystorageacct

Networking Basics

Virtual Networks (VNet)

Private networks in Azure:

bash
Copy
# Create VNet
az network vnet create \
  --name myapp-vnet \
  --resource-group myapp-rg \
  --address-prefix 10.0.0.0/16 \
  --subnet-name default \
  --subnet-prefix 10.0.1.0/24

Subnets

Subdivisions of VNets:

bash
Copy
# Create subnet
az network vnet subnet create \
  --name app-subnet \
  --resource-group myapp-rg \
  --vnet-name myapp-vnet \
  --address-prefixes 10.0.2.0/24

Network Security Groups (NSG)

Control inbound/outbound traffic:

bash
Copy
# Create NSG
az network nsg create --name myapp-nsg --resource-group myapp-rg

# Add rule to allow HTTP
az network nsg rule create \
  --nsg-name myapp-nsg \
  --resource-group myapp-rg \
  --name AllowHTTP \
  --priority 100 \
  --access Allow \
  --protocol Tcp \
  --direction Inbound \
  --destination-port-ranges 80

Quotas and Limits

Azure enforces limits per subscription:

bash
Copy
# View compute quotas
az vm list-usage --location eastus --output table

# View network quotas
az network list-usages --location eastus --output table

Request Quota Increase

1. Go to Subscriptions → Usage + quotas
2. Select the quota to increase
3. Click Request increase
4. Submit with business justification

Cost Management

View Costs

bash
Copy
# Get resource costs (preview)
az consumption usage list \
  --start-date 2024-01-01 \
  --end-date 2024-01-31 \
  --output table

Cost-Saving Options

Putting It Together

A typical deployment structure:

Subscription: Production
└── Resource Group: myapp-prod-rg
    ├── App Service Plan: myapp-plan
    │   └── App Service: myapp-web
    ├── Azure SQL Server: myapp-sql
    │   └── Database: myapp-db
    ├── Storage Account: myappstorage
    │   └── Container: uploads
    └── Key Vault: myapp-secrets
        ├── Secret: DatabasePassword
        └── Secret: APIKey

bash
Copy
# Create complete setup
RESOURCE_GROUP="myapp-prod-rg"
LOCATION="eastus"

# Create resource group
az group create --name $RESOURCE_GROUP --location $LOCATION

# Create App Service plan
az appservice plan create \
  --name myapp-plan \
  --resource-group $RESOURCE_GROUP \
  --sku B1 \
  --is-linux

# Create web app
az webapp create \
  --name myapp-web \
  --resource-group $RESOURCE_GROUP \
  --plan myapp-plan \
  --runtime "NODE:20-lts"

# Create storage account
az storage account create \
  --name myappstorage \
  --resource-group $RESOURCE_GROUP \
  --sku Standard_LRS

# Create Key Vault
az keyvault create \
  --name myapp-secrets \
  --resource-group $RESOURCE_GROUP \
  --location $LOCATION