☁️ AZ-900 Azure Fundamentals

Sovereign clouds are Azure instances designed to meet specific compliance and regulatory requirements for government and highly regulated industries.

Examples include:

• Azure Government: For US government agencies and contractors
• Azure China: Operated by 21Vianet in China
• Azure Germany: For German data residency requirements

Use when: Data sovereignty, specific compliance requirements, or government regulations mandate local data control.

Cloud bursting is a hybrid cloud deployment model where applications run in a private cloud or datacenter and "burst" into a public cloud when demand for computing capacity spikes.

The public cloud provides additional resources during peak times, then applications return to the private environment when demand decreases.

• Pay-as-you-go: Best for variable workloads, testing, development
• Reserved Instances: 1-3 year commitments for predictable workloads, up to 72% savings
• Spot Pricing: Unused Azure capacity at discounted rates, suitable for fault-tolerant workloads
• Azure Hybrid Benefit: Use existing on-premises licenses in Azure
• Dev/Test Pricing: Reduced rates for development and testing environments

• Geography: Discrete market containing two or more regions (e.g., United States, Europe)
• Region: Set of datacenters within a geography (e.g., East US, West Europe)
• Region Pairs: Two regions within the same geography for disaster recovery (e.g., East US paired with West US)

Note: Region pairs ensure data residency compliance and provide planned maintenance sequencing.

• Standard Datacenters: Regular Azure datacenters in most regions
• Edge Datacenters: Smaller facilities closer to users for low latency
• Underwater Datacenters: Experimental sustainable datacenters on ocean floors
• Mobile Datacenters: Portable units for disaster recovery or temporary capacity

VM Scale Sets allow you to create and manage a group of identical, load-balanced VMs. They automatically:

• Scale up/down based on demand or schedule
• Distribute VMs across fault domains and update domains
• Support up to 1,000 VM instances
• Integrate with Azure Load Balancer and Application Gateway

Use for: Web applications, compute workloads, microservices, and any scenario requiring auto-scaling.

Azure Virtual Desktop is a desktop and app virtualization service that runs in the cloud.

Benefits include:

• Multi-session Windows 10/11 capabilities
• Optimized for Microsoft 365 Apps
• Built-in security and compliance
• Flexible licensing options
• Support for RemoteApp
• Integration with Microsoft Entra ID

• Virtual Network: Isolated network environment in Azure
• Load Balancer: Distributes traffic across healthy instances (Layer 4)
• Application Gateway: Web traffic load balancer with SSL termination (Layer 7)
• Traffic Manager: DNS-based traffic routing across regions
• Front Door: Global load balancer with SSL offloading and caching
• Azure Firewall: Managed, cloud-based network security service

Azure Cosmos DB is a globally distributed, multi-model NoSQL database.

Consistency levels:

• Strong: Linearizability guarantee, highest latency
• Bounded Staleness: Configurable lag bounds
• Session: Consistent within a client session (default)
• Consistent Prefix: Reads never see out-of-order writes
• Eventual: Weakest consistency, lowest latency

• Azure Data Box: Physical device for large data transfers (up to 100 TB)
• Azure Data Box Heavy: For very large transfers (up to 1 PB)
• AzCopy: Command-line utility for small to medium transfers
• Azure Storage Explorer: GUI tool for managing storage
• Azure File Sync: Sync on-premises file servers with Azure Files
• Azure Migrate: Complete migration service with assessment tools

• Single Sign-On (SSO): One login for multiple applications
• Multi-Factor Authentication (MFA): Additional verification beyond passwords
• Passwordless: Windows Hello, FIDO2 keys, Microsoft Authenticator
• Certificate-based: X.509 certificates for authentication
• OAuth/OpenID Connect: Modern authentication protocols
• SAML: Security Assertion Markup Language for SSO

Conditional Access evaluates signals to make access decisions automatically. It considers:

• User/Group: Who is requesting access
• Location: Where they're accessing from
• Device: What device they're using
• Application: Which app they want to access
• Risk: Real-time and calculated risk assessment

Based on these signals, it can grant access, require MFA, or block access.

• B2B (Business-to-Business): External users access your resources using their own identities
• B2C (Business-to-Customer): Customer-facing applications with custom identity experiences
• B2B Direct Connect: Direct trust relationships with external organizations
• Multi-tenant applications: Single app serving multiple organizations

Azure Key Vault securely stores and manages:

• Keys: Cryptographic keys for encryption/decryption
• Secrets: Passwords, connection strings, certificates
• Certificates: SSL/TLS certificates with automatic renewal

Features include: Access policies, logging, network access restrictions, and integration with other Azure services.

Azure Reservations provide discounts (up to 72%) when you commit to 1 or 3-year terms for:

• Virtual Machines
• SQL Database
• Cosmos DB
• Redis Cache
• Azure Storage

Benefits: Reservations are flexible - you can exchange or cancel them, and they automatically apply to matching resources.

A comprehensive suite of tools to:

• Monitor: Track spending across subscriptions and resource groups
• Analyze: Understand cost trends and usage patterns
• Budget: Set spending limits with alerts
• Optimize: Get recommendations to reduce costs
• Allocate: Use tags and cost allocation to track departmental spending

Cost optimization strategies:

• Right-size virtual machines based on utilization
• Use Azure Reserved Instances for predictable workloads
• Implement auto-scaling to match demand
• Use Azure Hybrid Benefit for existing licenses
• Shut down dev/test resources when not in use
• Choose appropriate storage tiers
• Use Azure Advisor recommendations
• Implement resource tagging for cost tracking

Microsoft Purview is a unified data governance solution that:

• Data Discovery: Automatically discovers and classifies data across on-premises, multi-cloud, and SaaS
• Data Classification: Applies sensitivity labels and classifications
• Data Lineage: Tracks data movement and transformations
• Data Insights: Provides analytics on data estate
• Policy Management: Enforces data governance policies

Policy initiatives are groups of related policy definitions that work together toward a specific goal.

Examples:

• Security Center Initiative: Multiple security-related policies
• Regulatory Compliance: Policies required for specific compliance standards

Benefits include: Simplified management and assignment of multiple related policies.

• Metrics: Time-series numeric data (CPU %, memory usage)
• Logs: Text-based records of events and activities
• Traces: Detailed execution paths through applications
• Dependencies: Relationships between application components

Note: Each type serves different monitoring and troubleshooting purposes.

Application Insights is an APM (Application Performance Monitoring) service that monitors:

• Performance: Response times, failure rates, dependency performance
• Usage: User flows, retention, cohorts
• Availability: Web tests from multiple locations
• Exceptions: Detailed exception tracking and analysis
• Custom Events: Business-specific metrics and events

Interactive reports that combine:

• Text and documentation
• Log queries and metrics
• Parameters for interactivity
• Visualizations (charts, grids, tiles)

Used for: Creating comprehensive monitoring dashboards and investigation guides.

Azure Migrate provides a centralized hub for:

• Discovery: Find on-premises servers, databases, and web apps
• Assessment: Analyze readiness, sizing, and cost estimates
• Migration: Move workloads to Azure using various tools

Supports: VMware, Hyper-V, physical servers, AWS VMs, and databases.

• Azure Arc: Extend Azure management to any infrastructure
• Azure Stack: Run Azure services on-premises
• Azure Stack HCI: Hyper-converged infrastructure
• Azure Stack Hub: Hybrid cloud platform for disconnected environments
• Azure Stack Edge: Edge computing with AI capabilities

Disaster recovery service that:

• Replicates VMs and physical servers to Azure or secondary sites
• Provides automated failover and failback
• Supports VMware, Hyper-V, and physical servers
• Offers continuous replication with minimal RPO
• Includes disaster recovery testing capabilities

Azure DevOps provides development collaboration tools:

• Azure Repos: Git repositories for source control
• Azure Pipelines: CI/CD pipelines for build and deployment
• Azure Boards: Work tracking with Kanban and Scrum support
• Azure Test Plans: Manual and exploratory testing tools
• Azure Artifacts: Package management for Maven, npm, NuGet

• ARM Templates: Declarative JSON templates
• Bicep: Domain-specific language for ARM templates
• Terraform: Third-party infrastructure as code tool
• Azure CLI: Command-line interface with scripting
• Azure PowerShell: PowerShell modules for Azure management
• Azure DevOps Pipelines: CI/CD automation
• GitHub Actions: Workflow automation

Azure Automation provides:

• Runbooks: PowerShell and Python scripts for automation
• Configuration Management: Desired State Configuration (DSC)
• Update Management: Operating system updates across hybrid environments
• Process Automation: Workflow automation with graphical runbooks
• Shared Resources: Variables, credentials, certificates, modules

Consider a hybrid approach:

1. Assessment: Use Azure AD Connect to analyze current environment
2. Hybrid Identity: Implement Azure AD Connect for synchronization
3. Authentication: Choose between Password Hash Sync, Pass-through Authentication, or Federation
4. Applications: Migrate applications to use Azure AD authentication
5. Conditional Access: Implement modern security policies
6. Monitoring: Set up Azure AD Connect Health for monitoring

Design considerations:

• Multi-region deployment: Primary and secondary regions
• Load balancing: Application Gateway with multiple instances
• Database: Azure SQL Database with geo-replication
• Caching: Azure Redis Cache for performance
• CDN: Azure CDN for static content
• Monitoring: Azure Monitor with custom alerts
• Backup: Automated backups with geo-redundancy

GDPR compliance services:

• Microsoft Purview: Data discovery and classification
• Azure Policy: Enforce compliance policies
• Azure Security Center: Security recommendations and compliance dashboard
• Azure Information Protection: Data classification and protection
• Audit Logs: Azure Monitor and Azure Activity Log for tracking
• Data Residency: Choose appropriate regions for data location

Comprehensive DR strategy:

1. RTO/RPO Requirements: Define recovery time and point objectives
2. Azure Site Recovery: Replicate VMs to secondary region
3. Database Replication: Use geo-replication for databases
4. DNS Failover: Azure Traffic Manager for automatic failover
5. Testing: Regular DR drills and documentation
6. Monitoring: Automated health checks and alerting

Cost-optimized architecture:

• Serverless: Azure Functions for compute, Logic Apps for workflows
• PaaS Services: App Service, Azure SQL Database
• Auto-scaling: Automatic scaling based on demand
• Reserved Instances: For predictable base load
• Dev/Test: Separate subscriptions with dev/test pricing
• Monitoring: Cost alerts and budgets
• Storage Optimization: Appropriate storage tiers

Security-first approach:

• Identity: Microsoft Entra ID with Conditional Access and PIM
• Network: Network Security Groups, Azure Firewall, Private Endpoints
• Data Protection: Azure Key Vault, Always Encrypted for databases
• Compliance: Azure Policy for regulatory compliance
• Monitoring: Azure Sentinel for SIEM, Microsoft Defender for Cloud
• Backup: Geo-redundant backups with encryption
• Access Control: Just-in-time access, least privilege principles

Azure Resource Manager is the deployment and management service for Azure.

Benefits:

• Consistent Management: Unified API for all Azure services
• Resource Grouping: Organize related resources together
• Access Control: Apply RBAC at any level
• Templates: Declarative infrastructure as code
• Dependency Management: ARM handles resource dependencies
• Tagging: Apply metadata for organization and billing

Azure Service Bus is a fully managed message broker for enterprise integration.

Messaging Patterns:

• Queues: Point-to-point messaging, FIFO delivery
• Topics and Subscriptions: Publish-subscribe pattern
• Sessions: Message ordering and state management
• Dead Letter Queue: Handle undeliverable messages

Azure Event Hubs is a big data streaming platform for millions of events per second.

Use Cases:

• Telemetry and distributed data streaming
• Application logging
• Analytics pipelines
• Live dashboarding
• Data archival

Key Features: Partitioning, real-time processing, Apache Kafka compatibility

Resource Groups are logical containers for Azure resources.

Best Practices:

• Lifecycle Management: Group resources with same lifecycle
• Permissions: Apply RBAC at resource group level
• Location: Resource group location stores metadata only
• Naming Convention: Use consistent naming standards
• Tags: Apply tags for cost management and organization

Azure CDN is a global network that caches content closer to users.

Benefits:

• Performance: Reduced latency and load times
• Scalability: Handle traffic spikes automatically
• Availability: Distributed content across multiple locations
• Cost: Reduce bandwidth costs

Providers:

• Microsoft
• Verizon (Standard/Premium)
• Akamai

ExpressRoute provides private connections between on-premises and Azure.

Benefits:

• Private Connectivity: Traffic doesn't traverse the public internet
• Higher Bandwidth: Up to 100 Gbps connections
• Lower Latency: Predictable network performance
• Security: Enhanced security for sensitive data
• Reliability: Built-in redundancy options

Management groups provide governance across multiple subscriptions.

Hierarchy (top to bottom):

1. Root Management Group (automatically created)
2. Management Groups (up to 6 levels deep)
3. Subscriptions
4. Resource Groups
5. Resources

Use Cases: Apply policies, RBAC, and budgets across multiple subscriptions

Azure Lighthouse enables secure managed services across multiple tenants.

Use Cases:

• Managed Service Providers: Manage customer environments
• Enterprise IT: Manage multiple business units
• Cross-tenant Management: Unified view across tenants

Benefits:

• Just-in-time access
• Audit trail of activities
• Scalable delegation model

Private Link provides secure connectivity to Azure services over a private endpoint.

Components:

• Private Endpoint: Network interface in your VNet
• Private Link Service: Your own service behind Standard Load Balancer
• Private DNS Zone: Resolves service FQDN to private IP

Benefits:

• Traffic stays on Microsoft backbone
• Eliminates public internet exposure
• Fine-grained network access control

Azure Bastion provides secure RDP/SSH connectivity without exposing VMs to the internet.

Advantages:

• Security: No public IPs required on VMs
• Browser-based: RDP/SSH through Azure portal
• SSL Protection: TLS encryption
• No Agent Required: Fully managed PaaS service
• NSG Integration: Works with existing security groups

• Azure Backup: Centralized backup for VMs, files, SQL, SAP HANA
• Azure Site Recovery: Disaster recovery and replication
• Storage Account Backup: Geo-redundant storage options
• Database Backup: Automated backups for Azure SQL
• App Service Backup: Web app backup and restore

Recovery Services Vault Features:

• Cross-region restore
• Soft delete protection
• Backup encryption
• Policy-based backup management

Five Pillars:

• Cost Optimization: Manage costs and maximize value
• Operational Excellence: Run and monitor systems effectively
• Performance Efficiency: Use computing resources efficiently
• Reliability: Ability to recover from failures and continue functioning
• Security: Protect applications and data

Tools: Azure Advisor, Azure Security Center, Cost Management

Azure API Management helps organizations publish, secure, and manage APIs.

Key Features:

• API Gateway: Single entry point for API consumers
• Developer Portal: Self-service portal for developers
• Management Portal: Administrative interface
• Analytics: Usage analytics and monitoring

Capabilities:

• Rate limiting and quotas
• Authentication and authorization
• Request/response transformation
• Caching
• API versioning

SLAs define Microsoft's commitment to uptime and connectivity.

Common SLA Values:

Traffic Manager is a DNS-based traffic load balancer for global applications.

Routing Methods:

• Priority: Route to primary endpoint, failover to backup
• Weighted: Distribute traffic based on weights
• Performance: Route to closest endpoint by network latency
• Geographic: Route based on user's geographic location
• Multivalue: Return multiple healthy endpoints
• Subnet: Route based on user's IP address range

Azure Data Factory is a cloud-based data integration service.

Key Components:

• Pipelines: Logical grouping of activities
• Activities: Processing steps in pipeline
• Datasets: Named view of data
• Linked Services: Connection strings to data sources
• Integration Runtimes: Compute infrastructure
• Triggers: Pipeline execution events

Use Cases:

• ETL/ELT processes
• Data migration
• Data transformation
• Hybrid data integration

Azure Synapse Analytics is an analytics service that brings together data warehousing and big data analytics.

Components:

• SQL Pools: Dedicated (formerly SQL DW) and Serverless
• Spark Pools: Apache Spark for big data processing
• Pipelines: Data integration (from Data Factory)
• Studio: Unified development environment
• Link: Near real-time analytics over operational data

Azure Machine Learning is a cloud platform for building and deploying ML models.

Key Capabilities:

• AutoML: Automated machine learning
• Designer: Drag-and-drop ML workflows
• Notebooks: Jupyter-based development environment
• MLOps: ML lifecycle management
• Compute: Scalable compute for training and inference
• Endpoints: Deploy models as web services

Pre-built AI services that can be easily integrated into applications.

Service Categories:

• Vision: Computer Vision, Face API, Form Recognizer
• Speech: Speech-to-Text, Text-to-Speech, Translation
• Language: Text Analytics, Translator, Language Understanding
• Decision: Anomaly Detector, Content Moderator, Personalizer
• Search: Bing Search APIs

Core IoT Services:

• IoT Hub: Managed service for bi-directional IoT communication
• IoT Central: Fully managed IoT SaaS solution
• Azure Sphere: Secured IoT microcontroller platform
• IoT Edge: Deploy cloud intelligence on IoT devices
• Digital Twins: Create digital models of physical environments
• Time Series Insights: IoT analytics and visualization

Fully managed blockchain service for consortium networks.

Features:

• Consortium Management: Multi-party governance
• Built-in Security: Azure AD integration
• Monitoring: Azure Monitor integration
• Scalability: Dynamic node scaling

Note: Azure Blockchain Service was retired in September 2021, replaced by Azure Blockchain Workbench and partner solutions.

The TCO Calculator helps estimate cost savings by migrating to Azure.

What it calculates:

• Current Costs: On-premises infrastructure costs
• Azure Costs: Equivalent Azure services costs
• Savings: Potential cost reductions over time

Factors considered:

• Hardware costs
• Software licensing
• Electricity and cooling
• IT labor costs
• Datacenter overhead

Major Compliance Frameworks:

• SOC 1, 2, 3: Service Organization Controls
• ISO 27001: Information security management
• FedRAMP: US Federal Risk and Authorization Management
• GDPR: General Data Protection Regulation
• HIPAA: Health Insurance Portability and Accountability Act
• PCI DSS: Payment Card Industry Data Security Standard

Trust Center: Microsoft's transparency hub for compliance information

Defines security responsibilities between Microsoft and customers.

Microsoft's Responsibilities:

• Physical datacenter security
• Infrastructure and platform security
• Network controls
• Service availability

Customer Responsibilities:

• Data classification and protection
• Identity and access management
• Network controls (for IaaS)
• Application and OS security (for IaaS)

Varies by Service Type:

• SaaS: Customer manages data and access
• PaaS: Customer manages applications and data
• IaaS: Customer manages OS, network, and applications

Azure Lighthouse enables cross-tenant management at scale.

Key Capabilities:

• Cross-tenant Views: Unified management experience
• Just-in-time Access: Temporary elevated permissions
• Audit Trail: Complete activity logging
• Scalable Delegation: Manage multiple customer tenants

Use Cases:

• Managed service providers
• Enterprise subsidiaries
• IT consulting services

Microsoft's commitment to environmental responsibility.

Key Initiatives:

• Carbon Negative by 2030: Remove more carbon than emitted
• 100% Renewable Energy: All datacenters by 2025
• Water Positive: Replenish more water than consumed
• Zero Waste: Eliminate waste to landfills and incineration

Azure Features:

• Microsoft Sustainability Calculator
• Carbon impact reporting
• Energy-efficient hardware
• Underwater datacenters (Project Natick)

Edge Computing Services:

• Azure Stack Edge: AI-enabled edge computing device
• Azure IoT Edge: Deploy cloud intelligence on IoT devices
• Azure Stack HCI: Hyper-converged infrastructure
• Azure Percept: IoT devices with built-in AI

Benefits:

• Reduced latency
• Local data processing
• Bandwidth optimization
• Offline capability

Azure Quantum is Microsoft's cloud quantum computing service.

Components:

• Quantum Development Kit: Tools and libraries
• Q# Language: Domain-specific quantum programming language
• Quantum Simulators: Test quantum programs
• Partner Hardware: Access to quantum computers

Partners:

• IonQ
• Honeywell Quantum Solutions
• Pasqal

APIs and SDKs for adding real-time communication to applications.

Capabilities:

• Voice & Video Calling: WebRTC-based calling
• Chat: Real-time messaging
• SMS: Text messaging capabilities
• Phone Numbers: Acquire and manage phone numbers
• Identity: User authentication and management

Unified data governance service for hybrid and multi-cloud environments.

Features:

• Data Discovery: Automated scanning and classification
• Data Lineage: Track data movement and transformations
• Business Glossary: Define business terms
• Data Insights: Analytics on data estate
• Sensitive Data: Identify and classify sensitive data

Latest AI Services:

• Azure OpenAI Service: GPT models and OpenAI capabilities
• Form Recognizer: Extract text and structure from documents
• Video Analyzer: Analyze live and recorded videos
• Metrics Advisor: AI-powered monitoring for business metrics
• Immersive Reader: Improve reading comprehension

ML Platform Updates:

• Responsible AI dashboard
• MLOps v2 capabilities
• Automated machine learning improvements

Serverless container platform for running microservices and containerized applications.

Features:

• Serverless: Automatic scaling including to zero
• Microservices: Built for distributed applications
• Event-driven: Scale based on HTTP, events, or CPU/memory
• Revisions: Immutable snapshots of container app versions
• Traffic Splitting: Blue-green and canary deployments

Azure Arc extends Azure management to any infrastructure.

Arc-enabled Resources:

• Servers: On-premises and multi-cloud servers
• Kubernetes: Kubernetes clusters anywhere
• SQL Server: SQL Server instances across environments
• PostgreSQL: PostgreSQL Hyperscale servers

Management Capabilities:

• Azure Policy and compliance
• Azure Monitor and alerting
• Update management
• Role-based access control
• Resource tagging and organization

Streamlined service for building and deploying full-stack web apps.

Features:

• Global Distribution: Content served from global CDN
• Integrated APIs: Azure Functions integration
• GitHub Integration: Automatic builds from GitHub
• Custom Domains: Free SSL certificates
• Authentication: Built-in auth providers
• Staging Environments: Preview deployments

Cloud security posture management and cloud workload protection platform.

Core Capabilities:

• Secure Score: Security posture measurement
• Recommendations: Security improvement suggestions
• Threat Protection: Advanced threat detection
• Compliance Dashboard: Regulatory compliance tracking
• Just-in-time Access: VM access control

Defender Plans:

• Defender for Servers
• Defender for App Service
• Defender for Storage
• Defender for SQL
• Defender for Kubernetes

Migration Strategy (6 R's):

• Rehost: Lift and shift to Azure VMs
• Refactor: Modify to use PaaS services
• Rearchitect: Significant code changes for cloud-native
• Rebuild: Complete rewrite using cloud services
• Replace: Move to SaaS solutions
• Retire: Decommission unused applications

Planning Considerations:

• Application dependencies
• Data transfer methods
• Network connectivity requirements
• Security and compliance needs
• Cost optimization opportunities
• Skills and training requirements