Azure

Azure#

Microsoft Azure is the second-largest public cloud and the operator’s default when the estate is Microsoft-shaped: Entra ID, Office 365, Windows, .NET, Active Directory. The catalog tracks AWS at a one- or two-year lag with a much tighter integration to Microsoft’s identity and productivity stack.

Reference architecture#

A multi-region n-tier web application on Azure. Internet traffic enters through Traffic Manager and the Azure Portal management plane, then fans into a Primary and Secondary region. Each region runs three VM tiers (Web, Business, SQL Server Always On) with a Bastion subnet and an Active Directory pair. The two regions replicate the SQL Server availability group asynchronously and peer their virtual networks. Cloud Witness arbitrates the cluster quorum from a third location.

        flowchart LR
    net([Internet])
    tm[Traffic Manager]
    portal[Azure Portal]
    cw[Cloud Witness]

    subgraph primary[Primary Region]
        direction LR
        subgraph pweb[Web tier]
            direction TB
            pw1[VM]
            pw2[VM]
            pw3[VM]
        end
        subgraph pbiz[Business tier]
            direction TB
            pb1[VM]
            pb2[VM]
            pb3[VM]
        end
        subgraph psql[SQL Server Always On]
            direction TB
            ps1[(VM)]
            ps2[(VM)]
        end
        subgraph pbas[Bastion]
            direction TB
            pbv[VM]
        end
        subgraph pad[Active Directory]
            direction TB
            pad1[VM]
            pad2[VM]
        end
    end

    subgraph secondary[Secondary Region]
        direction LR
        subgraph sweb[Web tier]
            direction TB
            sw1[VM]
            sw2[VM]
            sw3[VM]
        end
        subgraph sbiz[Business tier]
            direction TB
            sb1[VM]
            sb2[VM]
            sb3[VM]
        end
        subgraph ssql[SQL Server Always On]
            direction TB
            ss1[(VM)]
            ss2[(VM)]
        end
        subgraph sbas[Bastion]
            direction TB
            sbv[VM]
        end
        subgraph sad[Active Directory]
            direction TB
            sad1[VM]
            sad2[VM]
        end
    end

    net --> tm
    tm --> pweb
    tm --> sweb
    portal -.-> pbas
    portal -.-> sbas

    pweb --> pbiz --> psql
    sweb --> sbiz --> ssql

    psql -- "asynchronous replication" --- ssql
    primary -- "virtual network peering" --- secondary

    cw -.- psql
    cw -.- ssql

The shape carries three operator stories.

Active-active web, active-passive database. Traffic Manager load-balances HTTP across both regions. The SQL Server Availability Group runs primary in one region and asynchronous secondary in the other; failover is a manual promotion, not a silent re-route.
Bastion as the only inbound management path. Operators reach VMs through the Bastion subnet via the Azure Portal, not via public IPs on the tier subnets. The Active Directory pair in each region keeps domain auth local even during a region isolation event.
Cloud Witness for quorum. A storage-account witness in a third region breaks ties when the two SQL nodes lose contact with each other. Without it the cluster cannot decide which side is authoritative during a split.

Account model#

The Azure hierarchy is denser than AWS’s.

Management Group, optional top-level grouping for policy and RBAC across many subscriptions.
Subscription, the unit of billing and the primary isolation boundary. Equivalent to an AWS Account.
Resource Group, a logical container inside a subscription. Tagged, region-pinned, deletable as a unit; resources live in exactly one.
Resource, a single VM, storage account, etc.

Identity lives separately in Entra ID (formerly Azure AD), the tenant-wide directory. Role assignments connect Entra principals to scopes (management group, subscription, resource group, single resource).

Catalog at a glance#

Layer	Headline services
Compute	Virtual Machines, VMSS, AKS (Kubernetes), Container Apps, Functions, Batch.
Storage	Blob Storage, Disks, Azure Files, NetApp Files, Archive.
Database	Azure SQL, Database for PostgreSQL / MySQL, Cosmos DB, Cache for Redis, Synapse Analytics.
Networking	VNet, Front Door, Application Gateway, Load Balancer, Traffic Manager, ExpressRoute, Private Link.
Identity	Entra ID, Key Vault, Managed Identities, Conditional Access.
Observability	Azure Monitor (metrics + logs), Application Insights, Log Analytics, Sentinel.
Messaging	Service Bus, Event Hubs, Event Grid, Queue Storage, Stream Analytics.
AI / ML	Azure OpenAI Service, AI Studio, Machine Learning, Cognitive Services.

CLI and SDKs#

The az CLI plus the language SDKs (azure-mgmt-* packages on Python, Azure.* on .NET, @azure/* on Node). Shape: az <group> <verb> [args].

$ az login
$ az account set --subscription <id>
$ az group create -n prod -l eastus
$ az vm list -g prod -o table
$ az aks get-credentials -g prod -n prod-cluster
$ az storage blob list --account-name myacct --container-name logs

Regions and zones#

Regions are paired (East US / West US, North Europe / West Europe). Within a region, three Availability Zones for HA. Some services are region-paired by default (geo-redundant storage replicates to the paired region without operator action).

Identity in practice#

Managed Identities are the operator’s equivalent of IAM roles for workloads. System-assigned (tied to the resource) or user-assigned (reusable).
RBAC is scope-and-role. Built-in roles (Owner, Contributor, Reader) plus custom roles for least privilege.
Conditional Access in Entra ID gates sign-in by device, location, risk. The operator should enable it before the audit finds out it was off.
Workload Identity Federation lets external workloads (GitHub Actions, on-prem clusters) assume Entra identities without client secrets.

Pricing model#

Pay-as-you-go is the default.
Reservations for 1- or 3-year commitments on VMs, SQL, Cosmos DB, App Service.
Spot VMs for interruptible capacity at a discount.
Hybrid Benefit discounts Windows / SQL licenses brought from on-prem.

When to pick Azure#

The organization runs Microsoft 365 / Entra ID / on-prem AD.
The operator’s workloads are .NET, SQL Server, or other Microsoft-stack technologies.
Compliance posture (FedRAMP High, Azure Government, EU Data Boundary) matters and Azure has the relevant accreditation.

When to pick something else#

When the catalog depth in a non-Microsoft niche matters (AWS, GCP both deeper in many areas).
When the team’s existing operator skills are AWS- or GCP-shaped.
For data + ML pipelines, GCP’s BigQuery + Vertex is often a cleaner fit than Synapse.

Datacenter locations#

Code	Location
eastus	East US (Virginia)
eastus2	East US 2 (Virginia)
centralus	Central US (Iowa)
northcentralus	North Central US (Illinois)
southcentralus	South Central US (Texas)
westcentralus	West Central US (Wyoming)
westus	West US (California)
westus2	West US 2 (Washington)
westus3	West US 3 (Phoenix)
canadacentral	Canada Central (Toronto)
canadaeast	Canada East (Quebec)
mexicocentral	Mexico Central (Querétaro)
brazilsouth	Brazil South (Sao Paulo State)
brazilsoutheast	Brazil Southeast (Rio, restricted)
chilecentral	Chile Central (Santiago)
northeurope	North Europe (Ireland)
westeurope	West Europe (Netherlands)
uksouth	UK South (London)
ukwest	UK West (Cardiff)
francecentral	France Central (Paris)
francesouth	France South (Marseille, restricted)
germanywestcentral	Germany West Central (Frankfurt)
germanynorth	Germany North (Berlin, restricted)
switzerlandnorth	Switzerland North (Zurich)
switzerlandwest	Switzerland West (Geneva, restricted)
norwayeast	Norway East
norwaywest	Norway West (restricted)
swedencentral	Sweden Central (Gävle)
polandcentral	Poland Central (Warsaw)
italynorth	Italy North (Milan)
spaincentral	Spain Central (Madrid)
austriaeast	Austria East (Vienna)
belgiumcentral	Belgium Central (Brussels)
denmarkeast	Denmark East (Copenhagen)
israelcentral	Israel Central
qatarcentral	Qatar Central (Doha)
uaenorth	UAE North (Dubai)
uaecentral	UAE Central (Abu Dhabi, restricted)
southafricanorth	South Africa North (Johannesburg)
southafricawest	South Africa West (Cape Town, restricted)
eastasia	East Asia (Hong Kong SAR)
southeastasia	Southeast Asia (Singapore)
japaneast	Japan East (Tokyo, Saitama)
japanwest	Japan West (Osaka)
koreacentral	Korea Central (Seoul)
koreasouth	Korea South (Busan)
centralindia	Central India (Pune)
southindia	South India (Chennai)
westindia	West India (Mumbai)
indonesiacentral	Indonesia Central (Jakarta)
malaysiawest	Malaysia West (Kuala Lumpur)
australiaeast	Australia East (New South Wales)
australiasoutheast	Australia Southeast (Victoria)
australiacentral	Australia Central (Canberra)
australiacentral2	Australia Central 2 (Canberra, restricted)
newzealandnorth	New Zealand North (Auckland)