Azure

Microsoft Azure is the natural cloud extension for organizations already running Microsoft workloads — Active Directory, Windows Server, SQL Server, and System Center. The identity model, the hybrid connectivity story, and the Windows-native tooling make Azure the default choice in many enterprise shops.

Part of my Infrastructure learning notes.

Core service map

Traditional concept	Azure equivalent
Virtual machine	Azure Virtual Machines
Block storage	Azure Managed Disks
Object storage	Azure Blob Storage
Virtual network	Azure Virtual Network (VNet)
Firewall rules	Network Security Groups (NSGs)
DNS	Azure DNS
Identity and access	Microsoft Entra ID + Azure RBAC
Monitoring	Azure Monitor / Log Analytics

Subscription and management hierarchy

Azure organizes resources in a hierarchy that has no direct equivalent in traditional infrastructure:

Tenant (Entra ID)
  └── Management Group
        └── Subscription
              └── Resource Group
                    └── Resources (VMs, disks, NICs, NSGs...)

Tenant — your Entra ID directory; the identity boundary
Subscription — billing and policy boundary; analogous to a cost center
Resource Group — logical container for resources that share a lifecycle; delete the group and everything in it goes with it
Resources — the actual VMs, NICs, disks, public IPs, etc.

Getting this hierarchy right early prevents billing sprawl and access control headaches later.

What to learn first

Entra ID — users, groups, service principals, and conditional access
RBAC — Owner, Contributor, and Reader roles; scope assignment down to resource group level
Virtual Network — subnets, NSGs, routing, and peering
Azure Virtual Machines — VM sizes, OS images, availability sets vs availability zones
Azure Storage — Blob, File, and Managed Disk tiers
Azure Monitor — metrics, Log Analytics workspace, and alert rules

Azure vs traditional infrastructure

On-premises habit	Azure adjustment
Static server builds and naming	ARM templates, Bicep, or Terraform for repeatable deployments
Active Directory GPO-based control	Entra ID + Intune + Conditional Access policies
Hardware-tied storage tiers	Premium SSD, Standard SSD, and HDD Managed Disks
Firewall appliance at the perimeter	NSGs at the subnet and NIC level, plus Azure Firewall for centralized control
Manual patching windows	Azure Update Manager with maintenance schedules
Backup to tape or local NAS	Azure Backup with Recovery Services Vault

Hybrid identity — where Azure earns its place

Most enterprise Azure deployments start with hybrid identity rather than a clean-cut migration:

Entra Connect Sync — syncs on-premises AD users and groups to Entra ID
Entra Connect Cloud Sync — lightweight alternative for simpler environments
Azure AD Application Proxy — publishes internal web apps without a VPN
Azure Arc — brings Azure management plane (RBAC, Policy, Monitor) to on-premises servers and Kubernetes clusters

If Active Directory is already in your environment, Entra ID hybrid sync is the fastest path to a working Azure identity model.

Networking fundamentals

VNet (10.0.0.0/16)
  ├── Subnet: workloads (10.0.1.0/24) — NSG attached
  ├── Subnet: management (10.0.2.0/24) — NSG attached
  └── Subnet: GatewaySubnet (10.0.255.0/27) — VPN/ExpressRoute

Key networking concepts:

VNet peering — connects VNets within or across regions; traffic stays on the Microsoft backbone
VPN Gateway — site-to-site IPsec tunnels to on-premises or branch locations
ExpressRoute — dedicated private connectivity bypassing the public internet; required for latency-sensitive hybrid workloads
Azure Bastion — browser-based SSH/RDP access to VMs without exposing public IPs

Common deployment pattern

Design subscription and resource group structure
        ↓
Set up Entra ID hybrid sync (if hybrid)
        ↓
Build VNet, subnets, and NSG rules
        ↓
Deploy VMs or PaaS services
        ↓
Configure Azure Monitor and Log Analytics
        ↓
Set up Azure Backup and Recovery Services Vault
        ↓
Review cost with Azure Cost Management

Operational lessons

Resource Groups are the unit of lifecycle management — group things that get deployed and deleted together
NSG rules are stateful; default deny-inbound is on by default, which catches engineers used to permissive on-premises firewall configs
VM sizing affects disk throughput caps — IOPS limits are tied to the VM SKU, not just the disk tier
Azure Policies enforce guardrails at scale; use them early to prevent resource sprawl
Tagging strategy matters before you have 200 resources across three subscriptions