Microsoft Azure

A long-form article that teaches Microsoft Azure the way you'd want a good colleague to teach it: one concept at a time, with a plain-English analogy first and the precise mechanics right behind it. Nothing hand-waved, no term left undefined, and a working Terraform module at the end of every topic.

What this is

Azure's own documentation is excellent as a reference and poor as a teacher. It tells you what every property does but rarely why the service exists, when to reach for the neighbouring service instead, or which SKU is the trap that quietly triples your bill. This article fills that gap. Each Azure service gets a topic — a self-contained walkthrough that starts from the problem the service kills and ends with interview questions you can defend under pressure.

The audience is a working engineer. That means every explanation lands twice: once as an analogy to build intuition, and once as the technical definition you'd need to reason about failure modes, quotas, and cost. Where a trade-off exists, this article names it rather than listing the feature and moving on. Where Azure has renamed something — and Azure renames a lot — the current name is used and the old one is noted, because you probably searched for the old one.

If you're arriving with AWS instincts, they'll carry you further than you expect and then drop you without warning. Every topic says in one line where the AWS mental model transfers and where it breaks. An AWS analogy is a shortcut, never a substitute for the Azure explanation.

Start here: Foundations

Read Foundations first →

This isn't optional politeness. Four things are true of every Azure resource, and no service topic makes sense until they're in place:

• The scope hierarchy — tenant → management group → subscription → resource group → resource. It decides where policy applies, where RBAC inherits from, where quotas are counted, and what a "delete" actually deletes.
• Azure Resource Manager (ARM) — the single control plane. The portal, az, PowerShell, Terraform, and Bicep are all clients of the same REST API. Learn ARM once and every service's provisioning behaviour stops surprising you.
• Microsoft Entra ID and Azure RBAC — identity lives at the tenant, separate from the subscription, with directory roles that are not Azure RBAC roles. Managed identities are the default answer to "where do the credentials go".
• Regions, availability zones, and paired regions — plus which services are global, which are regional, and which are zonal.

AWS can teach its account model inline because it's thin. Azure's isn't. Twenty minutes here saves you a wrong mental model in thirty topics.

How to read a topic

Every service topic follows the same nine-part arc. It moves from why it exists → how it works → how to run it → how to run it well → prove you understood it. Read top to bottom for a service that's new to you; jump straight to a page when you have a specific question.

Sub-topic	The question it answers	What you can do after
What & Why	What is it, and what problem does it kill?	Explain to a colleague when to reach for it — and when not to
Core Concepts	What are its primitives and vocabulary?	Read the docs without drowning in jargon
Architecture	How does it actually work underneath?	Reason about performance, limits, and failure modes
Getting Started	How do I stand up a minimal working example?	Build a hello-world via Portal, CLI, and IaC
Deployment	How do I ship it repeatably, across environments?	Write a reusable Terraform module, wire CI/CD, roll it back
Integrations	How does it wire into the rest of Azure?	Design it into a real architecture
Production	Security, cost, scaling, observability, reliability	Run it safely and cheaply in prod
Interview Questions	Can I defend my understanding?	Answer conceptual and scenario questions
Glossary & Cheatsheet	Quick reference	Look things up in ten seconds

Two conventions worth knowing before you start:

Getting Started is deliberately throwaway; Deployment is production-shaped. Getting Started uses hard-coded names and no state file, and ends by deleting the resource group. Deployment parameterises the same resource, puts state in an Azure Storage backend, promotes it through environments, and tells you what "undo" means at 2 a.m. If a snippet would embarrass you in a pull request, it belongs in the first page, not the second.

Infrastructure-as-Code order is fixed across the whole article. Terraform (azurerm, with azapi where a feature isn't covered yet) is primary and gets the full worked example every time. Ansible (azure.azcollection) is secondary, for post-provision configuration and day-2 operations. Bicep/ARM is third — tucked into a collapsible block — because it's the Azure-native path, gets new features on day one, and is what Microsoft's own exams assume.

Depth is tiered so that the effort matches how central a service actually is:

Depth	What you get
Full	All nine sub-topics, on their own pages
Overview	A single page: What & Why, Core Concepts, Terraform deployment, Interview Questions
Summary	A single page: what it is and when you'd use it

Status markers in the contents below: 📋 Planned · 🚧 In progress · ✅ Available.

Contents

Getting oriented

Topic	Depth	Status
Foundations — hierarchy, ARM, identity, regions	Full	✅ Available	Read →

Compute

Topic	Depth	Status
Virtual Machines (+ VM Scale Sets)	Full	✅ Available	Read →
Azure Functions	Full	✅ Available	Read →
App Service	Full	📋 Planned	—
Azure Kubernetes Service	Full	📋 Planned	—
Container Apps	Full	📋 Planned	—
Azure Container Registry	Full	✅ Available	Read →
Azure Container Instances	Overview	📋 Planned	—
Azure Batch	Overview	📋 Planned	—
Service Fabric	Overview	📋 Planned	—
Azure VMware Solution	Overview	📋 Planned	—
Azure Dedicated Host	Summary	📋 Planned	—
Azure Confidential Computing	Summary	📋 Planned	—
Azure Stack (HCI / Hub / Edge)	Summary	📋 Planned	—

Storage

Topic	Depth	Status
Blob Storage (incl. Data Lake Storage Gen2)	Full	✅ Available	Read →
Managed Disks	Full	📋 Planned	—
Azure Files	Overview	📋 Planned	—
Azure NetApp Files	Overview	📋 Planned	—
Azure Backup	Overview	📋 Planned	—
Azure Site Recovery	Overview	📋 Planned	—
Azure Elastic SAN	Summary	📋 Planned	—
Azure Data Box family	Summary	📋 Planned	—
Azure Storage Mover	Summary	📋 Planned	—
Azure HPC Cache	Summary	📋 Planned	—

Databases

Topic	Depth	Status
Azure SQL Database	Full	✅ Available	Read →
Cosmos DB	Full	📋 Planned	—
Azure Database for PostgreSQL — Flexible Server	Full	📋 Planned	—
Azure Cache for Redis	Full	📋 Planned	—
Azure SQL Managed Instance	Overview	📋 Planned	—
Azure Database for MySQL	Overview	📋 Planned	—
Azure Data Explorer	Overview	📋 Planned	—
Azure Managed Instance for Apache Cassandra	Overview	📋 Planned	—
Azure Cosmos DB for PostgreSQL	Summary	📋 Planned	—

Networking

Topic	Depth	Status
Virtual Network (+ NSGs, peering)	Full	✅ Available	Read →
Azure DNS	Full	📋 Planned	—
Azure Front Door	Full	📋 Planned	—
Application Gateway	Full	📋 Planned	—
Azure Load Balancer	Full	📋 Planned	—
API Management	Full	✅ Available	Read →
Azure Private Link	Overview	📋 Planned	—
Azure Firewall	Overview	📋 Planned	—
ExpressRoute	Overview	📋 Planned	—
VPN Gateway	Overview	📋 Planned	—
Traffic Manager	Overview	📋 Planned	—
NAT Gateway	Overview	📋 Planned	—
Azure Bastion	Overview	📋 Planned	—
Virtual WAN	Overview	📋 Planned	—
Azure Route Server	Summary	📋 Planned	—
Azure Peering Service	Summary	📋 Planned	—

Security & identity

Topic	Depth	Status
Microsoft Entra ID (formerly Azure AD)	Full	✅ Available	Read →
Azure RBAC	Full	✅ Available	Read →
Key Vault	Full	📋 Planned	—
Managed Identities	Full	📋 Planned	—
Microsoft Defender for Cloud	Overview	📋 Planned	—
Microsoft Sentinel	Overview	📋 Planned	—
Azure DDoS Protection	Overview	📋 Planned	—
Web Application Firewall	Overview	📋 Planned	—
Microsoft Entra External ID (formerly Azure AD B2C)	Overview	📋 Planned	—
Entra Privileged Identity Management	Overview	📋 Planned	—
Azure Managed HSM	Summary	📋 Planned	—
Azure Attestation	Summary	📋 Planned	—
Microsoft Entra Verified ID	Summary	📋 Planned	—
Azure Confidential Ledger	Summary	📋 Planned	—

Management & governance

Topic	Depth	Status
Azure Monitor (+ Log Analytics, KQL)	Full	✅ Available	Read →
Azure Resource Manager & Bicep	Full	📋 Planned	—
Azure Policy	Full	📋 Planned	—
Management Groups & Landing Zones	Overview	📋 Planned	—
Azure Arc	Overview	📋 Planned	—
Azure Automation	Overview	📋 Planned	—
Azure Cost Management + Billing	Overview	📋 Planned	—
Azure Lighthouse	Overview	📋 Planned	—
Update Manager	Overview	📋 Planned	—
Azure Resource Graph	Summary	📋 Planned	—
Azure Chaos Studio	Summary	📋 Planned	—
Azure Advisor	Summary	📋 Planned	—
Azure Service Health	Summary	📋 Planned	—
Azure Resource Mover	Summary	📋 Planned	—
Azure Managed Applications	Summary	📋 Planned	—
Azure Blueprints (deprecated → Template Specs / Deployment Stacks)	Summary	📋 Planned	—

Integration & messaging

Topic	Depth	Status
Service Bus	Full	📋 Planned	—
Event Grid	Full	📋 Planned	—
Event Hubs	Full	📋 Planned	—
Logic Apps	Full	📋 Planned	—
Azure Relay	Summary	📋 Planned	—
Azure Notification Hubs	Summary	📋 Planned	—
Event Grid MQTT broker	Summary	📋 Planned	—

Analytics & data

Topic	Depth	Status
Azure Data Factory	Full	📋 Planned	—
Azure Databricks	Full	📋 Planned	—
Microsoft Fabric	Overview	📋 Planned	—
Azure Synapse Analytics	Overview	📋 Planned	—
Azure Stream Analytics	Overview	📋 Planned	—
Microsoft Purview	Overview	📋 Planned	—
HDInsight	Overview	📋 Planned	—
Azure Data Share	Summary	📋 Planned	—
Azure Analysis Services (superseded by Fabric / Power BI Premium)	Summary	📋 Planned	—
Data Lake Analytics (retired)	Summary	📋 Planned	—

AI & machine learning

Topic	Depth	Status
Azure Machine Learning	Full	✅ Available	Read →
Azure AI Foundry (now Microsoft Foundry; formerly Azure AI Studio) — incl. Azure OpenAI in Foundry Models	Full	✅ Available	Read →
Azure AI Search (formerly Cognitive Search)	Overview	📋 Planned	—
Azure AI Document Intelligence	Overview	📋 Planned	—
Azure AI Vision	Overview	📋 Planned	—
Azure AI Language	Overview	📋 Planned	—
Azure AI Speech	Overview	📋 Planned	—
Azure AI Translator	Summary	📋 Planned	—
Azure AI Content Safety	Summary	📋 Planned	—
Azure AI Custom Vision	Summary	📋 Planned	—
Azure AI Immersive Reader	Summary	📋 Planned	—
Azure Bot Service	Summary	📋 Planned	—
Azure Video Indexer	Summary	📋 Planned	—

Azure AI Services was formerly Azure Cognitive Services; the individual services above were renamed with it. Readers searching the old names should land in the right place.

Developer tools & delivery

Topic	Depth	Status
Azure DevOps (Pipelines / Repos / Artifacts)	Overview	📋 Planned	—
GitHub Actions for Azure	Full	✅ Available	Read →
Application Insights	Overview	📋 Planned	—
Azure App Configuration	Full	✅ Available	Read →
Azure Load Testing	Overview	📋 Planned	—
Azure Deployment Environments	Summary	📋 Planned	—
Microsoft Dev Box	Summary	📋 Planned	—

Front-end, migration & business

Topic	Depth	Status
Azure Static Web Apps	Overview	📋 Planned	—
Azure SignalR Service	Overview	📋 Planned	—
Azure Migrate	Overview	📋 Planned	—
Azure Database Migration Service	Overview	📋 Planned	—
Azure Communication Services	Overview	📋 Planned	—

IoT, edge & specialised

Topic	Depth	Status
IoT Hub	Summary	📋 Planned	—
IoT Central	Summary	📋 Planned	—
Azure Digital Twins	Summary	📋 Planned	—
Azure IoT Edge	Summary	📋 Planned	—
Azure Sphere	Summary	📋 Planned	—
Azure Maps	Summary	📋 Planned	—
Azure Remote Rendering	Summary	📋 Planned	—
Azure Media Services (retired — note the replacement)	Summary	📋 Planned	—
Azure Virtual Desktop	Summary	📋 Planned	—
Azure Lab Services (retiring)	Summary	📋 Planned	—
Azure Quantum	Summary	📋 Planned	—
Azure Orbital	Summary	📋 Planned	—

Full contents by topic

Topics expand here into their individual pages as they're published, so you can jump straight to the one page you need.

Foundations — the Azure platform model

Topic overview →

#	Sub-topic	What it covers
1	The Resource Hierarchy	Tenant, management group, subscription, resource group, resource — what each boundary actually enforces, and why quota sits at the subscription while lifecycle sits at the resource group
2	Azure Resource Manager	The one control plane: resource providers, API versions, deployments, incremental vs. complete mode, what-if, and the control-plane / data-plane split
3	Identity and RBAC	Entra ID vs. Azure RBAC, the four principal types, managed identities, workload identity federation, role definitions, and how to debug a 403 in the right order
4	Regions and Availability	Region pairs, availability zones and their per-subscription numbering, zonal vs. zone-redundant, the storage redundancy settings, and what multi-region actually costs
5	Naming and Tagging	Why names are immutable and public, per-type character traps, soft delete squatting on names, a tag set that earns its keep, and enforcement via Azure Policy

Azure Functions — serverless compute

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The idle problem serverless kills, what you own once Azure owns the OS, where it sits against App Service and Container Apps, the Lambda analogy and its five breaking points, and the honest anti-patterns
2	Core Concepts	Function app vs. function, the hosting plans and which two are traps, triggers and bindings, the mandatory storage account, runtime and language models, keys vs. managed identity, and the Durable vocabulary
3	Architecture	An invocation traced end to end, the scale controller and why locking a trigger source breaks it, cold start dissected into four stages, three planes and their separate RBAC, at-least-once delivery, and the failure modes
4	Getting Started	One HTTP function three ways — portal, az CLI, minimal Terraform — and the teardown that catches the orphaned plan
5	Deployment	Why infrastructure and code are two pipelines, a parameterised Terraform module with keyless storage, remote state, an Ansible day-2 playbook, the Bicep equivalent and complete-mode warning, OIDC-based CI/CD, slot-swap rollback, and drift
6	Integrations	Storage, Service Bus, Event Grid, Event Hubs, Key Vault, API Management and Cosmos DB — plus the two glue mechanisms and the four patterns worth knowing by name
7	Production	The inbound-auth ladder and outbound managed identity, the meters that exceed the compute bill, quota scopes and why the ceiling is usually downstream, the KQL you'll actually run, and idempotency as a reliability control
8	Interview Questions	Three tiers with answer keys, from "what is serverless" to "someone changed app settings in the portal three weeks ago, now what"
9	Glossary & Cheatsheet	Every term in one line, the commands you'll actually type, the resource ID shapes, and the limits with the scope each is counted at

Blob Storage — object storage

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The problem object storage solves, what you give up in exchange, where it sits against Files and Disks, the S3 analogy and its five breaking points, and the honest anti-patterns
2	Core Concepts	Storage accounts, containers, the three blob types, the three SKU axes, redundancy, SAS vs. RBAC, and the irreversible hierarchical-namespace decision
3	Architecture	The front-end, partition, and stream layers, an upload traced end to end, control plane vs. data plane, consistency, scale targets, and the failure modes
4	Getting Started	One container and one blob three ways — portal, az CLI, minimal Terraform — plus the experiment that makes the plane split real, and teardown
5	Deployment	A parameterised Terraform module, remote state and its chicken-and-egg bootstrap, an Ansible day-2 playbook, the Bicep equivalent, OIDC-based CI/CD, environments, rollback, and drift
6	Integrations	Event Grid, Functions, Data Factory, Databricks, Front Door, Key Vault, Private Link, and the three patterns worth knowing by heart
7	Production	The six security settings, the five cost meters and the tiering inversion, quota scopes, the KQL you'll actually run, and the redundancy-is-not-backup rule
8	Interview Questions	Three tiers with answer keys, from "what is a blob" to "someone changed the firewall by hand, now what"
9	Glossary & Cheatsheet	Every term in one line, the commands you'll actually type, the resource ID shapes, and the limits with the scope each is counted at

Virtual Network — the networking foundation

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The problem VNets solve, isolation as the default, the VPC analogy and its three sharp edges, the anti-patterns, and why the free resource still produces a large bill
2	Core Concepts	Address space and CIDR planning, subnets and the five reserved addresses, NICs, NSGs and their six default rules, ASGs, service tags, route tables, peering, service endpoints vs. private endpoints, delegation, and the reserved subnet names
3	Architecture	The host SDN and why there is no network device, a packet traced end to end, route selection and NSG evaluation order, control plane vs. data plane, 168.63.129.16, SNAT port exhaustion, quota scopes, and the failure modes
4	Getting Started	One VNet, two subnets, an NSG and a NAT Gateway three ways — portal, az CLI, minimal Terraform — plus the refused-vs-timeout lesson and teardown
5	Deployment	A for_each Terraform module over a subnet map, remote state with blob leases, an Ansible day-2 playbook, the Bicep equivalent and complete-mode warning, OIDC CI/CD with a destructive-change gate, environments, rollback, and drift
6	Integrations	Private Link and Private DNS end to end, hub-and-spoke assembled, Azure Firewall, AKS networking modes, App Service integration, Network Watcher, flow logs, and Azure Policy
7	Production	The flat default posture, the management-port rule, exfiltration paths, the cost meters that bill while idle, quota scopes, the KQL you'll actually run, and the zone story per attached resource
8	Interview Questions	Three tiers with answer keys, from "what is a VNet" to "diagnose intermittent timeouts to one API at peak"
9	Glossary & Cheatsheet	Every term in one line, the commands worth memorising, the resource ID shapes, the limits with their scopes, and a five-second debug flowchart

Microsoft Entra ID — the identity provider

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The problem a shared directory kills, why it is neither Active Directory nor Azure RBAC, why it is not an ARM resource at all, the IAM analogy and its four breaking points, and the honest anti-patterns
2	Core Concepts	Tenants and verified domains, members vs. guests, the four names for two application objects, delegated vs. application permissions, consent, Conditional Access, directory roles vs. Azure RBAC, the licensing SKU axis, and on-premises sync topologies
3	Architecture	An authorisation-code sign-in traced end to end, what is actually in a token, control plane vs. data plane where neither is ARM, Conditional Access evaluation order, why revocation lags and what CAE changes, Graph throttling, the group overage claim, and the failure modes
4	Getting Started	An app registration, a credential, and a role assignment three ways — portal, az CLI and Graph PowerShell, minimal Terraform with two providers — plus decoding a token, and teardown of both systems
5	Deployment	A parameterised azuread Terraform module, remote state, the bootstrap chicken-and-egg, Conditional Access as code, an Ansible day-2 playbook, why Bicep mostly can't do this, OIDC CI/CD and the subject-claim trap, environments when a tenant is a singleton, replacement-forcing changes, soft delete, and drift
6	Integrations	The four glue patterns — managed identity, workload identity federation, OIDC/SAML sign-in, and Entra-backed data-plane auth — plus the legacy key each one replaces, and a real architecture with no secrets in it
7	Production	The ten settings a new tenant gets wrong, the Conditional Access baseline, workload identity as the offboarding blind spot, licence scope creep and log ingestion cost, limits with their scopes, the KQL you'll actually run, and why there is no tenant restore
8	Interview Questions	Three tiers with answer keys, from "what is a tenant" to "someone consented to a malicious app — what now"
9	Glossary & Cheatsheet	Every term in one line, the commands you'll actually type, the endpoint and well-known GUID shapes, and the limits with the scope each is counted at

Azure RBAC — authorisation for Azure resources

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The problem scoped authorisation kills, why it is neither Azure Policy nor a directory role nor a resource lock, the parallel data-plane systems that route around it, the IAM analogy and its four breaking points, and the honest anti-patterns
2	Core Concepts	The role assignment as three fields, the four principal types, role definitions and their four permission arrays, operation strings and why wildcards widen over time, scope and downward-only inheritance, custom roles, ABAC conditions, deny assignments, PIM, and the vocabulary traps
3	Architecture	An authorisation decision traced end to end, control plane vs. data plane with two separate evaluators, the union-with-no-deny algorithm, the six systems that can refuse a request and their error codes, propagation and token-cache latency in both directions, limits with their scopes, and the failure modes
4	Getting Started	Grant a managed identity read access to one blob container — portal, az CLI, PowerShell Az, and minimal Terraform — plus a runnable proof that Owner cannot read a blob, and teardown that names what survives
5	Deployment	A parameterised Terraform module with for_each and assignment descriptions, custom roles without wildcards, PIM eligibility via azapi, remote state and why not workspaces, an Ansible day-2 playbook with an idempotency assert, Bicep's guid() trick and the complete-mode warning, OIDC CI/CD posting the access diff on the PR, subscription-per-environment, replacement windows, locks and purge protection, and the two drift checks you need
6	Integrations	Managed identity plus role assignment in full, the Key Vault access-policy migration, Azure Policy enforcing the access model, AKS's three overlapping RBAC layers, SQL's sequential model, the activity log, and the switch that closes each parallel door
7	Production	Least privilege as four decisions, the four permissions that are escalation paths, break-glass accounts, what the governance licences actually buy, limits with the scope each is counted at, the observability blind spot when you assign to groups, the alerts to configure, and a failure drill most estates fail
8	Interview Questions	Three tiers with answer keys, from "what are the three parts of a role assignment" to "a service principal is compromised — walk me through containment"
9	Glossary & Cheatsheet	Every term in one line, the resource ID and operation-string shapes, the commands you'll actually type, the roles worth knowing by name, and the limits with the scope each is counted at

Azure SQL Database — managed relational

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The operational tail it kills, choosing inside the Azure SQL family, the RDS analogy and its four breaking points, and the honest anti-patterns
2	Core Concepts	The logical server that isn't a server, DTU vs. vCore, the three service tiers, serverless and auto-pause, elastic pools, connectivity and identity vocabulary, and the SKU traps
3	Architecture	A query traced through gateway and redirect, the three storage architectures behind one T-SQL surface, control plane vs. data plane and the escalation path between them, replication and RPO, scaling ceilings with their scopes, and the failure modes
4	Getting Started	One database three ways — portal, az CLI with Entra-only auth, PowerShell, and minimal Terraform — how to read a sku_name string, and teardown
5	Deployment	Two pipelines not one: a parameterised Terraform module, remote state with blob leases, an Ansible day-2 playbook, the Bicep equivalent and the complete-mode warning, forward-only schema migrations, OIDC CI/CD, environments, replacement-forcing changes, locks, and drift
6	Integrations	Managed identity plus contained users, private endpoint and DNS, the full integration map, read-replica routing, change feeds and the outbox pattern, and the failover group listener
7	Production	The identity ladder, authorisation below db_owner, the cost traps in the order they bite, limits with the scope each is counted at, the KQL and DMVs you'll actually run, and a restore drill worth rehearsing
8	Interview Questions	Three tiers with answer keys, from "what is a DTU" to "someone scaled this in the portal during an incident — now what"
9	Glossary & Cheatsheet	Every term in one line, the commands and T-SQL you'll actually type, connection strings, the resource ID shape, limits with their scopes, and the error numbers worth recognising

Azure Monitor — observability

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The fragmentation it kills, why almost nothing is collected by default, the neighbours (Sentinel, Defender, Service Health), the CloudWatch analogy and its five breaking points
2	Core Concepts	Metrics vs. Logs as two separate stores, workspaces and tables, table plans and retention, diagnostic settings, DCRs and transformations, Application Insights, alert types, action groups, KQL
3	Architecture	One event traced from emission to query, control plane vs. data plane with the roles that govern each, workspace access modes, inside the two stores, limits with their scopes, and the failure modes
4	Getting Started	A workspace, a diagnostic setting, a KQL query and one alert — portal, az CLI, PowerShell, and minimal Terraform — plus teardown and the soft-delete caveat
5	Deployment	A parameterised Terraform module with table plans and DCR transformations, remote state with blob leases, Azure Policy DeployIfNotExists as the piece Terraform can't do, Ansible day-2 work, the Bicep equivalent and the complete-mode warning, OIDC CI/CD, environments, rollback, and drift
6	Integrations	Managed identity and AMPLS as the two glue mechanisms, the full pairing map, the Entra ID logs everyone forgets, Container Insights defaults, cross-workspace queries, and Resource Graph as the other KQL
7	Production	The role table for least privilege, cost as the first pillar with the queries that find the culprit, limits with the scope each is counted at, monitoring the monitor, and a failure drill
8	Interview Questions	Three tiers with answer keys, from "metrics or logs" to "our bill tripled — diagnose it" and "someone changed a threshold at 3 a.m."
9	Glossary & Cheatsheet	Every term in one line, the az commands and KQL you'll actually type, the resource ID shapes including the extension-resource one, and limits with their scopes

Azure Machine Learning — training, the model registry, and managed inference

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The reproducibility problem it kills, the four things it actually gives you, where it sits against Foundry and Databricks, the v1→v2 break and the retired Studio (classic), the SageMaker analogy and its four breaking points, and the honest anti-patterns
2	Core Concepts	Workspace and its kind, the four dependent resources, the compute taxonomy that is the SKU axis, datastores, data assets as pointers not snapshots, environments, jobs, components, models, registries, endpoints and deployments, and the three-plane split
3	Architecture	A training job and a scoring request traced end to end, the three doors (ARM, workspace data plane, inference data plane), the four identities in play, quota mechanics across three separate pools, the networking paths, and a diagnostic table of failure modes
4	Getting Started	One workspace, one scale-to-zero cluster, one MLflow-tracked job, one registered model — portal, az ml CLI, and minimal Terraform — plus the optional endpoint, teardown, and the soft-delete trap
5	Deployment	The two-cadence split between infrastructure and ML artifacts, a parameterised Terraform module with azurerm + azapi, remote state with blob leases, an honest Ansible section, the Bicep equivalent and the complete-mode warning, OIDC CI/CD with an evaluation gate, environments as subscriptions, blue/green rollback, and drift in three flavours
6	Integrations	Storage and ADLS Gen2, Key Vault, ACR, Databricks, Fabric and Synapse, Foundry and the shared resource provider, Monitor's three telemetry paths, Event Grid for event-driven MLOps, APIM, AKS both ways, Private Link, and Entra ID
7	Production	The identity and network hardening checklist, where the money actually goes, scaling against three separate quota pools, four layers of observability including data drift, and the multi-region pattern with a registry as the seam
8	Interview Questions	Three tiers with answer keys, from "what is a workspace" to "design this for an audit requirement" and "Terraform wants to recreate the prod cluster"
9	Glossary & Cheatsheet	Every term in one line, the az ml commands you'll actually type, the azureml: URI shapes, and limits with the scope each is counted at

Azure AI Foundry — the AI application and agent platform

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The problem it kills, the four-name rename chain ending at Microsoft Foundry, the two architectures (Foundry account vs. classic hub), the Bedrock analogy and its three breaking points, and the honest anti-patterns
2	Core Concepts	Account, project, model deployment, the deployment-type SKU axis, TPM and PTU, connections, agents, threads, runs, capability hosts, content filters, evaluations, and every endpoint in one table
3	Architecture	A chat completion and an agent run traced end to end, the three doors (control plane, inference data plane, project data plane), quota and throttling mechanics, residency by deployment type, and the failure modes
4	Getting Started	One account, one deployment, one completion — portal, az CLI, and minimal Terraform — plus the data-plane role the portal grants for you, teardown, and the soft-delete purge
5	Deployment	A parameterised Terraform module with azurerm + azapi, remote state with blob leases, an Ansible day-2 playbook, the Bicep equivalent and the complete-mode warning, OIDC CI/CD, the second pipeline for prompts and models gated on evaluation, environments as subscriptions, rollback, and drift
6	Integrations	AI Search, Cosmos DB, Storage, Key Vault, API Management as an AI gateway, Monitor, Content Safety, Functions and Logic Apps as tools, the RAG / agent / gateway patterns, and the confused-deputy mistake
7	Production	Disabling keys, the role table, prompt injection as a design constraint, the three cost meters and the idle-PTU trap, quota scopes, the four alerts, monitoring quality as well as health, and the multi-region pattern
8	Interview Questions	Three tiers with answer keys, from "what is a deployment" to "design this for a regulated EU customer" and "someone changed the capacity in the portal"
9	Glossary & Cheatsheet	Every term in one line including all the renames, the az commands you'll actually type, the resource ID and endpoint shapes, and limits with the scope each is counted at

GitHub Actions for Azure — CI/CD and the keyless deploy

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The three eras of CI pain, why workload identity federation is the whole point, the neighbours (Azure DevOps, GitOps, Automation), the AWS OIDC analogy and its three breaking points, and the honest anti-patterns
2	Core Concepts	Workflows, jobs, runners, actions, contexts, secrets vs. variables, environments and permissions:, then the Azure half — app registration vs. user-assigned managed identity, federated identity credentials, subject-claim shapes, role assignments and scope
3	Architecture	The eleven-step token exchange from push to ARM write, control plane vs. data plane with the role pairs a pipeline actually needs, what a runner really is, concurrency and queueing, quota scopes, and a diagnostic table of every failure mode
4	Getting Started	One federated credential and one keyless login three ways — portal, az CLI, PowerShell, and minimal Terraform — the deliberate branch experiment, and what teardown leaves behind
5	Deployment	The bootstrap problem, a parameterised Terraform module for the whole CI substrate including the GitHub side, remote state with blob leases, Ansible for self-hosted runners, the Bicep equivalent and the complete-mode warning, plan-on-PR/apply-on-merge, build-once-deploy-many, environments, rollback, and drift
6	Integrations	Entra ID trust patterns, the ACR push/pull identity split, slots as the rollback lever, AKS and the case for GitOps, Key Vault references vs. the injection anti-pattern, Monitor in both directions, and the private-networking problem stated honestly
7	Production	Killing long-lived credentials, narrowing the trust boundary, supply-chain hardening and action pinning, runner-minute cost traps, limits with the scope each is counted at, the KQL that separates pipeline changes from human ones, and a failure drill
8	Interview Questions	Three tiers with answer keys, from "what does for Azure add" to "convince me nobody who shouldn't can deploy to prod" and "someone hand-edited the app at 3 a.m."
9	Glossary & Cheatsheet	Every term in one line, the az and gh commands you'll actually type, the workflow skeleton from memory, resource ID and subject-claim shapes, and limits with their scopes

Azure App Configuration — settings and feature flags outside the deployment

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The lifecycle mismatch between code and configuration, the neighbours (Key Vault, app settings, ConfigMaps, flag platforms), the Parameter-Store-plus-AppConfig analogy and its three breaking points, and the honest anti-patterns
2	Core Concepts	Key-values identified by (key, label), the label model and why "no label" is not a default, magic content types, feature flags and variants, snapshots, revisions, replicas, the four-tier SKU axis, and the two ways to authenticate
3	Architecture	The nine-step startup read path, control plane vs. data plane and the access-key escalation that leaks between them, the caching and sentinel-key refresh model, cross-replica consistency, and the failure modes including startup failure
4	Getting Started	One store and two labelled keys three ways — portal, az appconfig, minimal Terraform — the data-plane role assignment everyone forgets, reading it from an app, and what teardown leaves behind
5	Deployment	The two-pipeline split, a parameterised Terraform module and the features {} block that governs soft delete, remote state with blob leases, the honest Ansible story, Bicep with what-if and the complete-mode warning, OIDC CI/CD, environments, rollback, and drift
6	Integrations	Key Vault references and who actually resolves them, managed identity, App Service and Functions, the AKS Kubernetes provider, Event Grid to turn polling into push, Private Link, and the diagnostic setting people forget
7	Production	Disabling local auth as the one correctness fix, least privilege where the built-in roles are too broad, the refresh-interval cost arithmetic, limits with the scope each is counted at, the KQL that finds your noisy client, and a failure drill
8	Interview Questions	Three tiers with answer keys, from "what problem does it solve" to "Terraform created the store but can't write the keys — why" and "someone edited prod by hand at 3 a.m."
9	Glossary & Cheatsheet	Every term in one line, the az appconfig commands you'll actually type, the client-side knobs, resource ID shapes, and limits with their scopes

API Management — the API gateway and governance layer

Topic overview →

#	Sub-topic	What it covers
1	What & Why	The fan-out of cross-cutting concerns a gateway kills, where APIM sits among Front Door, Application Gateway, API Center and ingress controllers, the Amazon API Gateway analogue and its eight breaking points, and the honest anti-patterns
2	Core Concepts	Service, unit, API, operation, product, subscription and key, policy scopes and <base />, named values, backends, revisions vs. versions, workspaces, caching, and the tier axis from Consumption to Premium v2
3	Architecture	The nine-step request path through the nested policy pipeline, control plane vs. data plane where configuration is control plane, the units-and-capacity model, networking modes, and the failure modes from certificate expiry to soft-delete name collisions
4	Getting Started	One gateway over one backend three ways — portal, az apim, minimal Terraform — the 401 that teaches you what a subscription key is, and the purge step teardown leaves behind
5	Deployment	The slow-infrastructure / fast-configuration split, a parameterised Terraform module with policy XML in files, remote state with blob leases, Ansible for day-2 work, Bicep with what-if and the complete-mode warning, OIDC CI/CD with a <base /> lint, environments, rollback by revision, and drift
6	Integrations	Backends and the Function-key trap, validate-jwt against Entra ID, Key Vault certificates and named values, App Insights sampling, Front Door and Application Gateway with the side door closed, and APIM as an AI gateway in front of Azure OpenAI
7	Production	Security layering where the key is not the control, the five cost traps, why capacity is concurrency rather than CPU, the KQL that separates gateway overhead from backend latency, zone and multi-region reliability, and a failure drill
8	Interview Questions	Three tiers with answer keys, from "product vs. subscription vs. key" to "90% capacity with an idle backend" and "someone fixed a policy in the portal at 3 a.m."
9	Glossary & Cheatsheet	Every term in one line, the az apim commands you'll actually type, the policy snippets worth memorising, resource ID shapes, and limits with their scopes

Coming from AWS?

These equivalences are rough. They're good enough to orient you on day one and actively misleading by day thirty — each pairing hides a structural difference that the relevant topic spells out. Treat this table as a map legend, not the territory.

AWS	Azure	Where the analogy breaks
S3	Blob Storage	The storage account layer above the container is real: it owns redundancy, firewall, network rules, and most quotas
Lambda	Azure Functions	The hosting plan (Consumption / Flex Consumption / Premium / Dedicated) drives cold start, networking, and cost far more than the code does
DynamoDB	Cosmos DB	Multi-model with five consistency levels, and you provision RU/s on a container — not read and write capacity separately
RDS	Azure SQL Database / Flexible Server	Azure SQL DB is not "SQL Server on a managed VM"; the compatibility gap is why SQL Managed Instance exists as a third option
EC2	Virtual Machines	Sizing, disks, and images are similar; the resource group and separate NIC/public-IP resources are not
VPC	Virtual Network	Closest pairing in the table — but Azure subnets are not zonal (a subnet spans every zone), NSGs are ordered and can deny, and outbound internet needs an explicit NAT source
Transit Gateway	Virtual WAN	VNet peering is non-transitive, which is the whole reason Virtual WAN exists
IAM	Microsoft Entra ID + Azure RBAC	Two systems, not one: directory roles govern the tenant, Azure RBAC governs resources, and they're easy to confuse
IAM roles for service accounts	Managed identities	Same idea, cleaner execution — system-assigned identities live and die with the resource
CloudWatch	Azure Monitor (+ Log Analytics)	Diagnostic settings are off by default; you route logs somewhere explicitly, then query with KQL
CloudFormation	ARM templates / Bicep	ARM tracks deployments itself — no separate stack object — and complete deployment mode will delete resources not in the template
Organizations / SCPs	Management groups / Azure Policy	Policy can modify and deploy, not just deny — a meaningfully larger surface than SCPs
SQS	Service Bus queues (or Storage queues)	Service Bus is the richer broker: sessions, transactions, dead-lettering. Storage queues are the cheap, simple option
SNS / EventBridge	Event Grid	Push-based with a retry policy and dead-lettering; system topics publish Azure's own resource events
Kinesis Data Streams	Event Hubs	Partitions and consumer groups map cleanly; throughput units and the Kafka-compatible endpoint don't
Step Functions	Logic Apps / Durable Functions	Two different answers — Logic Apps for connector-driven integration, Durable Functions for code-first orchestration
ECS / Fargate	Container Apps / Container Instances	Container Apps is KEDA + Dapr on managed Kubernetes, not a thin Fargate clone
EKS	Azure Kubernetes Service	The control plane is free; the node pools, networking plugin (kubenet vs. Azure CNI), and identity integration are the real decisions
API Gateway	API Management	Provisioned and billed per unit-hour, not per request (except the Consumption tier); one instance hosts your whole portfolio, so Azure RBAC's grain is the instance; no stages, and no built-in WAF
CloudFront	Azure Front Door (or Azure CDN)	Front Door is a global L7 load balancer with WAF, not purely a cache
Route 53	Azure DNS + Traffic Manager	Split across two services: DNS hosting in one, DNS-based traffic routing in the other
Secrets Manager / KMS	Key Vault	One resource for secrets, keys, and certificates — with soft delete and purge protection that will surprise you on teardown
SSM Parameter Store + AWS AppConfig	Azure App Configuration	One resource covers both halves — but there is no service-side deployment strategy (no gradual rollout, no alarm-triggered auto-rollback; that's client-side filter logic), and the orthogonal label dimension has no Parameter Store equivalent
Glue	Azure Data Factory	Pipeline orchestration with a mapping-data-flow engine; the Spark story lives in Databricks or Fabric instead
SageMaker	Azure Machine Learning	Workspace-centric, with a model registry and managed online/batch endpoints that promote separately from infrastructure
Bedrock	Azure AI Foundry	Foundry adds two objects Bedrock has no equivalent for — the named model deployment (model + version + type + capacity, called by your name) and the project — and makes you allocate a regional TPM pool across them by hand

A note on numbers

Concepts, architecture, and trade-offs are stable. Quotas, SKU limits, pricing, region availability, VM sizes, and default values are not — and in Azure they vary by region and subscription type more than they do in AWS. Where this article states a limit, it also states the scope it's counted at (per resource / per resource group / per subscription-per-region / per tenant), because a number without a scope is useless. Anything volatile is marked ⚠️ verify against current Azure docs. Preview features are labelled as preview, have no SLA, and may not be covered by the azurerm Terraform provider yet — that's what azapi is for.

Where a service is retired or retiring — Media Services, Data Lake Analytics, Azure Database for MariaDB, Blueprints, Lab Services — the topic says so up front and points at the replacement.

---

Next: Foundations — the Azure platform model →