Design infrastructure solutions

Compute

Specifying components from requirements

Ask in this order: how much control do you need (IaaS to PaaS to serverless), how does it scale (manual, autoscale, to zero), how is it packaged (VM image, container, code), which licences and OS, and what are the HA and cost targets.

Virtual machine solutions

• Sizes: B (burstable, low average CPU), D (general), E (memory), F (compute), L (storage), M (very large memory), N (GPU), H (HPC). Choose family by the bottleneck.
• Cost levers: reserved instances and savings plans (1 or 3 years, steady), Spot (up to ~90% off, evictable, for interruptible batch and test), Azure Hybrid Benefit (bring Windows Server or SQL licences), auto-shutdown, right-sizing from Azure Advisor.
• Virtual Machine Scale Sets (flexible orchestration) give autoscale on metrics or schedule, zone spreading and instance repair. Azure Compute Gallery distributes images.
• Dedicated Hosts for compliance isolation and bring-your-own per-core licences. Confidential VMs protect data in use.
• Azure Virtual Desktop for hosted desktops and apps, with multi-session Windows, FSLogix profile containers on Azure Files or NetApp Files, and scaling plans.
• VMware: Azure VMware Solution runs vSphere unchanged to migrate quickly.
• Oracle, SAP and HPC workloads: specific certified sizes, NetApp Files, proximity placement groups for low latency.
• Reduce patching with Azure Update Manager, and use Azure Bastion instead of public RDP/SSH.

Container solutions

Quick tell: Kubernetes API access or custom control needed = AKS; microservices but “no cluster management” = Container Apps; run one container briefly = ACI.

AKS design points: Azure CNI (overlay or node subnet) vs kubenet, managed identity, workload identity for pods, private cluster, zone-spread node pools, system vs user node pools, Azure Policy for Kubernetes, Defender for Containers, ingress via Application Gateway for Containers or NGINX.

Serverless solutions

• Azure Functions: event-triggered code. Hosting plans:

• Durable Functions for stateful workflows (chaining, fan-out/fan-in, human approval).
• Logic Apps: low-code workflows and enterprise integration with 1,000+ connectors. Consumption (multi-tenant, per action) vs Standard (single-tenant, VNet, stateful and stateless). Choose when integrating SaaS systems with little code.
• App Service: managed web hosting with deployment slots, autoscale, custom domains, VNet integration. Static Web Apps for static front ends with serverless API. Functions vs Logic Apps: code-first vs designer-first.

Batch processing

Batch is the answer for “run thousands of independent tasks and pay only while nodes run”.

Application architecture

Messaging

Service Bus vs Queue storage: need ordering, dead lettering, topics, transactions or messages over 64 KB = Service Bus. Simple, huge backlog, lowest cost = Queue Storage.

Patterns: competing consumers (many workers share a queue, scale on length), queue-based load levelling (absorb spikes), priority queue, claim check (store the large payload in blob, send a reference), outbox, saga.

Event-driven architecture

• A message is a command with an intended handler and an expectation of processing (Service Bus). An event is a fact that something happened, and the publisher doesn’t care who reacts (Event Grid, Event Hubs).
• Event Grid: discrete events, reactive, push to Functions, webhooks, Logic Apps, Service Bus, Event Hubs. Azure services emit system events (blob created). Supports filters, retry and dead letter, and the CloudEvents schema.
• Event Hubs: high-volume streams (telemetry, clickstream), ordered per partition, consumers pull at their own offset.
• Choreography (services react to each other’s events, loose coupling) vs orchestration (a central workflow such as Logic Apps or Durable Functions coordinates steps). Choose orchestration when you need clear sequencing, compensation and visibility.
• Triggers for Functions (blob, queue, Event Grid, Cosmos change feed, Event Hubs). IoT Hub for device-to-cloud and cloud-to-device messaging, device twins and per-device identity.

API integration

• Azure API Management (APIM): gateway, developer portal, management plane. Policies for rate limiting, quota, JWT validation, caching, transformation, mock responses, versioning and revisions. Tiers: Consumption (serverless), Developer (non-production), Basic/Standard (and v2), Premium (multi-region, availability zones, VNet injection) and Basic v2/Standard v2/Premium v2 with VNet integration. Self-hosted gateway runs APIs on-premises with cloud management.
• Put APIM behind Front Door or Application Gateway (WAF) for edge protection. Use it in front of Functions, App Service, Logic Apps and backend APIs, to expose one consistent facade.
• Logic Apps for orchestrating connectors, Event Grid for event APIs, Service Bus for async. GraphQL and MCP/AI gateway capabilities exist in APIM for AI workloads (token limits, semantic caching).

Caching

• Azure Managed Redis (successor to Azure Cache for Redis tiers) provides in-memory caching, sessions, leaderboards, pub/sub, with zone redundancy, active geo-replication and clustering. Use cache-aside: check cache, load on a miss, set a TTL.
• Front Door and Azure CDN cache static and dynamic content at the edge close to users. Output caching in APIM, query caching in Cosmos integrated cache, and App Service local cache.
• Design points: expiration, eviction, consistency and stampede protection. Cache doesn’t replace the database.

Application configuration

• Azure App Configuration: central store of settings and feature flags, labels per environment, snapshots, change notifications, and Key Vault references. Access with managed identity.
• Store secrets in Key Vault and settings in App Configuration. App Service application settings are fine for simple cases, and slot-sticky settings stay with a slot.
• Kubernetes: ConfigMaps with the App Configuration provider.

Automated deployment

• Infrastructure as code: Bicep (declarative, first-party, compiles to ARM; preferred), ARM templates (JSON), Terraform (multi-cloud). Template specs store versioned reusable templates in Azure; deployment stacks manage and protect a set of resources as a unit; what-if previews changes. Deployments can be incremental (default) or complete (deletes resources not in the template).
• CI/CD: Azure Pipelines and GitHub Actions, authenticating with workload identity federation. Environments with approvals and checks.
• App Service deployment slots (staging, swap with warm-up, roll back by swapping) enable zero-downtime releases. Container Apps revisions with traffic splitting. AKS with GitOps (Flux) and Helm.
• Azure Verified Modules and Azure Developer CLI (azd) for standard patterns.

Migrations

Cloud Adoption Framework

Stages: Strategy (business case, motivations), Plan (digital estate, skills), Ready (landing zone), Adopt (migrate and innovate), then Govern and Manage. The landing zone is the prepared environment of subscriptions, networking, identity and policy that workloads migrate into. The 5 Rs of rationalisation: Rehost (lift and shift), Refactor/repackage (to PaaS), Rearchitect, Rebuild, Replace (SaaS), plus retire/retain.

Evaluating servers, data and applications

• Azure Migrate is the hub: discovery and assessment of VMware, Hyper-V, physical servers and other clouds via the lightweight appliance (agentless), and with an import from CSV. Outputs readiness, right-sized Azure VM or PaaS suggestions, and cost estimates (including Hybrid Benefit and reserved prices).
• Dependency analysis: agentless (connections between servers) or agent-based (Microsoft Monitoring and dependency agent) to group servers into move groups that migrate together.
• Assessments cover: Azure VM, Azure SQL, Azure App Service (web apps), AKS, and Azure VMware Solution.
• Business case in Azure Migrate compares on-premises TCO with Azure. Data Migration Assistant assesses SQL compatibility.

Migrating to IaaS and PaaS

Migrating databases

• Offline migration needs downtime during copy; online keeps the source live and cuts over after sync. Pick online when downtime must be minimal. Assess first with DMA or the Azure SQL migration extension for SKU recommendations.
• Use Azure Migrate with SQL discovery to find instances at scale.

Migrating unstructured data

Rule: compute transfer time = data size / usable bandwidth. If it takes weeks, use Data Box. Seeding with Data Box and then syncing the delta online is a common combination.

Networking

Connecting Azure resources to the internet

• Outbound: default outbound access is being retired for new VNets. Use a NAT Gateway (static public IPs, SNAT scalability for a subnet), a Standard Load Balancer outbound rule, or Azure Firewall for filtering.
• Inbound: Standard public IPs are secure by default (closed unless an NSG allows). Use Azure Bastion for RDP and SSH over TLS with no public IP on the VM. Use Azure DDoS Protection (Network or IP Protection) for L3/L4 mitigation, and WAF for L7.
• Azure Firewall (Basic, Standard, Premium: TLS inspection, IDPS, URL filtering) centralises outbound and east-west control with FQDN rules and threat intelligence. Firewall Manager manages multiple. DNAT publishes services.

Connecting to on-premises

• ExpressRoute circuit SKUs: Local, Standard (geopolitical region), Premium (global reach, more routes). FastPath bypasses the gateway for data path. Private peering reaches VNets; Microsoft peering reaches Microsoft 365 and public PaaS IPs.
• Resilient hybrid: two ER circuits in different peering locations, or ER plus VPN failover. Dual gateways zone-redundant.
• Topologies: hub and spoke (shared services and firewall in the hub, workloads in spokes, VNet peering, UDRs) vs Virtual WAN (managed hub, routing built in, scale). VNet peering is non-transitive and carries gateway transit settings; global peering spans regions. Overlapping address spaces can’t peer.
• Private connectivity to PaaS: Private Link/private endpoints (private IP in your VNet, with private DNS zones) vs service endpoints (traffic stays on backbone but the service keeps its public IP and the rule restricts to a subnet). Private endpoints are the stronger answer and reachable from on-premises. DNS is the usual trap: use Azure DNS Private Resolver to resolve privatelink zones from on-premises.

Optimizing network performance

• Accelerated networking (SR-IOV) for lower latency and CPU on VMs. Choose VM sizes that support it.
• Proximity placement groups keep VMs physically close, at the cost of capacity and availability flexibility.
• Azure Front Door and CDN reduce latency to users globally by using the Microsoft edge and caching. Front Door uses anycast and split TCP.
• ExpressRoute vs VPN for consistent latency. Azure Route Server exchanges BGP routes with NVAs.
• Monitor with Network Watcher (connection monitor, NSG flow logs and VNet flow logs, packet capture), ExpressRoute Network Insights, Azure Monitor.
• Choose the region nearest the users and use Traffic Manager performance routing across regions.

Optimizing network security

• Segment with subnets, NSGs (stateful L3/L4 rules by priority, applied at subnet or NIC, with service tags) and application security groups (rule by workload group, not IP).
• Azure Firewall for central filtering and TLS inspection; NVAs only when a vendor feature is required. Application Gateway WAF and Front Door WAF (OWASP rules, bot protection) for web apps. DDoS Protection for public endpoints.
• Private endpoints to close public access on PaaS, disable public network access, Just-in-time VM access (Defender for Cloud), Bastion.
• Force traffic through the firewall with user-defined routes (0.0.0.0/0 to the firewall). Network Security Perimeter controls PaaS-to-PaaS access. Virtual network encryption and IPsec over ER (MACsec on Direct) protect data in transit.
• Zero trust: verify explicitly, least privilege, assume breach.

Load balancing and routing

Decision shortcuts:

• HTTP and global, with WAF and acceleration = Front Door. HTTP in one region with WAF and path routing = Application Gateway.
• Non-HTTP and regional = Load Balancer. Non-HTTP and global = Traffic Manager (DNS) or cross-region Load Balancer.
• Common layering: Front Door (global) then Application Gateway or APIM (regional) then backends.
• Traffic Manager can’t terminate TLS or cache, and failover is bound by DNS TTL.
• Routing: system routes, UDRs, BGP from gateways and Route Server; the most specific prefix wins, then UDR over BGP over system. Azure DNS (public and private zones) for names.