Azure architecture and services

Core architecture

Regions, region pairs and sovereign regions

• A region is a geographic area containing one or more datacenters connected by a low-latency network. You pick the region when you create most resources, usually for latency, data residency, compliance, service availability and price.
• A region pair links two regions in the same geography, hundreds of miles apart. Azure rolls out platform updates to one region in a pair at a time, and prioritises recovery of one region of each pair in a broad outage. Some services replicate to the paired region (geo-redundant storage does).
• Sovereign regions are isolated instances of Azure for specific compliance needs, such as Azure Government (US government agencies and partners) and Azure operated by 21Vianet (China). Data and identities are kept separate from the global public cloud.

Availability zones

• An availability zone is a physically separate location inside a region, with its own power, cooling and networking. Regions that support zones have a minimum of three.
• Zonal services pin a resource to one zone (you choose it). Zone-redundant services spread or replicate across zones automatically. Pairing zones with region pairs gives protection from both a datacenter-level and a region-level failure.
• Not every region has zones and not every service supports them.

Datacenters

Azure datacenters are physical buildings with servers, networking, power and cooling. Microsoft runs them with layered physical security, and customers never manage them. They are grouped into regions and zones.

Resources, resource groups, subscriptions and management groups

• A resource is a manageable item: a VM, a storage account, a virtual network, a database.
• A resource group is a logical container for resources that share a lifecycle. Every resource lives in exactly one resource group. The group stores metadata in a location, but its resources can be in other regions. Resource groups can’t be nested. Deleting a group deletes everything in it. You can move many resource types between groups.
• A subscription is a billing and access boundary and a scope for limits. One account can hold several subscriptions (for production, development, departments). Each resource group belongs to one subscription.
• Management groups sit above subscriptions so you can apply Azure Policy and RBAC to many subscriptions at once. They can nest up to six levels (not counting the root). Everything under a management group inherits assignments.
• The hierarchy, top to bottom: management groups → subscriptions → resource groups → resources. Policy and RBAC assigned at a level flow down.

Compute

Compute types

Virtual machine options

• Azure Virtual Machines: you choose size (CPU, memory), image, disks and network. You manage the OS. Billed while allocated. Stopping (deallocating) from Azure stops compute charges; you still pay for disks. Shutting down from inside the OS does not deallocate.
• Virtual Machine Scale Sets: a group of identical, load-balanced VMs that autoscale with demand or a schedule. Use for web tiers and big compute.
• Availability sets: spread VMs across fault domains (separate racks and power) and update domains (groups rebooted one at a time for maintenance) inside one datacenter, giving a higher SLA than a single VM. Zones are the stronger option.
• Azure Virtual Desktop: a managed desktop and app virtualisation service running Windows in Azure, with multi-session Windows 11 and remote access from many device types.

Typical SLA ladder: single VM with premium SSD disks 99.9%, availability set 99.95%, two or more VMs across zones 99.99%.

Resources a VM needs

A VM needs more than the machine itself: a resource group, a virtual network and subnet, a network interface (and usually an IP address), one or more disks (an OS disk, optionally data disks), and optionally a network security group and a public IP. Size, region, image, and authentication (password or SSH key) are chosen at creation.

Application hosting

Choosing: least management, web code only: App Service. Need a container but no orchestration: Container Instances. Many containers needing scaling and service discovery: AKS or Container Apps. Full control: VM.

Networking

Virtual networks

• An Azure virtual network (VNet) is your private network in Azure. It is scoped to one region and one subscription, and holds an address space split into subnets. Resources in the same VNet can talk to each other by default, and can reach the internet outbound by default.
• Network security groups (NSGs) filter traffic to subnets and network interfaces with allow/deny rules by source, destination, port and protocol.
• Peering connects two VNets so they communicate over the Microsoft backbone with low latency, as if on one network. Global peering crosses regions. Peering is not transitive by default.
• Azure DNS hosts DNS zones on Azure’s infrastructure for name resolution (public and private zones). It doesn’t buy domains.
• VPN Gateway sends encrypted traffic between a VNet and on-premises (site-to-site), or from individual devices (point-to-site), over the public internet.
• ExpressRoute is a private connection between on-premises and Microsoft, through a connectivity provider, that doesn’t cross the public internet. It gives more reliability, faster and more consistent speeds, and lower latency than a VPN. It isn’t encrypted by default.

Public and private endpoints

• A public endpoint is reached through a public IP over the internet.
• A private endpoint gives a PaaS service (Storage, SQL Database and others) a private IP address inside your VNet using Azure Private Link, so traffic stays on the Microsoft backbone and the public endpoint can be turned off. Use it to keep a service off the public internet.

Storage

Storage services

An Azure storage account gives you a unique namespace with these services:

Access tiers (blobs)

Archive is offline: data must be rehydrated (hours) before you can read it. Moving data out of a tier before its minimum period incurs an early-deletion charge. Lifecycle management policies move blobs between tiers automatically by age or last access.

Redundancy options

Cheapest is LRS; most durable is GZRS. Geo options copy asynchronously.

Storage account options

• Standard general-purpose v2 is the recommended type for most uses (blobs, files, queues, tables). Premium accounts use SSDs for low-latency workloads (block blobs, file shares, page blobs).
• Account names are globally unique, 3 to 24 lowercase letters and numbers.
• Data is encrypted at rest by default. Access is controlled through Entra ID, shared access signatures and keys, and a firewall can limit networks.

Moving files and data

If the question says “slow network”, “terabytes” and “ship”: Data Box. If it says “assess readiness and move servers”: Azure Migrate.

Identity, access and security

Directory services

• Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity and access management service for users, apps and devices. It authenticates to Microsoft 365, Azure and thousands of SaaS apps. It uses modern protocols (OAuth, OpenID Connect, SAML), not Kerberos or LDAP.
• Microsoft Entra Domain Services provides managed domain services (domain join, group policy, LDAP, Kerberos/NTLM) without running domain controllers yourself, for lift-and-shift apps that need those older protocols.
• Microsoft Entra Connect synchronises on-premises Active Directory with Entra ID for hybrid identity.

Authentication methods

• Single sign-on (SSO): sign in once, access many apps without re-entering credentials.
• Multifactor authentication (MFA): requires two or more of something you know (password), have (phone, security key) and are (fingerprint, face). It blocks the vast majority of account-compromise attacks.
• Passwordless: replaces the password with something stronger such as Windows Hello for Business, the Microsoft Authenticator app, or FIDO2 security keys.
• Self-service password reset lets users fix their own passwords.

External identities

Microsoft Entra External ID covers people outside your organisation: B2B collaboration (invite partners as guests who use their own credentials to reach your resources) and customer identity for consumer-facing apps (sign-up and sign-in with social or local accounts).

Conditional Access

Conditional Access is Entra’s policy engine: if signals match (user, group, location, device state, app, sign-in risk), then enforce a decision (allow, require MFA, require a compliant device, or block). It needs Entra ID P1 or higher; risk-based policies use P2. It’s evaluated after the first sign-in step.

Azure role-based access control (RBAC)

• RBAC controls what authenticated identities can do with Azure resources. A role assignment has three parts: security principal (user, group, service principal, managed identity), role definition (a set of permissions) and scope (management group, subscription, resource group, resource).
• Assignments inherit downward. Built-in roles: Owner (everything, including assigning roles), Contributor (everything except granting access), Reader (view only), User Access Administrator (manage access only).
• Don’t confuse it with Entra roles, which manage the directory (users, groups), and with Azure Policy, which governs resource properties.

Zero Trust

Zero Trust is a security model that assumes no implicit trust based on network location. Its principles: verify explicitly (use all available signals), use least-privilege access (just-in-time and just-enough access), and assume breach (limit blast radius, segment, encrypt, monitor).

Defense in depth

Layered protection so that if one layer fails, others hold: physical security, identity and access, perimeter, network, compute, application, data. Each layer has its own controls (for example DDoS protection at the perimeter, NSGs and firewalls at the network, patching at compute, encryption at data).

Microsoft Defender for Cloud

A cloud-native platform for posture management and workload protection across Azure, on-premises and other clouds:

• Secure score and recommendations to harden configuration (cloud security posture management, with a free foundational tier).
• Threat protection for VMs, containers, databases, storage and more through paid Defender plans.
• Compliance assessment against standards and regulatory benchmarks.

Defender for Cloud tells you what to fix and detects threats. Azure Advisor gives broader best-practice advice, and Microsoft Sentinel is the separate SIEM/SOAR.