Microsoft Azure Cloud Expertise

Key Principles

• Use Azure Resource Manager (ARM) or Bicep templates for all infrastructure; declarative infrastructure-as-code ensures reproducibility and drift detection
• Centralize identity management in Entra ID with conditional access policies, MFA enforcement, and role-based access control (RBAC) at the management group level
• Choose the right compute tier: App Service for web apps, AKS for container orchestration, Functions for event-driven serverless, Container Apps for simpler container workloads
• Organize resources into resource groups by lifecycle and ownership; resources that are deployed and deleted together belong in the same group
• Enable Microsoft Defender for Cloud and Azure Monitor from the start; configure diagnostic settings to send logs to a Log Analytics workspace

Techniques

• Use

  az group create

  and

  az deployment group create --template-file main.bicep

  for declarative resource provisioning with parameter files per environment
• Deploy to AKS with

  az aks create --enable-managed-identity --network-plugin azure --enable-addons monitoring

  for production-grade Kubernetes with Azure CNI networking
• Configure App Service with deployment slots for zero-downtime deployments: deploy to staging slot, warm up, then swap to production
• Store secrets in Azure Key Vault and reference them from App Service configuration with

  @Microsoft.KeyVault(SecretUri=...)

  syntax
• Define networking with Virtual Networks, subnets, Network Security Groups, and Private Endpoints to keep traffic within the Azure backbone
• Use

  az monitor metrics alert create

  and

  az monitor log-analytics query

  for proactive alerting and ad-hoc log investigation

Common Patterns

• Hub-Spoke Network: Deploy a central hub VNet with Azure Firewall, VPN Gateway, and shared services, peered to spoke VNets for each workload; all egress routes through the hub
• Managed Identity Chain: Assign system-managed identities to compute resources (App Service, AKS pods via workload identity), grant them RBAC roles on Key Vault, Storage, and SQL; eliminate all connection strings with passwords
• Bicep Modules: Decompose infrastructure into reusable Bicep modules (networking, compute, monitoring) with typed parameters and outputs for composition across environments
• Cost Management Tags: Apply

  environment

  ,

  team

  ,

  project

  , and

  cost-center

  tags to all resources; configure Cost Management budgets and anomaly alerts per tag scope

Pitfalls to Avoid

• Do not use classic deployment model resources; they lack ARM features, RBAC support, and are on a deprecation path
• Do not store connection strings or secrets in App Settings without Key Vault references; plain-text secrets in configuration are visible to anyone with Reader role on the resource
• Do not create AKS clusters with

  kubenet

  networking in production; Azure CNI provides pod-level network policies, better performance, and integration with Azure networking features
• Do not assign Owner or Contributor roles at the subscription level to application service principals; scope roles to specific resource groups and use custom role definitions