Azure

Microsoft Azure is an enterprise cloud computing platform featuring managed container services, Azure Arc hybrid management, and unified identity governance.

When to Use

• Enterprise Microsoft Cloud Infrastructure: Hybrid cloud environments, Microsoft Entra ID (Azure AD), and Windows/Linux VMs.
• Containerized Apps with Azure Container Apps (ACA) & AKS: Microservices with managed KEDA autoscaling and Envoy routing.
• Serverless Event-Driven Workloads: Azure Functions, Event Grid, Service Bus, and Logic Apps.
• AI & OpenAI Integration: Enterprise Azure OpenAI Service endpoints with private networking and VNet endpoints.

Quick Start

# Login to Azure subscription
az login

# Create a resource group
az group create --name rg-production --location eastus

# Deploy Azure App Service plan and web app
az appservice plan create --name plan-prod --resource-group rg-production --sku B1 --is-linux
az webapp create --name app-service-prod-1234 --resource-group rg-production --plan plan-prod --runtime "NODE:20-lts"

Core Concepts

Azure Container Apps Declarative Deployment

Deploying scalable microservices with KEDA scaling:

# container-app.yaml
apiVersion: Microsoft.App/containerApps@2024-03-01
type: Microsoft.App/containerApps
metadata:
  name: billing-service
  location: eastus
properties:
  managedEnvironmentId: /subscriptions/.../managedEnvironments/prod-env
  configuration:
    ingress:
      external: true
      targetPort: 8080
      transport: auto
    secrets:
      - name: db-connection
        keyVaultUrl: https://prod-vault.vault.azure.net/secrets/db-conn
        identity: system
  template:
    containers:
      - image: myacr.azurecr.io/billing-service:v2.1.0
        name: billing
        resources:
          cpu: 0.5
          memory: 1.0Gi
    scale:
      minReplicas: 2
      maxReplicas: 10
      rules:
        - name: http-scaling
          http:
            metadata:
              concurrentRequests: "100"

Managed Identities & Key Vault Integration

Accessing secrets without code credentials using Azure SDK:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# DefaultAzureCredential automatically checks Managed Identity, Azure CLI, or env
credential = DefaultAzureCredential()
vault_url = "https://corp-production-vault.vault.azure.net/"

client = SecretClient(vault_url=vault_url, credential=credential)
db_password = client.get_secret("database-master-password").value
print("Retrieved secret securely via Managed Identity.")

Azure Private Endpoints & Virtual Networks

Securing database traffic from public internet exposure:

[Virtual Network (VNet)]
  ├── Application Subnet ──► Azure Container Apps / App Service
  │     │ (Private VNet Traffic)
  │     ▼
  └── Private Endpoint Subnet ──► Azure Cosmos DB / SQL Database (Public access: Disabled)

Common Patterns

Managed Identity for Secure Azure Resource Access

Problem: Storing database passwords or Azure Storage keys in application config files.

Solution: Assign System-Assigned Managed Identity and grant RBAC:

# Enable Managed Identity on App Service
az webapp identity assign --name my-web-app --resource-group rg-production

# Grant Storage Blob Data Contributor role to the App Service identity
APP_SP_ID=$(az webapp identity show --name my-web-app --resource-group rg-production --query principalId -o tsv)

az role assignment create \
  --assignee $APP_SP_ID \
  --role "Storage Blob Data Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/rg-production/providers/Microsoft.Storage/storageAccounts/mystorage"

Best Practices

Do:

• Use Managed Identities (System-assigned or User-assigned) for service-to-service authentication instead of passwords.
• Store all certificates and connection strings in Azure Key Vault.
• Deploy resources inside Virtual Networks with Private Endpoints, disabling public network access on databases.
• Leverage Azure Container Apps (ACA) for microservices that do not require full Kubernetes cluster management overhead.

Don't:

• Store plain text secrets in App Settings or environment variables.
• Assign broad Contributor or Owner roles at subscription scopes; scope RBAC to resource groups.
• Leave diagnostic logging disabled; route Azure Monitor logs to Log Analytics Workspaces.

Troubleshooting

Error	Cause	Solution
AuthorizationFailed: The client ... does not have authorization to perform action	User or service principal lacks RBAC role on target resource group/subscription.	Request Contributor or specific RBAC role assignment from subscription owner.
ResourceNotFound: The Resource '...' could not be found	Typo in resource name or querying wrong subscription/resource group.	Verify active subscription with az account show and check resource group.
QuotaExceeded: Operation could not be completed	Regional VM vCPU quota exceeded on Azure subscription.	Request quota increase in Azure Portal under Help + Support.

References

• Azure Architecture Center