Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Gauge your current knowledge
Gauge your current knowledge
Operational excellence in logging means setting up a system that is easy to manage and provides clear visibility into your Azure environment. A key strategy is to use as few Log Analytics workspaces as possible, centralizing logs to simplify security and management. You can manage these workspaces automatically using Infrastructure as Code (IaC) tools like Bicep or Terraform. To make sure the logging system itself is healthy, you use Log Analytics Workspace Insights to watch data flow and set up alerts if anything goes wrong.
For alerting, you configure Azure Monitor rules to spot problems without creating too many false alarms. Using dynamic thresholds allows the system to learn normal performance patterns and adjust alert levels automatically. You can design a single alert rule to watch many similar resources at once. To handle alerts efficiently across your organization, you use alert processing rules to manage notifications, and you can connect Logic Apps to add extra information to your logs as they flow through the system.
Logs travel from your Azure resources to storage destinations via diagnostic settings. You configure these settings on each resource to send data to a Log Analytics workspace for active investigation, a Storage account for cheap long-term storage, or Event Hubs to stream logs to other security tools. The choice depends on how much data you have, how long you need to keep it, and whether you need to search it immediately. To apply these settings automatically whenever new resources are created, you use Azure Policy.
Azure Monitor collects two main types of data: metrics and logs. Standard metrics are simple, pre-calculated numbers like CPU percentage that are gathered automatically. For more complex analysis, you can create log-based metrics from the results of log queries, letting you alert on specific patterns found in your logs. If you need to track a unique business event, you can design and send custom metrics directly to Azure Monitor.
Resource logs contain detailed information about the internal operations of individual Azure services, like a virtual machine starting or a database query running. These logs are not collected by default; you must enable them by configuring diagnostic settings. Once enabled, you can route this data to Azure Monitor Logs for querying, Azure Storage for archiving, or Event Hubs for streaming to external systems. Your decision depends on whether your priority is quick troubleshooting, long-term compliance storage, or real-time security analysis.
The activity log automatically records all control-plane actions in your subscription, such as who created a resource or changed a configuration. This creates an audit trail for governance. You can forward these events to the same destinations as resource logs—Logs, Storage, or Event Hubs—to support centralized reporting and compliance checks.
Choosing where to send your logs involves balancing data volume, retention needs, and cost. Use Event Hubs when you need to stream large amounts of data in real-time to an external SIEM (Security Information and Event Management) tool like Splunk. Choose a Log Analytics workspace when you need to actively search and analyze logs using the powerful Kusto Query Language (KQL). Select a Storage account when your main goal is inexpensive, long-term storage for regulatory archives, with little need for frequent querying.
To implement routing, you configure diagnostic settings on each source resource. A single setting can send logs to multiple targets at once. For example, you could send a virtual machine's security logs to Event Hubs for immediate threat detection while also sending a copy to Storage for a seven-year compliance archive. This design separates the creation of logs from how they are used, making the system flexible.
A complete monitoring architecture brings together Azure's native tools and external systems to watch the health, performance, and security of your applications and infrastructure. The system depends on collecting consistent data from all parts of your environment, including virtual machines, networks, and application code. A good design helps operators spot problems early, before they cause outages, by providing clear visibility across both cloud and hybrid deployments.
Azure Monitor is the foundation, automatically gathering logs, metrics, and traces from all Azure services. You analyze this data by writing queries in KQL to find failures or track trends. The results can be shown on dashboards or used to trigger automated alerts. This central pipeline allows you to correlate different types of data instantly during an incident.
The Log Analytics workspace is the central database where your log data is stored in tables. You must manage its lifecycle by setting retention periods—shorter for development environments and longer for production—to control costs while meeting compliance rules. Proper management ensures historical data is available for audits without overspending.
Application Insights is designed specifically for monitoring applications. It tracks details like page load times, user counts, and how often your app calls other services. Developers use it to trace errors back to specific lines of code. By connecting this data to your DevOps pipelines, you can see how new code releases affect performance in real time, which can influence decisions to roll back a bad update.
You can also integrate third-party monitoring solutions if your organization uses existing tools across multiple clouds. These external systems connect to Azure Monitor via APIs to pull in Azure metrics, providing a single dashboard view. This approach is ideal for teams that must maintain consistent monitoring workflows across different cloud platforms or keep their current dashboards.
Single Sign-On (SSO) allows users to sign in once with one set of credentials to access many different applications. This improves productivity and security by reducing the number of passwords users must remember and manage. It works especially well with cloud applications like Microsoft 365.
Multifactor Authentication (MFA) adds a critical security layer by requiring a second form of verification beyond just a password. Azure MFA supports methods like a code sent via SMS, a phone call, or a notification through an authenticator app on a mobile device.
Managed Identities provide Azure resources with an automatically managed identity in Azure AD, removing the need to store and manage passwords in your code. A system-assigned managed identity is created for and tied to a single resource, like a virtual machine. A user-assigned managed identity is a standalone resource you can assign to multiple Azure resources. Service Principals are used by applications and tools to access resources securely but require you to manage their credentials, like certificates.
Azure AD uses modern protocols like OAuth 2.0 and OpenID Connect. OAuth 2.0 allows an application to securely access resources on a user's behalf without seeing the user's password. OpenID Connect builds on OAuth to verify the user's identity, telling the application who is signing in.
For organizations with on-premises Active Directory, federation services like Active Directory Federation Services (AD FS) enable users to sign into cloud applications using their existing local credentials. This provides a seamless experience while keeping authentication control on-premises.
Conditional Access policies add dynamic security controls. They evaluate conditions like the user's location, device health, or sign-in risk in real-time. Based on these signals, a policy might block access, allow it, or require MFA. This ensures access is granted only when conditions meet your security standards.
Identity management starts with authentication (verifying who you are) and authorization (determining what you're allowed to do). These two processes work together to control access to resources.
For hybrid environments, Azure AD Connect synchronizes user accounts and groups from on-premises Active Directory to Microsoft Entra ID, creating a unified identity. For more complex needs, you can deploy AD FS for federation or use Pass-through Authentication, which validates passwords directly against your on-premises servers without storing them in the cloud.
In a cloud-native model, Microsoft Entra ID is the primary identity provider. All identities are created and managed in the cloud, enabling direct use of advanced features like Conditional Access and MFA.
Advanced security integrates Conditional Access policies, which evaluate risk signals to dynamically allow or block access, with Identity Protection, which uses machine learning to detect risky sign-ins and compromised accounts. These features automate responses like requiring password resets.
Maintaining security requires auditing. Identity systems generate detailed logs of all authentication and authorization events. Collecting and analyzing these logs is essential for tracking user activity, investigating incidents, and proving compliance.
Choosing the right solution depends on your requirements. You must decide between a hybrid model using Azure AD Connect or AD FS and a cloud-only Microsoft Entra ID implementation. The choice balances existing infrastructure, application needs, compliance rules, and the desired user experience.
Azure RBAC controls access to Azure resources by assigning roles to users, groups, or applications at different scopes (management group, subscription, resource group, or individual resource). You can create custom roles to grant only the permissions needed for a specific job, enforcing the least-privilege principle. All actions are recorded in audit logs for review.
Privileged Identity Management (PIM) enhances security by making privileged roles just-in-time. Instead of permanent admin access, users must request elevation, often with approval, for a limited time. PIM automatically revokes access when the time expires, drastically reducing the attack surface.
Conditional Access policies authorize access based on real-time evaluation of conditions. A policy might block access from certain countries or require a compliant device. If a sign-in appears risky, the policy can force MFA. These dynamic policies provide a more secure and flexible gate than static permissions.
Azure Policy enforces organizational standards and compliance across your resources. It evaluates resources against rules you define—like requiring encryption on storage accounts—and can block non-compliant creations or automatically remediate existing resources. Policies can be grouped into initiatives to manage complex governance scenarios.
Managed identities allow Azure resources to authenticate to other services without any credentials in your code. An app on a virtual machine can use its managed identity to securely access Azure SQL or Key Vault. Azure manages the credential lifecycle, eliminating the risk of exposed secrets.
Access to on-premises resources in a hybrid setup uses different authentication methods. Password Hash Synchronization (PHS) syncs password hashes to Microsoft Entra ID, allowing cloud-based authentication. Pass-through Authentication (PTA) uses an on-premises agent to validate passwords directly against your domain controllers, keeping validation local. Active Directory Federation Services (AD FS) provides the most control by redirecting authentication to on-premises servers, but requires complex infrastructure.
Azure AD Connect is the synchronization engine that links your on-premises directory to the cloud. It regularly syncs user accounts and, if using PHS, password hashes. For PTA and AD FS, it syncs user data but establishes a trust boundary where the cloud service hands off the actual password validation to your local systems.
Microsoft Entra Application Proxy publishes on-premises web apps to the internet without opening inbound firewall ports. An external user authenticates with Microsoft Entra ID, and the request flows through a cloud endpoint. An on-premises Application Proxy connector retrieves the request over an outbound connection and forwards it to the internal web server. For integration with existing network hardware, Secure Hybrid Access partners like F5 BIG-IP can extend cloud identity controls to legacy traffic.
Conditional Access policies act as the gatekeeper for access to these published on-premises applications. Policies can require MFA, block access from unmanaged devices, or restrict access based on user location, ensuring only trusted and compliant users can reach internal resources.
Vault architecture starts by choosing between Azure Key Vault for most secrets and certificates, and Managed HSM for dedicated hardware security modules that meet strict compliance standards like FIPS 140-2 Level 3. The vault is a regional resource, and all application traffic to it flows over HTTPS. Management operations (the control plane) are separate from operations to retrieve secrets (the data plane).
Access control has two layers. Azure AD RBAC controls who can manage the vault itself (like creating it or setting firewall rules). The vault's own access policy defines exactly which users or applications can perform data operations like reading a specific secret. This two-layer model enforces least privilege: a security admin might manage the vault, while an application's managed identity gets only permission to read its own secret.
Automation is key for scaling. You can use Azure DevOps pipelines or Azure Logic Apps to automate certificate renewal and secret rotation. For example, a Logic App can periodically call the vault's API to generate a new storage account key and update the consuming services. This automates the secret lifecycle from created to active to expired.
For monitoring and compliance, every vault operation generates diagnostic logs that can be sent to Azure Monitor. Azure Policy can enforce rules on the vaults themselves, such as requiring soft-delete or restricting network access. Together, these tools provide an auditable trail and ensure vaults are configured to meet security and regulatory standards.
Governance design begins by mapping your organization's structure—departments, projects, environments—into an Azure hierarchy. Management groups act as containers above subscriptions, allowing you to apply policies and permissions broadly. Subscriptions are the units for billing and resource limits. Inside subscriptions, resource groups logically group resources that share a lifecycle, like all parts of an application, and provide a scope for applying policies.
Designing the management group hierarchy is critical. You place a root management group at the top, with child groups reflecting your organization. Roles assigned at a parent group flow down to all its children. Moving a subscription between groups can break these role assignments if you're not careful, requiring specific write permissions on both the source and target parents.
Resource tagging involves applying consistent key-value pairs (like "Environment: Prod" or "CostCenter: 12345") to resources for organization, cost management, and automation. A defined tagging taxonomy should be enforced via policy when resources are created. This enables operations like automated shutdown of development resources on weekends or cost reporting by department.
There are important technical limits. Custom roles that include data operation permissions cannot be assigned at the management group scope. Also, restructuring your hierarchy requires proactive permission management to avoid broken access. You can audit all governance actions, like role assignments, using activity logs sent to Azure Monitor, Storage, or Event Hubs.
Azure Policy helps enforce organizational standards and assess compliance across your Azure resources. You create rules that resources must follow, such as requiring encryption or specific VM sizes. Azure Policy evaluates resources automatically when they are deployed and on a schedule, reporting their compliance status.
Policies come as built-in definitions from Microsoft or custom definitions you create for specific needs. To address broader goals, you group related policies into initiatives, such as one for a specific regulatory framework like CIS Benchmarks. Initiatives can be assigned at the management group, subscription, or resource group level, with policies flowing down the hierarchy.
When a policy is assigned, you can set parameters to customize it without changing the definition. The compliance dashboard shows which resources pass or fail. For non-compliant resources, you can set up remediation tasks—either automatic fixes by Azure or manual alerts for administrators. Integrating with Azure Monitor Logs allows you to create alerts for compliance issues. This system provides continuous compliance, prevents configuration drift, and generates audit-ready documentation.
Azure AD Entitlement Management governs access at scale. It groups resources (like applications or SharePoint sites) into catalogs. Administrators then create access packages within these catalogs, which bundle the resources and roles needed for a task. Assignment policies control who can request a package, the approval workflow, and how long the access lasts.
Deploying this involves sequential steps: configuring the base entitlement management, defining automatic assignment policies, and setting up access reviews and custom extensions, each with estimated setup times.
To enforce separation of duties and compliance, the system checks a user's existing permissions when they request an access package. If the new permissions would create a conflict, the request is blocked. This is monitored and reported for audits.
Access packages support multi-stage approval workflows. Access can be granted for a limited time, requiring periodic re-certification to maintain the principle of least privilege. Access can be automated based on user attributes (like department) or triggered manually via PowerShell.
To extend governance, you integrate Azure Logic Apps to create custom workflows triggered by lifecycle events—like a new access request or an impending expiration. These workflows can send notifications, call external APIs, or create tasks in other systems, automating the entire governance process.
Operational excellence in logging aims to minimize manual maintenance while maximizing system visibility. A core architecture strategy is deploying the fewest number of Log Analytics workspaces ne…
Operational excellence in logging aims to minimize manual maintenance while maximizing system visibility. A core architecture strategy is deploying the fewest number of Log Analytics workspaces ne…
Establishing this infrastructure involves specific, sequential deployment steps. Administrators first configure the base entitlement management structure, which typically takes one hour of deployment …
Establishing this infrastructure involves specific, sequential deployment steps. Administrators first configure the base entitlement management structure, which typically takes one hour of deployment …
Single Sign-On (SSO) lets users access multiple applications by signing in once with a single set of credentials. This removes the need to remember and manage multiple passwords, and it reduces th…
Single Sign-On (SSO) lets users access multiple applications by signing in once with a single set of credentials. This removes the need to remember and manage multiple passwords, and it reduces th…
StudyCerts
StudyCerts