Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Gauge your current knowledge
Gauge your current knowledge
Azure's global physical structure is organized into a hierarchy designed to keep services resilient and close to users. At the base of this structure are regions, which are geographical areas containing one or more datacenters connected through a low-latency network. Within these regions, Azure provides availability zones, which are physically separate datacenters equipped with independent power, cooling, and networking. To manage these resources logically, users place them into a resource group, which acts as a container for organizing and securing related assets. This physical and logical structure helps organizations meet performance goals and comply with data residency rules by choosing exactly where data is processed and stored.
Cloud computing is a model that provides on-demand, over-the-network access to a shared pool of configurable computing resources like servers, networks, and storage. These resources can be quickly set up and released with very little management effort. The model relies on five core characteristics:
In a shared environment, Azure maintains security through logical isolation, which keeps each customer's data and applications private from others on the same hardware. This system relies on strict user access controls, compute isolation, networking isolation with encryption in transit, and storage isolation with encryption at rest. For businesses requiring absolute separation, physical compute isolation is available through an Azure Dedicated Host. Data is further protected by data encryption using keys managed either by Azure or by the customer. To protect these keys, Azure Key Vault stores them in highly secure hardware modules, allowing organizations to bring their own keys securely.
Moving to the cloud offers primary benefits like cost savings, flexibility, and scalability. Instead of buying expensive hardware upfront, companies pay only for what they use on a subscription basis, leading to predictable budgets. Workloads can easily scale up or down based on current demand, and employees can securely access cloud tools from any location with an internet connection.
However, cloud computing also presents several challenges that organizations must manage. Storing data in the cloud introduces security concerns, which Azure addresses using data encryption and logical isolation, though users must still configure their own access controls correctly. Compliance with industry-specific laws can be complex, but Azure provides built-in tools and guidance to help. Finally, because systems rely on external networks, companies must prepare for potential downtime by building redundancy and backup solutions into their setups.
Understanding how to fund IT resources requires choosing between two main financial models. Under the traditional Capital Expenditure (CapEx) model, an organization spends money on physical infrastructure upfront, such as physical servers that must be maintained over time. In contrast, cloud computing operates on an Operational Expenditure (OpEx) model, where businesses pay for resources as they consume them, treating computing costs as an ongoing operational expense. Adopting an OpEx approach removes the need for large upfront investments, allowing companies to align their spending directly with actual daily demand.
Cloud agility is built on the key concepts of scalability and elasticity. Scalability refers to the ability of a system to handle increased load by adding resources to the existing pool, which can mean adding more power to an existing server or adding more virtual machines. Elasticity is the ability of the system to automatically adjust these resources in real-time, scaling out when traffic spikes and scaling in when traffic decreases. Azure services leverage these principles to match resource availability dynamically with current demand, ensuring applications remain performant during busy periods without overpaying for idle resources.
Cloud services are grouped into three primary delivery models: Infrastructure as a Service, Platform as a Service, and Software as a Service. Infrastructure as a Service (IaaS) provides virtualized hardware over the internet, allowing users to rent virtual machines, storage, and networking. This model gives users the most control, making it perfect for migrating existing applications or running workloads with custom configuration needs.
Platform as a Service (PaaS) shifts the focus from managing hardware to building applications. In this model, Azure provides the development tools, database management systems, and operating systems, allowing developers to focus purely on application logic and code. This approach speeds up development because the cloud provider handles the underlying infrastructure updates and security patching.
Software as a Service (SaaS) provides fully completed software applications that users access over the internet, typically through a web browser. With SaaS, the service provider manages everything, including infrastructure, databases, and application updates. This model is ideal for standard business applications, like email or collaboration tools, where the customer only wants to use the software without any maintenance burden.
Microsoft Azure functions as a massive multitenant cloud platform where multiple customers share physical computing hardware. To keep data secure, Azure implements logical isolation to ensure that one customer's environment cannot access or see another customer's data. This boundary is maintained through strict identity authentication, secure storage isolation with data encryption at rest, and network encryption in transit.
Managing resources on this platform requires a cloud subscription, which serves as a billing and organizational boundary. Although creating a subscription itself has no cost, it acts as a container for tracking usage and budgeting resources like virtual machines or databases. Organizations can set up multiple subscriptions to separate different environments, delegate administrative control to specific teams, and enforce security policies across various departments.
The division of labor between the cloud provider and the customer is defined by the shared responsibility model. In a traditional on-premises environment, the customer is responsible for everything, from physical security to application data. When moving to the cloud, Azure always assumes responsibility for physical hosts, physical networks, and physical datacenter security. The customer, on the other hand, always retains responsibility for managing their own endpoints, customer accounts, and data security.
For the parts of the system in the middle, responsibility shifts depending on the cloud service model you select. Under IaaS, the customer is still responsible for the operating system, network controls, and installed applications. When choosing PaaS, the operating system and network controls shift to Azure's responsibility, allowing the customer to focus purely on application configurations. In a SaaS setup, almost all of the remaining technical responsibilities shift to Azure, leaving the customer to manage only the users who access the system.
Choosing how to deploy resources depends on an organization's specific security, compliance, and budget requirements. A public cloud uses shared physical hardware owned by Azure, which provides high scalability with low upfront costs. In contrast, a private cloud runs on physical hardware dedicated entirely to a single organization, giving complete physical control over sensitive workloads. To combine the best of both worlds, a hybrid cloud connects public and private clouds, enabling secure data flow between them to optimize costs and security. Finally, a multi-cloud strategy involves using services from multiple different public cloud providers to avoid vendor lock-in and increase resilience.