Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Gauge your current knowledge
Gauge your current knowledge
Azure’s global physical structure is organized into a hierarchy designed to keep services resilient and close to users. At the base are regions, which are geographical areas containing one or more datacenters connected through a low‑latency network. Within regions, Azure provides availability zones—physically separate datacenters with independent power, cooling, and networking. To manage these resources logically, users place them into a resource group, which acts as a container for organizing and securing related assets. This physical and logical structure helps organizations meet performance goals and comply with data residency rules by choosing exactly where data is processed and stored.
Cloud computing is a model that provides on‑demand, over‑the‑network access to a shared pool of configurable computing resources like servers, networks, and storage. These resources can be quickly set up and released with little management effort. The model relies on five core characteristics:
In a shared environment, Azure maintains security through logical isolation, which keeps each customer’s data and applications private from others on the same hardware. This system relies on strict user access controls, compute isolation, networking isolation with encryption in transit, and storage isolation with encryption at rest. For businesses requiring absolute separation, physical compute isolation is available through an Azure Dedicated Host. Data is further protected by data encryption using keys managed either by Azure or by the customer. To protect these keys, Azure Key Vault stores them in highly secure hardware modules, allowing organizations to bring their own keys securely.
Moving to the cloud offers primary benefits like cost savings, flexibility, and scalability. Instead of buying expensive hardware upfront, companies pay only for what they use on a subscription basis, leading to predictable budgets. Workloads can easily scale up or down based on current demand, and employees can securely access cloud tools from any location with an internet connection. However, cloud computing also presents challenges. Storing data in the cloud introduces security concerns, which Azure addresses using data encryption and logical isolation, though users must still configure their own access controls correctly. Compliance with industry‑specific laws can be complex, but Azure provides built‑in tools and guidance to help. Finally, because systems rely on external networks, companies must prepare for potential downtime by building redundancy and backup solutions into their setups.
Cloud agility is built on the key concepts of scalability and elasticity. Scalability refers to the ability of a system to handle increased load by adding resources to the existing pool, which can mean adding more power to an existing server or adding more virtual machines. Elasticity is the ability of the system to automatically adjust these resources in real time, scaling out when traffic spikes and scaling in when traffic decreases. Azure services leverage these principles to match resource availability dynamically with current demand, ensuring applications remain performant during busy periods without overpaying for idle resources.
Cloud services are grouped into three primary delivery models. Infrastructure as a Service (IaaS) provides virtualized hardware over the internet, allowing users to rent virtual machines, storage, and networking. This model gives users the most control, making it perfect for migrating existing applications or running workloads with custom configuration needs. Platform as a Service (PaaS) shifts the focus from managing hardware to building applications. Here, Azure provides the development tools, database management systems, and operating systems, allowing developers to focus purely on application logic and code. This approach speeds up development because the cloud provider handles the underlying infrastructure updates and security patching. Software as a Service (SaaS) provides fully completed software applications that users access over the internet, typically through a web browser. With SaaS, the service provider manages everything, including infrastructure, databases, and application updates. This model is ideal for standard business applications like email or collaboration tools, where the customer only wants to use the software without any maintenance burden.
Microsoft Azure functions as a massive multitenant cloud platform where multiple customers share physical computing hardware. To keep data secure, Azure implements logical isolation to ensure that one customer’s environment cannot access or see another customer’s data. This boundary is maintained through strict identity authentication, secure storage isolation with data encryption at rest, and network encryption in transit. Managing resources on this platform requires a cloud subscription, which serves as a billing and organizational boundary. Although creating a subscription itself has no cost, it acts as a container for tracking usage and budgeting resources like virtual machines or databases. Organizations can set up multiple subscriptions to separate different environments, delegate administrative control to specific teams, and enforce security policies across various departments.
The division of labor between the cloud provider and the customer is defined by the shared responsibility model. In a traditional on‑premises environment, the customer is responsible for everything, from physical security to application data. When moving to the cloud, Azure always assumes responsibility for physical hosts, physical networks, and physical datacenter security. The customer, on the other hand, always retains responsibility for managing their own endpoints, customer accounts, and data security.
For the parts of the system in the middle, responsibility shifts depending on the cloud service model you select. Under IaaS, the customer is still responsible for the operating system, network controls, and installed applications. When choosing PaaS, the operating system and network controls shift to Azure’s responsibility, allowing the customer to focus purely on application configurations. In a SaaS setup, almost all of the remaining technical responsibilities shift to Azure, leaving the customer to manage only the users who access the system.
Choosing how to deploy resources depends on an organization’s specific security, compliance, and budget requirements. A public cloud uses shared physical hardware owned by Azure, which provides high scalability with low upfront costs. In contrast, a private cloud runs on physical hardware dedicated entirely to a single organization, giving complete physical control over sensitive workloads. To combine the best of both worlds, a hybrid cloud connects public and private clouds, enabling secure data flow between them to optimize costs and security. Finally, a multi‑cloud strategy involves using services from multiple different public cloud providers to avoid vendor lock‑in and increase resilience.
Each cloud model fits different scenarios. A public cloud is ideal when an organization needs high scalability and wants to keep upfront costs low—for example, hosting a web application with unpredictable traffic. A private cloud is the right choice when the workload must meet strict security or compliance rules, such as handling sensitive financial data. A hybrid cloud works well when a company wants to keep some data on‑premises for control while taking advantage of the cloud’s scalability for other parts of the business. A multi‑cloud strategy helps organizations avoid relying on a single vendor and can improve resilience by spreading workloads across multiple providers.
Understanding how to fund IT resources requires choosing between two main financial models. Under the traditional Capital Expenditure (CapEx) model, an organization spends money on physical infrastructure upfront, such as physical servers that must be maintained over time. In contrast, cloud computing operates on an Operational Expenditure (OpEx) model, where businesses pay for resources as they consume them, treating computing costs as an ongoing operational expense. Adopting an OpEx approach removes the need for large upfront investments, allowing companies to align their spending directly with actual daily demand.
Cloud pricing follows a pay‑as‑you‑go approach that differs from traditional on‑premises spending. With CapEx, you buy hardware before you need it and then depreciate it over years, regardless of whether you fully use it. With OpEx, you pay only for the resources you actually use, and you can stop paying when you no longer need them. Azure measures resource usage—such as virtual machine hours, storage consumed, and data transferred—and bills you at the end of each billing cycle. This model gives you flexibility to adjust spending up or down as demand changes, and you never pay for idle capacity. The trade‑off is that ongoing operational costs can add up, but they remain predictable because they match actual consumption.
Serverless computing is a cloud execution model where the cloud provider automatically manages the allocation and provisioning of servers. It represents an evolution of Platform as a Service (PaaS) that allows developers to run code without worrying about the underlying infrastructure. Serverless aligns with the cloud characteristics of rapid elasticity—the platform scales automatically in response to each request—and measured service, because you pay only for the compute time your code actually uses. Developers focus purely on writing functions or application logic, while Azure handles all server management, scaling, and billing by execution.