AZ-900 Microsoft Azure Fundamentals Exam

Understand the Concept of Infrastructure as Code (IaC)

Infrastructure as Code (IaC) is a key concept in cloud computing that involves managing and provisioning cloud resources using code instead of manual configuration. By defining infrastructure in machine-readable files, organizations achieve automation, consistency, and scalability in their cloud environments. This approach reduces the risk of human error and increases deployment reliability across platform environments like Azure.

With IaC, developers define resource configurations that can be automatically deployed to Azure using tools like Azure Pipelines or Terraform. The main benefits of IaC include consistency, repeatability, and version control. Consistency ensures that infrastructure is set up uniformly across dev and prod environments, repeatability allows the exact same setup to be deployed multiple times, and version control enables teams to track changes and roll back if necessary.

Examine Azure Resource Manager (ARM) Templates

Azure Resource Manager (ARM) templates use a declarative syntax to define the Azure resources you want to deploy. Instead of writing step-by-step scripts on how to build a resource, you describe the desired final state of the infrastructure, and Azure handles the actual creation. This declarative approach ensures your infrastructure setup remains consistent every time you run the deployment.

An ARM template is a JSON file with a defined structure that tells Azure exactly how to deploy your services. It contains distinct sections that organize how parameters, variables, and resources interact. These components work together to ensure that the template is highly customizable and reusable across different environments. The key template sections include:

• $schema and contentVersion: Define the template schema and version.
• parameters: Values supplied at deployment time to customize the template.
• variables: Reusable values defined and used internally within the template.
• resources: The actual Azure services to be created or configured.
• outputs: Values returned after a successful deployment.

ARM templates are idempotent, which means you can deploy the same template multiple times to the same environment without causing unintended changes. This repeatable behavior prevents configuration drift and ensures reliable environments. Automated tools like the Azure CLI or PowerShell run these templates to support fast and scalable infrastructure delivery.

Utilize Azure Bicep for IaC

Azure Bicep is a domain-specific language (DSL) designed to simplify the authoring experience of infrastructure code in Azure. It serves as a cleaner, more readable alternative to ARM templates while preserving all of their benefits. Bicep allows you to define resources, parameters, and outputs in a single file with a concise syntax.

Bicep provides several distinct advantages for cloud administrators and developers. It provides native support for all Azure resource types and API versions immediately on release. Additionally, Bicep features reliable type safety that catches errors early during the authoring phase, along with modules that promote code reuse. These benefits include:

• Simple syntax: Much easier to read and write than verbose JSON.
• Type safety: Catches validation errors during development.
• Code reuse: Uses modular files and parameter configurations for standardization.

The authoring lifecycle is supported by the Bicep Extension for VS Code, which offers IntelliSense, real-time syntax validation, and rich type assistance. Developers can also use the Bicep CLI to decompile existing ARM templates, deploy Bicep files directly, or generate parameters. Because Bicep deployments are idempotent, they can be repeated safely without risk of modifying already correct resources, ensuring strong governance.

Implement IaC with Azure DevOps

Implementing IaC with Azure DevOps begins by storing infrastructure templates and scripts in a Git-based repository using Azure Repos. Keeping your code in a centralized version control system establishes a single source of truth and allows teams to use branching and pull requests for peer reviews. This ensures that every change is tracked and that environments are constructed consistently from approved code.

To automate deployments, Azure Pipelines connects to your Azure subscription through a secure service connection. Azure DevOps automatically provisions a Microsoft Entra service principal to facilitate this connection. Security is maintained by granting this service principal the Deployment Environments User role using role-based access control (RBAC), ensuring it only has the minimum necessary permissions.

The deployment process is defined in an azure-pipelines.yml file located at the root of the repository. Each job in the pipeline automates the specific steps required to deploy the infrastructure and code. Parameterizing these steps allows teams to run identical deployments across developmental, testing, and production stages. Typical pipeline steps include:

• Creating the target environment using az devcenter.
• Deploying ARM or Bicep templates to configure Azure resources.
• Deploying the application code using built-in tasks like AzureFunctionApp@2.

Evaluate Security and Compliance in IaC

While IaC automates and scales cloud deployments, it also introduces security risks because a single file defines your entire cloud environment. If the code contains misconfigurations, those vulnerabilities will be deployed directly into production. To secure infrastructure code, teams must enforce strict version control, configure precise role-based access control (RBAC) to limit who can modify the code, and mandate thorough code reviews before any deployment.

IaC makes it easier to enforce organizational and regulatory compliance because policies can be embedded into the automated deployment lifecycle. Integrating automated checks into your pipeline prevents non-compliant resources from ever being created. Using these tools allows organizations to scale safely while maintaining strict control over their cloud environments. Key methods for ensuring compliance include:

• Policy Definition: Use Azure Policy to define and enforce guardrails across deployed resources.
• Audit Trails: Keep complete logs of all deployment changes to support auditing processes.
• Automated Testing: Integrate tests within your CI/CD pipelines to verify that configurations are compliant before they deploy.