AZ-204: Developing Solutions for Microsoft Azure

Create and Configure an Azure Functions App

A multi-stage Dockerfile helps you build efficient images by separating the compilation environment from the final runtime environment. The build stage compiles the application, and then only the required production files are copied into a clean, small runtime image. This separation reduces the overall image size and minimizes security vulnerabilities by leaving development tools behind. Ordering your instructions to maximize layer caching speeds up rebuilds, while using a .dockerignore file prevents unneeded files from bloating the build.

Authentication verifies who a user is, while authorization decides what that user can do. Azure App Service handles authentication through built-in support for identity providers like Microsoft Entra ID, Facebook, Google, and X, using OAuth 2.0 to manage the login flow. When a user tries to access your app, unauthenticated requests get redirected to the chosen provider before reaching your code. You configure this through the Authentication blade in the Azure portal, where you specify supported account types, what happens for unauthenticated requests, and whether to store tokens for session management.

Azure Blob Storage organizes blob data using system-defined properties and user-defined metadata. System-defined properties represent standard HTTP headers that control how the web handles the file. These headers include Content-Type to define the MIME type, Cache-Control to direct client caching, and ETag to uniquely identify the current file version. In contrast, user-defined metadata consists of custom name-value pairs created by developers to categorize files for custom business workflows. These custom metadata pairs must follow HTTP header naming rules, have a combined size limit of 8 KB, and do not change how the blob behaves.

To store data in Azure Cosmos DB, you programmatically create Azure Cosmos DB containers using the SDK. During creation, you must specify a partition key, which is a JSON property used to distribute data across logical partitions. You also configure throughput measured in Request Units (RUs), which can be managed manually or through autoscale to automatically adjust capacity based on workload demand. Additionally, developers configure the consistency level, time-to-live (TTL) rules for data expiration, and indexing policies to optimize database behavior.

Authorization determines what an authenticated user or application can do. The Microsoft Identity Platform controls this through permissions, roles, and policies. Applications request delegated permissions when acting on behalf of a signed-in user, or application permissions when running without a user, such as background services. You configure these in the Azure portal, always following the principle of least privilege. Role-Based Access Control (RBAC) assigns permissions based on organizational roles like "Reader" or "Contributor", and you can use built-in or custom roles. The consent framework governs how users or administrators grant an application permission to access resources; high-risk permissions require admin consent. Conditional Access policies add security by requiring conditions like multifactor authentication (MFA) or trusted locations before granting access. Managed identities provide an automatically managed identity for Azure resources, eliminating the need to store credentials in code. System-assigned identities are tied to a specific resource, while user-assigned identities can be shared across services.

Azure App Configuration provides a central service for storing and managing application settings and feature flags. This is especially useful for microservices and serverless apps, as it separates configuration from code, preventing errors and making updates easier. For sensitive information like connection strings and API keys, you should use Azure Key Vault, which is a dedicated, secure vault. The two services work together using Key Vault references, which are pointers in App Configuration that tell your application where to find a secret in Key Vault, keeping the actual secrets locked away.

Application Insights is a monitoring tool that watches how your application behaves when it runs in Azure. It collects three main types of data: metrics are numbers that measure performance like how fast a request completes or how much memory is used, logs are text records that describe what happened during a request including errors and warnings, and traces are detailed records that follow a single request through every part of the code. When you connect Application Insights to your app, it automatically gathers this data without requiring you to write extra code, though you can customize what gets collected.

Azure Event Grid is a serverless event routing service that connects event sources to event handlers. An event source, such as a storage account, a resource group, or a custom application, publishes events to an Event Grid topic. A topic can be a system topic for Azure services or a custom topic for your own applications. Event Grid then forwards each event to every event subscription that has been created on that topic, but only if the event matches the subscription's filter. Filters can match on event type, subject prefix/suffix, or advanced fields, so a single topic can serve many different handlers.

Azure API Management (APIM) acts as a central proxy that sits between your client applications and your backend services. It is made up of three main components that work together to manage the lifecycle of your APIs. The API gateway handles all incoming traffic, routes requests to the correct backends, and verifies security credentials. The management plane is the control center where administrators configure APIs and view analytics, while the developer portal is a web portal where external developers can discover and learn how to use your APIs. When deploying APIM, you must choose a pricing tier, such as the Consumption tier for serverless environments or the Premium tier for enterprise networking and multi-region support.

Azure Service Bus is a cloud messaging service used to connect different applications and services. It acts as a reliable middleman, allowing parts of a distributed system to communicate without being directly connected. This is useful for decoupling applications, which means one part can be changed or fail without immediately breaking the others.