Cloud · Azure
Microsoft Azure
Microsoft's public cloud platform, tightly integrated with Entra ID and Microsoft 365, organised through management groups, subscriptions and resource groups.
Overview
Azure organises resources hierarchically: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Azure Policy and role based access control apply at any level and inherit downward, which makes the hierarchy a governance instrument rather than mere bookkeeping.
Its distinguishing characteristic for most enterprises is identity integration. Azure uses the same Entra ID tenant as Microsoft 365, so Conditional Access, Privileged Identity Management and identity governance apply to cloud infrastructure administration directly.
How it works
- 01A landing zone establishes management group structure, subscription strategy, network topology, policy baseline, identity model and logging before workloads arrive.
- 02Hub and spoke networking centralises shared services, firewall, gateways, DNS, in a hub virtual network peered to workload spokes.
- 03Managed identities let resources authenticate to Azure services without stored secrets.
- 04Azure Policy enforces or audits configuration continuously, and deny effects prevent non compliant resources being created at all.
Reference table
| Function | Service | Notes |
|---|---|---|
| Compute | Virtual Machines, App Service, Functions, AKS | IaaS through to serverless and Kubernetes |
| Storage | Storage Accounts (Blob, Files), Managed Disks | Redundancy options from LRS to GZRS |
| Networking | Virtual Network, NSG, Azure Firewall, Front Door, ExpressRoute | Hub and spoke is the common topology |
| Databases | Azure SQL, Cosmos DB, PostgreSQL/MySQL Flexible Server | Managed backup and failover groups |
| Identity | Microsoft Entra ID, Managed Identities | Shared with Microsoft 365 |
| Monitoring | Azure Monitor, Log Analytics, Application Insights | Feeds Microsoft Sentinel |
| Security | Defender for Cloud, Key Vault, Azure Policy | Posture, secrets and guardrails |
Design considerations
- Separate subscriptions by environment and blast radius, not by department convenience.
- Plan address space against on premises and other clouds before creating virtual networks; renumbering later is painful.
- Send diagnostic and activity logs to a central Log Analytics workspace in a separate, tightly controlled subscription.
- Adopt tagging standards at day one for cost allocation, ownership and lifecycle.
Security considerations
- Use PIM for eligible role activation and avoid permanent Owner or Contributor assignments at subscription scope.
- Store secrets, keys and certificates in Key Vault with purge protection and access policy or RBAC.
- Enable Defender for Cloud plans on high value resource types and act on secure score regressions.
- Restrict public network access on PaaS services; use private endpoints for sensitive data services.
Common misconfigurations
- Storage accounts with public blob access left enabled.
- Network security groups allowing RDP or SSH from the internet for 'temporary' access.
- Resources created outside the landing zone structure, escaping policy and logging.
- Cost alerts absent, so a misconfigured autoscale or forgotten test cluster runs for months.