AZ Landscape cheat sheet

Azure resource hierarchy: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources.

An Azure region is a geographic area containing one or more datacenters; not every region supports availability zones.

Availability zones are physically separate datacenter groups within a region, each with independent power, cooling, and networking.

Most Azure regions are paired with another region in the same geography, typically at least 300 miles away, for sequential updates and recovery.

Azure Resource Manager is the control plane for provisioning, RBAC, tagging, and template-based deployment of resources.

Shared responsibility: the provider secures physical infrastructure; the customer always owns data, identities, and access configuration.

IaaS leaves OS and runtime management to the customer; PaaS leaves OS and runtime to the provider; SaaS leaves application management to the provider.

Tags are not inherited by default; Azure Policy can enforce or inherit tags across resources.

An App Service plan defines region, operating system, pricing tier, and compute capacity; multiple apps in one plan share those resources.

Azure Functions Consumption plan scales to zero and bills per execution and execution time; Premium adds pre-warmed instances and virtual network integration.

Virtual Machine Scale Sets deploy and manage groups of VMs with autoscaling and load balancing.

Availability sets use fault domains and update domains inside a datacenter; availability zones use separate datacenters within a region.

Azure Kubernetes Service manages the Kubernetes control plane; customer workloads run on nodes in the customer subscription.

Azure Container Instances runs standalone containers without an orchestrator; Azure Container Apps provides serverless containers with event-driven scaling.

Spot VMs use unused capacity at lower cost but can be evicted and carry no SLA; they suit interruptible workloads.

Azure Batch targets large parallel and high-performance computing jobs; Service Fabric targets microservices and stateful services.

A virtual network is regional and scoped to a subscription; subnets divide the VNet address space and can attach network security groups.

Network security group rules are stateful, evaluated by priority from 100 to 4096, and a lower number takes precedence.

VNet peering connects virtual networks privately over the Azure backbone; peering is non-transitive and can be regional or global.

VPN Gateway provides site-to-site IPsec connectivity over the public internet; ExpressRoute provides private dedicated connectivity through a provider.

Azure Bastion provides RDP and SSH through the Azure portal over TLS without assigning public IP addresses to virtual machines.

Private Endpoint assigns a private IP address from a VNet to a PaaS service; Private DNS zones resolve the service name to that private IP.

Azure Load Balancer operates at layer 4; Application Gateway operates at layer 7 with optional WAF; Front Door provides global layer 7 routing.

Traffic Manager routes using DNS responses; Azure DNS hosts public zones, and Private DNS zones support internal name resolution.

Storage replication options include LRS, ZRS, GRS, RA-GRS, GZRS, and RA-GZRS; geo-redundant options protect against regional failure.

Blob access tiers are Hot, Cool, Cold, and Archive; Cool has a 30-day minimum, Cold 90 days, and Archive 180 days with rehydration required.

Block blobs store files and objects; append blobs suit logs; page blobs back Azure VM disks.

Azure Files provides SMB or NFS file shares; Queue Storage provides messaging; Table Storage provides NoSQL key-value data.

AzCopy moves blobs and files; Azure Data Factory orchestrates data movement and transformation; Azure Data Box supports large offline transfers.

Azure Cosmos DB offers strong, bounded staleness, session, consistent prefix, and eventual consistency levels, with request units per second as throughput.

Azure SQL Database is PaaS; Azure SQL Managed Instance offers near-full SQL Server compatibility; SQL Server on Azure VMs gives IaaS control.

Azure Synapse dedicated SQL pools provide massively parallel processing; Data Lake Storage Gen2 adds a hierarchical namespace to blob storage.

Microsoft Entra ID is the cloud identity provider; a tenant is a dedicated directory instance holding users, groups, and applications.

Authentication proves identity; authorization determines permitted actions through systems such as Azure RBAC.

Azure RBAC assigns role definitions to security principals at management group, subscription, resource group, or resource scope.

Conditional Access evaluates sign-in conditions such as user, device, location, application, and risk before granting or blocking access.

Managed identities provide automatic Entra ID credentials; system-assigned identities follow resource lifecycle, while user-assigned identities are independent.

Azure Key Vault stores secrets, keys, and certificates; access can be controlled by Azure RBAC or vault access policies.

Privileged Identity Management provides just-in-time role activation, approvals, and access reviews for privileged accounts.

Microsoft Defender for Cloud provides cloud security posture management, Secure Score, and workload protections; Zero Trust follows verify explicitly, least privilege, and assume breach.

Management groups organize subscriptions for consistent policy and access assignment above the subscription level.

Azure Policy evaluates resources and can audit, deny, append, modify, or deploy resources to enforce standards.

An initiative groups multiple policy definitions into one assignable governance package.

A resource belongs to exactly one resource group; resource groups are logical containers sharing lifecycle and access control.

Azure budgets track actual or forecasted spending against thresholds and can trigger alerts or actions.

Azure Reservations provide one- or three-year discounts for predictable resources; Savings Plans offer compute flexibility in exchange for commitment.

Cost drivers include region, pricing tier, redundancy, storage transactions, and outbound data transfer; inbound data transfer is commonly free.

Tags support cost allocation and reporting but are not inherited by default; Azure Policy can enforce tag inheritance.

Azure Synapse Analytics combines dedicated SQL pools, serverless SQL, Spark, and pipelines for data warehousing and big-data processing.

Azure Databricks is a managed Apache Spark platform with collaborative notebooks and Delta Lake support.

Azure Data Factory builds ETL and ELT pipelines using linked services, datasets, activities, and integration runtimes.

Azure Stream Analytics processes real-time streams from sources such as Event Hubs or IoT Hub using SQL-like queries.

Event Hubs ingests high-volume event streams; Service Bus provides queues and topics for enterprise messaging.

Event Grid provides event-based publish-subscribe routing; Logic Apps provides low-code workflows with SaaS and enterprise connectors.

Azure AI services provide prebuilt models for vision, speech, language, and search; Azure Machine Learning manages model training and MLOps.

Azure AI Search supports full-text and vector search; Azure OpenAI provides access to generative AI models through Azure endpoints.

Azure Monitor collects metrics as numeric time-series data and logs for querying and alerting.

Application Insights provides application performance monitoring, distributed tracing, and availability tests.

A Log Analytics workspace stores Azure Monitor logs queried with KQL and defines retention and access boundaries.

Diagnostic settings route platform logs and metrics to destinations such as Log Analytics, storage accounts, or event hubs.

Recovery Time Objective is the maximum acceptable outage duration; Recovery Point Objective is the maximum acceptable data loss.

Azure Backup provides recovery points; Azure Site Recovery replicates and orchestrates failover and failback for disaster recovery.

Azure Service Health reports service incidents and planned maintenance; Resource Health reports the health of specific resources.

For serial dependencies, a composite SLA is the product of the individual SLAs; adding redundancy generally improves availability.

Azure resource hierarchy: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources.

An Azure region is a geographic area containing one or more datacenters; not every region supports availability zones.

Availability zones are physically separate datacenter groups within a region, each with independent power, cooling, and networking.

Most Azure regions are paired with another region in the same geography, typically at least 300 miles away, for sequential updates and recovery.

Azure Resource Manager is the control plane for provisioning, RBAC, tagging, and template-based deployment of resources.

Shared responsibility: the provider secures physical infrastructure; the customer always owns data, identities, and access configuration.

IaaS leaves OS and runtime management to the customer; PaaS leaves OS and runtime to the provider; SaaS leaves application management to the provider.

Tags are not inherited by default; Azure Policy can enforce or inherit tags across resources.

An App Service plan defines region, operating system, pricing tier, and compute capacity; multiple apps in one plan share those resources.

Azure Functions Consumption plan scales to zero and bills per execution and execution time; Premium adds pre-warmed instances and virtual network integration.

Virtual Machine Scale Sets deploy and manage groups of VMs with autoscaling and load balancing.

Availability sets use fault domains and update domains inside a datacenter; availability zones use separate datacenters within a region.

Azure Kubernetes Service manages the Kubernetes control plane; customer workloads run on nodes in the customer subscription.

Azure Container Instances runs standalone containers without an orchestrator; Azure Container Apps provides serverless containers with event-driven scaling.

Spot VMs use unused capacity at lower cost but can be evicted and carry no SLA; they suit interruptible workloads.

Azure Batch targets large parallel and high-performance computing jobs; Service Fabric targets microservices and stateful services.

A virtual network is regional and scoped to a subscription; subnets divide the VNet address space and can attach network security groups.

Network security group rules are stateful, evaluated by priority from 100 to 4096, and a lower number takes precedence.

VNet peering connects virtual networks privately over the Azure backbone; peering is non-transitive and can be regional or global.

VPN Gateway provides site-to-site IPsec connectivity over the public internet; ExpressRoute provides private dedicated connectivity through a provider.

Azure Bastion provides RDP and SSH through the Azure portal over TLS without assigning public IP addresses to virtual machines.

Private Endpoint assigns a private IP address from a VNet to a PaaS service; Private DNS zones resolve the service name to that private IP.

Azure Load Balancer operates at layer 4; Application Gateway operates at layer 7 with optional WAF; Front Door provides global layer 7 routing.

Traffic Manager routes using DNS responses; Azure DNS hosts public zones, and Private DNS zones support internal name resolution.

Storage replication options include LRS, ZRS, GRS, RA-GRS, GZRS, and RA-GZRS; geo-redundant options protect against regional failure.

Blob access tiers are Hot, Cool, Cold, and Archive; Cool has a 30-day minimum, Cold 90 days, and Archive 180 days with rehydration required.

Block blobs store files and objects; append blobs suit logs; page blobs back Azure VM disks.

Azure Files provides SMB or NFS file shares; Queue Storage provides messaging; Table Storage provides NoSQL key-value data.

AzCopy moves blobs and files; Azure Data Factory orchestrates data movement and transformation; Azure Data Box supports large offline transfers.

Azure Cosmos DB offers strong, bounded staleness, session, consistent prefix, and eventual consistency levels, with request units per second as throughput.

Azure SQL Database is PaaS; Azure SQL Managed Instance offers near-full SQL Server compatibility; SQL Server on Azure VMs gives IaaS control.

Azure Synapse dedicated SQL pools provide massively parallel processing; Data Lake Storage Gen2 adds a hierarchical namespace to blob storage.

Microsoft Entra ID is the cloud identity provider; a tenant is a dedicated directory instance holding users, groups, and applications.

Authentication proves identity; authorization determines permitted actions through systems such as Azure RBAC.

Azure RBAC assigns role definitions to security principals at management group, subscription, resource group, or resource scope.

Conditional Access evaluates sign-in conditions such as user, device, location, application, and risk before granting or blocking access.

Managed identities provide automatic Entra ID credentials; system-assigned identities follow resource lifecycle, while user-assigned identities are independent.

Azure Key Vault stores secrets, keys, and certificates; access can be controlled by Azure RBAC or vault access policies.

Privileged Identity Management provides just-in-time role activation, approvals, and access reviews for privileged accounts.

Microsoft Defender for Cloud provides cloud security posture management, Secure Score, and workload protections; Zero Trust follows verify explicitly, least privilege, and assume breach.

Management groups organize subscriptions for consistent policy and access assignment above the subscription level.

Azure Policy evaluates resources and can audit, deny, append, modify, or deploy resources to enforce standards.

An initiative groups multiple policy definitions into one assignable governance package.

A resource belongs to exactly one resource group; resource groups are logical containers sharing lifecycle and access control.

Azure budgets track actual or forecasted spending against thresholds and can trigger alerts or actions.

Azure Reservations provide one- or three-year discounts for predictable resources; Savings Plans offer compute flexibility in exchange for commitment.

Cost drivers include region, pricing tier, redundancy, storage transactions, and outbound data transfer; inbound data transfer is commonly free.

Tags support cost allocation and reporting but are not inherited by default; Azure Policy can enforce tag inheritance.

Azure Synapse Analytics combines dedicated SQL pools, serverless SQL, Spark, and pipelines for data warehousing and big-data processing.

Azure Databricks is a managed Apache Spark platform with collaborative notebooks and Delta Lake support.

Azure Data Factory builds ETL and ELT pipelines using linked services, datasets, activities, and integration runtimes.

Azure Stream Analytics processes real-time streams from sources such as Event Hubs or IoT Hub using SQL-like queries.

Event Hubs ingests high-volume event streams; Service Bus provides queues and topics for enterprise messaging.

Event Grid provides event-based publish-subscribe routing; Logic Apps provides low-code workflows with SaaS and enterprise connectors.

Azure AI services provide prebuilt models for vision, speech, language, and search; Azure Machine Learning manages model training and MLOps.

Azure AI Search supports full-text and vector search; Azure OpenAI provides access to generative AI models through Azure endpoints.

Azure Monitor collects metrics as numeric time-series data and logs for querying and alerting.

Application Insights provides application performance monitoring, distributed tracing, and availability tests.

A Log Analytics workspace stores Azure Monitor logs queried with KQL and defines retention and access boundaries.

Diagnostic settings route platform logs and metrics to destinations such as Log Analytics, storage accounts, or event hubs.

Recovery Time Objective is the maximum acceptable outage duration; Recovery Point Objective is the maximum acceptable data loss.

Azure Backup provides recovery points; Azure Site Recovery replicates and orchestrates failover and failback for disaster recovery.

Azure Service Health reports service incidents and planned maintenance; Resource Health reports the health of specific resources.

For serial dependencies, a composite SLA is the product of the individual SLAs; adding redundancy generally improves availability.