Azure AZ-600 cheat sheet

Azure Stack Hub is delivered as an integrated system from a hardware OEM partner; the customer never installs the OS directly, the OEM factory images and the operator runs the deployment worksheet and cloud builder.

Deployment prerequisites: scale unit node count per OEM, validated network design (public VIP pool, infra subnet, BMC, PXE, storage), Azure AD or AD FS identity choice, and a registered subscription for billing.

Region name and external domain name are chosen at deployment and cannot be changed afterward; renaming requires redeployment, so fix DNS and certificate names first.

A region has one or more scale units; each scale unit adds compute/storage capacity, and additional scale units are added via the privileged endpoint with the OEM's expansion procedure.

Capacity planning inputs: per-node cores and memory, resiliency (N+1 or N+2), storage reserve, VM SKU sizes, and the plan/offer quota model - overcommit is not allowed beyond the configured quotas.

Connected deployment registers with Azure via the administrator subscription for marketplace syndication and billing; disconnected deployment uses capacity model billing and an offline marketplace.

Network requirements include the public VIP pool for tenant and infrastructure services, the infrastructure subnet, BMC network, and outbound access to Azure endpoints for connected mode.

Certificates must match the external domain name and include the wildcard for portal, admin portal, ARM, and the services endpoints; validate with the pre-deployment certificate checker before deployment.

Update cadence: full package updates and hotfixes are applied by the operator from the administrator portal or privileged endpoint; the OEM handles firmware and driver updates.

Service delivery model: operator creates plans (base services: compute, storage, network) and adds services to plans, then offers combine one or more plans and are published for tenants.

Quotas are set per service in a plan; when a tenant subscription consumes quota, further resource creation in that service fails until the operator raises the quota or the tenant deletes resources.

Offers can be public or private; private offers require the operator to add tenant subscriptions explicitly, and delegated providers can create their own plans and offers from a delegated offer.

Marketplace: connected mode syndicates items from Azure; disconnected mode requires downloading the marketplace syndication tool and publishing items to the local marketplace.

Tenant RBAC uses built-in roles (Owner, Contributor, Reader) at subscription, resource group, and resource scope; Azure Stack Hub supports a subset of Azure RBAC roles.

Resource providers must be registered per tenant subscription (Microsoft.Compute, Microsoft.Storage, Microsoft.Network, Microsoft.Web, etc.) before resources of that type can be created.

Azure Stack Hub supports IaaS broadly and a subset of PaaS (App Service, SQL/MySQL resource providers, Event Hubs, Service Fabric, Kubernetes) depending on which resource providers the operator installs.

Managed identities, Key Vault, and Azure Policy are available in supported versions; verify service availability against the services list for the deployed build before promising a service to a tenant.

Privileged endpoint (PEP) is reached via Enter-PSSession -ComputerName -ConfigurationName PrivilegedEndpoint with a cloud admin account; it exposes commands such as Get-AzureStackStampInformation, Test-AzureStack, and Start-AzureStackUpdate.

ERCS VMs host the PEP; the number of ERCS VMs equals the scale unit node count plus one, and they are on the infrastructure subnet.

Health monitoring: the administrator portal alert blade and Test-AzureStack (with -Group and -IncludePassed switches) validate infrastructure; alerts have remediation guidance in the alert details.

Backup: infrastructure backup captures the stamp's control-plane configuration to an SMB share; it does not back up tenant VMs or data - tenants must protect their own workloads.

Backup frequency and retention are configured by the operator; a backup is required before updates, and restore is performed only through the OEM/Support process on replacement hardware.

Update process: download the update package, run Test-AzureStack, apply from the administrator portal, monitor progress; OEM firmware updates follow the vendor's documented order relative to Azure Stack Hub updates.

Log collection: Get-AzureStackLog gathers logs from the stamp for support cases; specify -FilterByRole to target roles such as BareMetal, Infrastructure, or Storage.

Capacity and usage: the administrator portal shows capacity blades per service and the region; usage data feeds billing in connected mode and is exported in disconnected mode.