Describe Azure Architecture and Services
Physical and logical hierarchy
Regions are geographic areas containing one or more datacenters; availability zones are physically separate datacenters within a region, used for high availability. Region pairs sit in the same geography, are updated sequentially, and support geo-replication for disaster recovery. The management hierarchy runs resources → resource groups → subscriptions → management groups. Trap: a resource group is a logical container and can hold resources from different regions; it is not a boundary for security or billing by itself.
Compute
Virtual machines keep you responsible for the guest OS; availability sets protect against host/rack failure inside one datacenter, while zones protect against datacenter failure. App Service, Azure Functions and AKS/ACI are PaaS/serverless options that remove OS patching. Virtual Desktop delivers hosted desktops.
Networking
VNets and subnets isolate workloads; peering joins VNets privately; VPN Gateway tunnels over the public internet; ExpressRoute is a private, dedicated circuit. NSGs filter traffic; Azure Firewall is a managed, stateful service.
Storage
Blob (objects), Files (SMB shares), Disks (VM disks), Queues and Tables. Redundancy tiers: LRS (three copies in one datacenter), ZRS (across zones), GRS/GZRS (plus a paired region); the RA- variants allow read access to the secondary region. Access tiers: hot, cool, cold, archive.
Identity and security
Microsoft Entra ID handles authentication, SSO, MFA and Conditional Access - note the rebrand from Azure AD. Azure RBAC controls resource permissions and is a different system. Defense in depth, Zero Trust, Key Vault and DDoS Protection round out the security model.