MSAP cheat sheet

Microsoft Entra ID (formerly Azure AD) is the identity plane for Azure RBAC, Microsoft 365, and SaaS apps; Azure subscriptions are only a billing and management boundary that trusts Entra ID for authentication.

Role assignment scope order is management group > subscription > resource group > resource, and permissions are additive: effective permission = union of all assignments, with deny assignments overriding allows.

Built-in role facts: Owner = full access including access management; Contributor = create/manage all resources but cannot grant access; Reader = view only; User Access Administrator = manage role assignments only.

Role assignment vs. role definition: a role definition lists allowed Actions/NotActions/DataActions; a role assignment binds a definition to a principal at a scope. NotActions are subtracted from Actions, not an explicit deny.

Custom role JSON requires Name, Description, Actions (or NotActions), AssignableScopes, and a GUID-style Id; AssignableScopes cannot be '/', and custom roles are tenant-wide visible but only assignable within listed scopes.

Azure Policy evaluates resource properties and can Deny, Audit, Append, Modify, DeployIfNotExists, or AuditIfNotExists; policy effects apply to new/updated resources, while existing resources need a remediation task.

Initiative (policy set) definitions group policies for a single assignment; Policy is enforced at management-group and subscription scopes and cannot be bypassed by RBAC, unlike RBAC which grants access.

Management groups nest up to six levels below the tenant root; a subscription or management group has exactly one parent, and moving a subscription changes inherited RBAC and policy.

Microsoft Entra ID P1/P2 features: P1 adds Conditional Access and group-based licensing; P2 adds Privileged Identity Management (just-in-time roles) and Identity Protection risk policies.

Storage account kind choices: Standard general-purpose v2 for most workloads (all services, tiering); Premium BlockBlob for high-transaction blob; Premium Files for SMB file shares; Premium PageBlob for unmanaged disks.

Replication rules: LRS = 3 copies in one datacenter; ZRS = 3 copies across availability zones in one region; GRS = LRS plus async copy to a paired region; GZRS = ZRS plus paired-region copy; RA-GRS/RA-GZRS add read access to the secondary endpoint.

Blob access tiers: Hot (frequent access), Cool (30-day minimum), Cold (90-day minimum), Archive (180-day minimum, offline, rehydrate needed before read); early deletion of Cool/Cold/Archive incurs prorated charges.

Blob access control: private (default), Blob (anonymous read for blobs only), Container (anonymous read/list for whole container); disable public access at account level with AllowBlobPublicAccess = false.

Shared Access Signatures: account SAS, service SAS, and user delegation SAS (secured by Entra credentials, recommended for blobs); stored access policies allow revocation of service SAS without rotating account keys.

Azure Files auth options: storage account key (SMB only), AD DS / Microsoft Entra Domain Services Kerberos for identity-based SMB, and Microsoft Entra Kerberos for hybrid identities; NFS shares use network-level auth only.

AzCopy is optimized for bulk/async copy and supports SAS tokens and OAuth; Azure Storage Explorer is a GUI; az storage blob upload/az storage copy are CLI options for scripted transfers.

Lifecycle management rules apply to block blobs and can tier down (Hot to Cool/Cold/Archive) or delete based on days-since-modification, days-since-creation, or last access time tracking (which must be enabled separately).

Soft delete for blobs, containers, file shares, and snapshots retains deleted data for a configurable retention period (1-365 days); blob versioning keeps prior versions and requires soft delete to be enabled first.

VM size families: B = burstable (CPU credits); D = general purpose; E = memory optimized; F = compute optimized; N = GPU; L = storage optimized; M = large memory.

Availability options: Availability Set = fault domains (up to 3) and update domains within one datacenter, SLA 99.95%; Availability Zone = physically separate datacenters, SLA 99.99% with two or more zones.

VMSS (Virtual Machine Scale Sets) support manual, autoscale (metric/ schedule based), and rolling upgrade policies; orchestration mode can be Uniform or Flexible (Flexible supports mixed VM types and is preferred for new designs).

Azure Bastion provides browser-based RDP/SSH over TLS to VMs without public IPs; it deploys into a dedicated subnet named AzureBastionSubnet with minimum /26 (or /27 on newer SKUs).

Azure App Service plans define compute SKUs (Free/Shared/Basic/Standard/Premium/Isolated); scaling out adds instances, scaling up changes the plan tier; deployment slots (Standard+) allow swap with warm-up and rollback.

Azure Functions hosting plans: Consumption (scale to zero, per-execution billing), Premium (pre-warmed, VNet integration), and Dedicated/App Service plan (always-on).

AKS cluster creation requires a node pool; the control plane is managed and free for the Free tier, while the Uptime SLA tier charges for the API server SLA; node pools can use VMSS or standalone VMs.

ARM/Bicep deployment modes: Incremental (default) adds or updates resources without deleting unlisted ones; Complete deletes resources in the resource group that are not in the template.

VM extensions (custom script, DSC, diagnostics, AKS monitoring) run after provisioning; the Custom Script Extension retrieves scripts from storage or a public URI and can be ordered with dependsOn.

VNet address space must be RFC1918 or public ranges you own; subnets cannot overlap with the VNet or each other, and Azure reserves 5 addresses per subnet (first 4 and last).

NSG rules evaluate by priority (100-4096, lower number wins) and allow/deny; default rules allow VNet-to-VNet and Azure Load Balancer inbound, and deny all other inbound from the internet.

NSGs can attach to subnets or NICs; both are evaluated (subnet first inbound, NIC last inbound), and effective rules can be checked with Network Watcher > Effective security rules.

Azure Firewall is a managed stateful firewall with FQDN filtering, threat intelligence, and DNAT/SNAT; it requires a dedicated AzureFirewallSubnet, and policy can be shared across firewalls.

VNet peering is non-transitive; use a hub-and-spoke topology with Azure Firewall or NVA in the hub plus user-defined routes (UDRs) and IP forwarding to route spoke-to-spoke traffic.

Private Endpoint assigns a private IP from a subnet to a PaaS service via Private Link; Private DNS zones (privatelink.*) resolve the service FQDN to that private IP for clients in the VNet.

Azure VPN Gateway SKUs (VpnGw1-5) determine tunnel count and throughput; active-active requires two public IPs and BGP or static routes; ExpressRoute provides private connectivity that does not traverse the public internet.

Azure Load Balancer is L4 (TCP/UDP) with public or internal frontends and health probes; Application Gateway is L7 with URL path routing, TLS termination, WAF, and cookie affinity.

Azure DNS supports public zones and private zones; private zones auto-register VM records when linked with auto-registration enabled, and Traffic Manager is a DNS-based global load balancer with priority, weighted, performance, and geographic methods.

Azure Monitor data types: Metrics (numeric, time-series, near real-time, 93-day default retention) and Logs (structured, queried with KQL, retained per workspace retention setting).

Log Analytics workspace is the central log store; diagnostic settings send resource logs and metrics to a workspace, a storage account, or an event hub, and each resource supports up to five diagnostic settings.

KQL basics: table | where condition | summarize aggregation by column | order by column desc | take N; join, project, extend, and render operators shape results.

Alert rules have a signal (metric or log query), condition, action group, and severity 0-4; action groups define email, SMS, webhook, Logic App, Automation Runbook, or ITSM actions.

Application Insights monitors web apps with availability tests, dependency tracking, request rates, failures, and live metrics; connection is via a connection string or instrumentation key (legacy).

Azure Backup uses Recovery Services vaults for VMs, SQL, and file shares; backup policies define schedule and retention; soft delete protects backups from accidental or malicious deletion.

Azure Site Recovery replicates VMs to a secondary region or on-premises for disaster recovery; recovery plans group VMs for ordered failover and support test failover into an isolated network.

Azure Advisor provides recommendations across cost, security, reliability, performance, and operational excellence; Azure Service Health reports outages, planned maintenance, and health advisories affecting your subscriptions.

Network Watcher tools include IP flow verify, next hop, connection troubleshoot, packet capture, and topology; connection monitor continuously tests reachability between endpoints.