OCI Multicloud Architect Professional cheat sheet

Oracle Interconnect for Microsoft Azure is a dedicated, private, low-latency link between an OCI region and an Azure region; it is ordered from the OCI Console and paired with an Azure ExpressRoute circuit in a supported region pair.

The interconnect is provisioned as a virtual circuit on the OCI side and an ExpressRoute circuit on the Azure side; both ends must be in the same supported metro pairing (for example, OCI Ashburn to Azure East US).

Latency and bandwidth options are fixed SKUs (for example 1 Gbps, 5 Gbps, 10 Gbps); the chosen SKU applies to the virtual circuit and cannot exceed the physical capacity of the region pair.

FastConnect and ExpressRoute remain separate products; the Oracle Interconnect bundles them so a single order creates both halves and the cross-cloud link, avoiding two independent procurement cycles.

Traffic over the interconnect is private and does not traverse the public internet; it still requires routing (dynamic gateway or static routes) and security lists or NSGs on both clouds.

A multicloud architecture is not the same as a hybrid architecture: multicloud spans two or more public clouds, while hybrid combines a private data center with at least one public cloud.

Data egress charges apply on both sides of the interconnect; the OCI side bills egress from OCI, and the Azure side bills ExpressRoute egress, so cost models must include both directions.

Supported region pairs are limited and change over time; an architect must confirm the current pairing list before committing to a topology, because not every OCI region has an Azure counterpart.

Each cloud keeps its own VCN or VNet; the interconnect joins them at the edge, so address spaces must be non-overlapping before any peering or route is configured.

OCI dynamic routing gateway (DRG) attaches to the VCN and terminates the virtual circuit; Azure uses a virtual network gateway of type ExpressRoute on the VNet side.

Route propagation is bidirectional when using BGP over the interconnect; static routing is possible but requires manual route tables on both clouds and does not fail over automatically.

A hub-and-spoke design on OCI uses a DRG with attached VCNs and a DRG route table to steer traffic between spokes; the Azure equivalent uses a hub VNet with peering to spoke VNets.

Transit between OCI and Azure for a third network requires the traffic to hairpin through the DRG and the Azure virtual network gateway; check that both gateways permit transit routing.

DNS resolution across clouds needs explicit design: OCI private DNS zones and Azure Private DNS zones are separate, so conditional forwarders or a shared resolver are required.

Security lists in OCI are subnet-level stateless filters; Azure NSGs are stateful and can attach to subnets or NICs, so rule design differs and must be validated per cloud.

MTU differences and asymmetric routing are common failure modes; keep forward and return paths symmetric and verify path MTU across the interconnect before production cutover.

OCI IAM and Microsoft Entra ID are separate identity providers; federation uses SAML 2.0 or OIDC, with OCI as the relying party and Entra ID as the identity provider.

OCI Identity Domains support federation at the domain level; mapping IdP groups to OCI groups via assertion attributes is what grants actual OCI policy permissions.

OCI policies are written as allow group X to verb resource in compartment Y; there is no cross-cloud policy language, so Azure RBAC and OCI policies are administered independently.

Workload identity across clouds is achieved with instance principals (OCI) and managed identities (Azure), each trusting only its own cloud metadata service; cross-cloud trust needs explicit token exchange.

Secrets should not be copied manually between clouds; use OCI Vault and Azure Key Vault with a defined rotation and replication process, or a central secrets manager reachable from both.

Encryption keys are regional and cloud-scoped; OCI Vault keys cannot directly encrypt Azure disks, so customer-managed key strategies must be duplicated per cloud.

Network security is defense in depth: the interconnect is private but not implicitly trusted, so NSGs, security lists, and host firewalls still apply on both sides.

Audit trails are separate: OCI Audit and Azure Activity Log must both be enabled and exported to a common SIEM for a unified view of cross-cloud activity.

Autonomous Database supports cross-region and cross-cloud replication via Data Guard or GoldenGate; a standby in another cloud requires network connectivity over the interconnect and matching wallet configuration.

Autonomous Database serverless scales compute and storage independently; the ECPU or OCPU count and storage are configured separately, and auto-scaling can be enabled per database.

Oracle Base Database Service runs on OCI VM clusters and supports RAC and Data Guard; it is the choice when full OS access or specific database versions are required.

WebLogic Server on OCI is available as a Marketplace image, as Kubernetes (Verrazzano or WebLogic Kubernetes Operator), or as a managed service; the operator pattern is the portable multicloud option.

A multicloud active-passive database topology uses Data Guard fast-start failover with an observer placed in a third location so neither cloud host failure can split brain the configuration.

GoldenGate supports bidirectional replication between OCI and Azure-hosted Oracle databases, enabling active-active reads and controlled write partitioning by region.

Connection routing should use a global name service or DNS-based failover in front of the database tier; the application must not hard-code a single cloud endpoint.

Cross-cloud database latency is bounded by interconnect round-trip time; synchronous Data Guard transport should be limited to configurations where that latency meets the recovery point objective.

Oracle Interconnect for Microsoft Azure is a dedicated, private, low-latency link between an OCI region and an Azure region; it is ordered from the OCI Console and paired with an Azure ExpressRoute circuit in a supported region pair.

The interconnect is provisioned as a virtual circuit on the OCI side and an ExpressRoute circuit on the Azure side; both ends must be in the same supported metro pairing (for example, OCI Ashburn to Azure East US).

Latency and bandwidth options are fixed SKUs (for example 1 Gbps, 5 Gbps, 10 Gbps); the chosen SKU applies to the virtual circuit and cannot exceed the physical capacity of the region pair.

FastConnect and ExpressRoute remain separate products; the Oracle Interconnect bundles them so a single order creates both halves and the cross-cloud link, avoiding two independent procurement cycles.

Traffic over the interconnect is private and does not traverse the public internet; it still requires routing (dynamic gateway or static routes) and security lists or NSGs on both clouds.

A multicloud architecture is not the same as a hybrid architecture: multicloud spans two or more public clouds, while hybrid combines a private data center with at least one public cloud.

Data egress charges apply on both sides of the interconnect; the OCI side bills egress from OCI, and the Azure side bills ExpressRoute egress, so cost models must include both directions.

Supported region pairs are limited and change over time; an architect must confirm the current pairing list before committing to a topology, because not every OCI region has an Azure counterpart.

Each cloud keeps its own VCN or VNet; the interconnect joins them at the edge, so address spaces must be non-overlapping before any peering or route is configured.

OCI dynamic routing gateway (DRG) attaches to the VCN and terminates the virtual circuit; Azure uses a virtual network gateway of type ExpressRoute on the VNet side.

Route propagation is bidirectional when using BGP over the interconnect; static routing is possible but requires manual route tables on both clouds and does not fail over automatically.

A hub-and-spoke design on OCI uses a DRG with attached VCNs and a DRG route table to steer traffic between spokes; the Azure equivalent uses a hub VNet with peering to spoke VNets.

Transit between OCI and Azure for a third network requires the traffic to hairpin through the DRG and the Azure virtual network gateway; check that both gateways permit transit routing.

DNS resolution across clouds needs explicit design: OCI private DNS zones and Azure Private DNS zones are separate, so conditional forwarders or a shared resolver are required.

Security lists in OCI are subnet-level stateless filters; Azure NSGs are stateful and can attach to subnets or NICs, so rule design differs and must be validated per cloud.

MTU differences and asymmetric routing are common failure modes; keep forward and return paths symmetric and verify path MTU across the interconnect before production cutover.

OCI IAM and Microsoft Entra ID are separate identity providers; federation uses SAML 2.0 or OIDC, with OCI as the relying party and Entra ID as the identity provider.

OCI Identity Domains support federation at the domain level; mapping IdP groups to OCI groups via assertion attributes is what grants actual OCI policy permissions.

OCI policies are written as allow group X to verb resource in compartment Y; there is no cross-cloud policy language, so Azure RBAC and OCI policies are administered independently.

Workload identity across clouds is achieved with instance principals (OCI) and managed identities (Azure), each trusting only its own cloud metadata service; cross-cloud trust needs explicit token exchange.

Secrets should not be copied manually between clouds; use OCI Vault and Azure Key Vault with a defined rotation and replication process, or a central secrets manager reachable from both.

Encryption keys are regional and cloud-scoped; OCI Vault keys cannot directly encrypt Azure disks, so customer-managed key strategies must be duplicated per cloud.

Network security is defense in depth: the interconnect is private but not implicitly trusted, so NSGs, security lists, and host firewalls still apply on both sides.

Audit trails are separate: OCI Audit and Azure Activity Log must both be enabled and exported to a common SIEM for a unified view of cross-cloud activity.

Autonomous Database supports cross-region and cross-cloud replication via Data Guard or GoldenGate; a standby in another cloud requires network connectivity over the interconnect and matching wallet configuration.

Autonomous Database serverless scales compute and storage independently; the ECPU or OCPU count and storage are configured separately, and auto-scaling can be enabled per database.

Oracle Base Database Service runs on OCI VM clusters and supports RAC and Data Guard; it is the choice when full OS access or specific database versions are required.

WebLogic Server on OCI is available as a Marketplace image, as Kubernetes (Verrazzano or WebLogic Kubernetes Operator), or as a managed service; the operator pattern is the portable multicloud option.

A multicloud active-passive database topology uses Data Guard fast-start failover with an observer placed in a third location so neither cloud host failure can split brain the configuration.

GoldenGate supports bidirectional replication between OCI and Azure-hosted Oracle databases, enabling active-active reads and controlled write partitioning by region.

Connection routing should use a global name service or DNS-based failover in front of the database tier; the application must not hard-code a single cloud endpoint.

Cross-cloud database latency is bounded by interconnect round-trip time; synchronous Data Guard transport should be limited to configurations where that latency meets the recovery point objective.