AZ-900 Microsoft Azure fundamentals        5

Cloud Concepts        6

Language of Cloud Computing        6

Pricing        7

Cloud Service Model        7

Azure architecture        9

Regions        9

Availability zone        9

Callouts        9

Resource group        10

Callouts        10

Azure resource manager (ARM)        10

Callouts        10

Compute        10

Virtual machine        10

Objectives        10

Scale set        11

App service        11

Azure container instances        11

Azure Kubernetes services: manage containers        12

Windows virtual desktop        13

Serverless azure functions        13

Demo of app service        13

Networking        14

Virtual network        14

VNet        14

IP Address        14

4 category        14

Adreess space        14

Subnet        14

Regions & Subscription        15

Benefits        15

VNet Peering        15

Demo        15

Load balancer        16

VPN Gateway        16

Virtual network gateway(VNG)        16

VPN Gateway        16

When to use?        17

How it works?        17

Setup        17

Application gateway        18

Express route        19

Azure content delivery network        19

Summery        19

Storage        20

Blob        20

When:        20

Blob type:        20

Price tier:        20

Disk        20

Disk type:        20

File        21

Issues        21

Resolve        21

Scenarios        21

Archive        21

Database        22

Cosmos DB        22

Issue        22

Resolve        22

Features        22

Azure SQL        22

Usecase        22

Benefits        23

Azure SQL database vs. Azure SQL managed instance        23

MySQL        23

What        23

Benefits        24

Usecases        24

Postgre SQL        24

What        24

Features        24

Usecases        24

Database migration service        24

Authentication AND Authorization        25

Identity service        25

Azure Active Directory        25

Tenant        26

Subscription        26

Hybrid cloud architecture        26

Multi-factor authentication        26

SSO        26

Azure Solutions        27

Internet of Things        27

what        27

Example:        28

2 azure service for IOT        28

Big Data        29

Why BigData        29

How data collected        29

Azure BigData services        29

Outcomes        30

Machine Learning        30

Azure service        30

Serverless        30

Services        30

DevOps        30

Services        31

Security        32

Defense in depth        32

What        32

Why        32

Security leval        32

Securing network connectivity        32

Why        32

Azure services        32

Public and private endpoint        34

What for        34

Microsoft defender for cloud (formerly azure security center)        36

What        36

Highlights        37

How to use        37

Azure key vault        37

Azure information protection        37

Why        37

When        37

How to use        38

Azure sentinel        38

What        38

When        38

How        38

Features        38

Azure dedicated host        38

When        38

What        38

Benefits        38

Microsoft defender for identity (formerly Advance threat protection)        39

What        39

When        39

Privacy, Compliance And Trust        39

Governance        39

Tools & service        39

Azure monitor        41

Why        41

Monitoring tools        41

Log analytics        41

Application insight        41

Azure Alerts        42

Azure service health        42

What        42

Features        42

Scenarios        42

Compliance        42

What        42

When        43

Tool        43

Benefits        43

Why compliance        43

Privacy        44

Trust        44

Services        44

azure Arc        44

what        44

How        44

Benefits        45

Scenarios        45

Price        45

Subscriptions        46

Management groups        46

Cost management        46

Pricing factors        47

Factors        47

Billing zones        47

Azure pricing calculator        47

Total cost of ownership calculator        47

Best practices        47

Credits        48

AZ-900 Microsoft Azure fundamentals

Cloud Concepts

Azure architecture





Authentication and authorization



Privacy, compliance and trust



Ways to create Azure resources in Azure CloudShell(web-based shell)

  1. Azure CLI: text only(stable/strutured) way to manage resources
  1. az group list
  2. az storage account list
  3. az vm list
  4. az vm create
  1. Powershell Commands: supported by azure with modules and cmdlet // for scripting
  1. Get-AzResourceGroup
  2. Get-AzStorageAccount
  3. Get-AzVm
  4. Get-AzResource | ft
  5. Remove-AzVm

Best way to create Azure resources

  1. ARM Template: to automate and replicate tasks, processes
  1. Idemopotent: applying operations multiple time and the resule is always the same // running the same template again and again to get the same result(variablize the name of the resource to use the template multiple time)


Cloud Concepts

Language of Cloud Computing

High availability: 



You own the hardware

You don’t own the hardware

Physical hardware

Add more server with a click

You can’t just add server

If hardware fails, replace instantly

Use clusters to ensure HA

Fault tolerance:

  1. Resilience: Fault tolerance is part of the Resilience in CC  
  2. Zero downtime: faults created by azure are also mitigated by azure  

Disaster recovery:

  1. Catastrophic disasters: hurricane, flood, tornado, cyber attack
  2. Plan to recover: complete plan to recover critical business systems
  3. Specific points: designated time to recovery (how long does it take to recover) and recovery point(point of time data to recover)





  1. Capital expenditure(CapEx): is buying hardware outright, paid upfront as a one-time purchase.
  2. Operational expenditure(OpEx): ongoing cost needed to run your business
  3. Consumption-based pricing lets you pay only for what you use

Cloud Service Model

Infrastructure as a service

Platform as a service

Software as a service


Azure architecture


Each region has more than 1 data center(physical location)  

  1. How to select the region for your resources
  1. Where your user location is to minimize latency
  2. Some features are not in all regions
  3. Price is different from region to region

Availability zone


Resource group


Azure resource manager (ARM)



Virtual machine

  1. Deploy windows VM
  1. Basics
  1. Subscription
  2. RG
  3. Region
  4. AZ
  5. Image
  6. Size (cpu and memory)
  7. User name/password
  8. Public Inbound ports: allow selected ports
  1. Disk
  1. OS Disk Type
  2. Encryption: Azure or you handle encryption
  1. Networking
  1. Connect and login to the server
  2. Delete the server

Scale set

App service

Azure container instances

Azure Kubernetes services: manage containers

Container Architecture 

ACR has Image → create container to run app → running app

Kubernetes Architecture

Container/s → pod/s → node/s → cluster  

Windows virtual desktop

Serverless azure functions  

Demo of app service

  1. Create App Service instance → web app
  1. Subscription
  2. RG
  3. App Name: must be unique to access it via internet
  4. Publish: Code or Docker Container
  5. Runtime stack: .net/java/python
  6. OS: windows/linux
  7. Region
  8. App Service Plan: more like a server/VM
  1. What you’ll get
  1. URL to access your website


Virtual network

IP Address
4 category
Adreess space
 Regions & Subscription

  1. Scaling: adding more VNets or more addresses to one is simple
  2. High availability: peering VNets, using a load balancer or using a VPN gateway all increases availability
  3. Isolation: manage and organize resources with subnets and network security group
VNet Peering




  1. Create a VNet with 2 subnet
  2. Create network security group:
  1. So that inbound and outbound rules on the NSG will take effect on your subnets and it will act as a firewall
  1. Associate NSG to subnets  

You will need

  1. IPv4 address space. Ex: // meaning how many IP addresses you want within your VNet
  2. Add howmany subnets you want
  3. Create NSG(to set up stateful firewall for the subnets)
  4. Attach subnets to youre NSG

Load balancer

  1. When to use LB
  2. Which problem does it solve

LB: When you have more than one VM serving your app; how do you decide which VM gets a particular user?

How: load balancer receives your internet and network traffic and, based on an IP address and a port, it will send that data to one of the VMs in the backend pool.

VPN Gateway


Virtual network gateway(VNG)

VPN Gateway

Why to use?

When to use? 

How it works?


Questions answered

  1. When should you use

Application gateway

  1. How does it diffrent then LB
  2. Which application can use one

When: you want to route the traffic based on other parameters(HTTP request) than simply IP address and port number?

HTTP request = An HTTP request is the data format that is received from any kind of internet traffic.

URI path = the web address for the request

Host headers = is a piece of information that is sent with the request.


Example: if you have a request for a URL that is images, you could send that to a specific pool of machines that are better at handling images. The same can be done for videos.


Express route

  1. If you need Private link


Azure content delivery network

It's a distributed network of servers that can deliver web content close to users. CDNs store cached content on what is called edge servers in locations that are close to end users to minimize latency.



Storage account = unique azure namesapce (every object in azure has it’s own web address)


Blob type: 
  1. Blocks: store text and binary data up to 4.7 TB. made up of individually managed blocks of data
  2. Append: optimal for append operation. Works well for logging where data is constantly appended
  3. Page: store random files up to 8 TB. ex: virtual hard drive and serve as a disk on a VM
Price tier:
  1.  Hot: frequently accessed files, lower access times, higher access cost
  2. Cool: lower storage cost and higher access time. Data remains here at least 30 days
  3. Archive: lowest cost and higher access time


Disk storage: disk that you can store data on

Managed disk is attached to VM

Disk type:
  1. HDD:
  1. old school spinning hard drive
  2. Low cost and suitable for backups
  3. Data less frequently accessed
  1. Standard SSD
  1. The standard for production
  2. VM with SSD provides lower latency than an HDD, improved reliability, and better scalability.
  1. Premium SSD
  1. Super fast and high-performance
  2. Very low latency
  3. Use for critical workload
  1. Ultra disk
  1. For most demanding, data-intensive workloads
  2. Disk up to 64TB


  1. Constrain: You only have a limited amount of storage
  2. Backups: Backups need to be configured and maintained.
  3. Security: Data security can be hard to maintain and requires specialists to enforce.
  4. File sharing: require more infrastructure to both supply and manage

Hybrid: can have cloud file storage when on-premises space running out of space

Lift and shift: to move all your infrastructure to Azure.


Lowest price 

Features: durable, encrypted and stable. Suitable for data less frequently accessed

Blob: archive storage is blob storage. So the same tool will work for both when retrieving the data


Cosmos DB

is a Globally scaled and fully managed database service. Fast read-writes


having data near your users is a key in providing the best experience for your users.

Old databases were difficult to set up across multiple locations and keep in sync.


With Cosmos DB, the entire headache of the global distribution of your data is taken care of by Azure.

For example, if you have the data in the region of US East, West Europe, and South Africa and want to expand to Australia, all you have to do is click on that region in the Azure portal to enable it.


Global from the start

  1. Synchronization 
  1. Easy with cosmos: solve the issue of traditional database setup  
  2. One-click to add region: easy to expand region and have the data in sync  
  3. Continued Synchronization: stays on top of all read and writes to your data and make sure your data is moved between regions to stay in sync.
  1. Latency: is the time it takes for data to travel 
  1. single-digit millisecond latency
  1. Scalability: scale Cosmos DB to infinity and beyond.
  1. Automated: when demand goes up, set Cosmos to scale with demand for each region and instance automatically.
  2. Infinite resources:  any number of users to your application can be supported
  3. Low price: pay for what you use
  1. Connectivity
  1. Developer: SDK and API to connect
  2. Languages: C#, java
  3. Platform: data platform to integrate with, SQL, MongoDB
  1. Expensive   

Azure SQL

Azure SQL is a fully-fledged database solution, where Azure manages all the parts (Azure will take care of your hardware and infrastructural level needs. Which include servers, storage, network, and everything else infrastructure-related) with managing the data in the database.

  1. migrate your on-premises SQL server instances directly to Azure, and get all the benefits of managed instances
  1. No changes required on you on-premises database → migration is frictionless
  2. Cost saving
  3. The lower total cost of ownership- TCO
  1. Built-in machine learning
  1. Optimization: database performance and optimization suggestions are provided based on your usage, patents, and other metrics.
  2.  Warnings: when bad things happening to your database → give warnings
  1. Scalability 
  2. Space: manage huge databases up to 100 TB
  3. Security

Azure SQL database vs. Azure SQL managed instance

Azure SQL: most like traditional SQL server

Azure SQL managed instance: aimed at migrating from on-prem



Azure SQL is Microsoft product

MySQL is built and maintained by the community


Postgre SQL

  1. Open-souce
  2. Free and stable
  1. Extensions: JSONB, Visual code, indexing
  2. Horizontal scale: scale easily with no application rewrite
  3. Performance recommendation
  4. Fully managed: automatic backup, patching, monitoring  

Database migration service

Tool to migrate your database from on-prem to azure

Authentication AND Authorization

Right users and processes are let in

Identity service

  1. How does azure authenticate you authorize you
  2. What is access management
  3. Different bw authentication and authorization

Authentication: conforming you’re you. Can be done username/password, face on smartphone

Authorization: let you access of service



Making sure you are you

Comes after authentication  

Confirming identity

Do you get access?

First test for access

Granular control


Azure Active Directory

Active directory != Azure active directory

They are different products

Active directory

Azure active directory

Azure’s product which companies host themselves

You can’t have an Azure account without AAD

Every Azure account needs a user and this user needs to be in the initial AAD

First service you get when you create an Azure account


Billing entry: all resources within a single subscription bullied together

Cost separation: can have multiple subscriptions within a single tenant to separate cost. ex: dev,prod

Hybrid cloud architecture

AAD lets you manage users from on-prem to Azure

Multi-factor authentication


Lets you use one username/password to signin to different applications

Azure Solutions

Internet of Things


The Internet of Things (IoT) describes the network of physical objects—“things”—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet without human interaction. These devices range from ordinary household objects to sophisticated industrial tools.


​​Imagine a water network for a big city. The water comes from far, far away, and having it running smoothly is critical to ensure people in the city can open the tap and get fresh water. This makes the water network critical.

There will be thousands of valves, pumps, gates, locks, and much, much more.

And if any of these things fail, it could be disastrous for the water supply to the city.

If every single thing was connected to the internet, then if any of them failed, you see it instantly. It would create a much more stable and, over time, much more cost-effective network.

You wouldn't have to spend time and money checking the network constantly in the


2 azure service for IOT

  1. IoT hub:
  1. hub to collect data feeds from all your things
  2. Backend system that receives the data and manages it // can receive data from billions of devices
  1. These devices are autonomous and do the task without any human interaction, you could have lot of them // billions even
  1. Managed and secure
  2. Ease of deployment(devices)
  3. PaaS
  4. Scaling and authenitcation
  5. When to use: when you want more control of the IoT data collection and processing
  1. IoT central
  1. SaaS
  2. Speed up th implementation of your IoT solution
  3. No coding needed to connect all your things // tool with ready made component
  4. Pre-made connectors

Azure speare: all in one solution for IoT devices

Big Data

Why BigData
How data collected
Azure BigData services
  1. Data lake analytics
  1. Large amount of data: that you can perform analytical procedures on
  2. Parallel processing: two or more processes/computers process the same data at the same time paralelly
  3. Ready to go: don’t need to worry about VM, server or cluster of computer
  1. HDInsight
  1. Similar to data lack analytics
  2. Open source and community supported
  3. Includes apache hadoop, apache spark, apache kafka
  1. DataBricks
  1. Based on apache spark, a distributed cluster-computing framework
  2. Run and process a dataset on many computers simultaneously
  3. Provides computing power: You don’t need to buy computers and maintain it
  4. Integrates with azure storages
  1. Synapse analytics
  1. Azure’s data wherehouse offering
  2. Used to be azure SQL data warehouse
  3. Used for reporting and data analysis
  4. Use synapse language to manipulate data

  1. Speed: processing large amount of data
  2. Cost reduction: when it comes to store large amount of data
  3. Better decision making: immediate data processing and analysis in memory
  4. New products and services: understand customer needs

Machine Learning

Azure service
  1. Azure bot service
  1. PaaS offering let you build bots for Q/A, virtual assistant and more
  2. Language
  3. Integration: twilio, FB, Teams
  4. Branding
  1. Azure cognitive service
  1. Vision
  2. Decision
  3. Speech
  1. Machine learning studio
  1. Tool
  2. Pre-made modules for your project


  1. Functions
  2. Logic apps
  3. Event grid


  1. Azure DevOps
  2. Azure DevTest Labs
  3. Github & GitHub Action


Defense in depth

Security leval
  1. Physical 
  1. This is data center. Only authorized person has access
  1. Identity and access
  1. Relates to Azure Active Directory which controls all access to Azure and identity of all users, apps and connections
  1.  Perimeter
  1. Protection against DDoS Attack, volumetric attack, protocol attacks and more
  1. Network 
  1. is the filter of traffic to and from Azure using virtual networks and applying security standards.
  1. Compute 
  1. protects against intruders trying to get into your virtual machines or databases.
  1. Application gateways and firewalls
  1. Provides Azure app security
  1. Data 
  1. is encrypted and protected against anyone unauthorized reading it or making sense of it

Securing network connectivity

Azure services
  1. Firewall 
  1. Rules: decides whether network traffic is allowed to access the service or device attached to the network.
  2. Variations: firewall come in many versions and sizes. Both in software and hardware incarnations. And for small, big, and huge networks.
  3. Critical part:  network that take security seriously will have firewall
  1. DDoS (distributed denial of service attack - histroty)
  1. Attacks
  1. U.S Banks were flooded with 60 GB of traffic every second in 2012
  2. CloudFlare was attacked in 2014 with 400GB of traffic per second
  3. GitHub in 2018 with 1.35TB traffic per second // new record for DDoS attack
  1. What is DDoS
  1. server can only serve, or handle, a certain number of requests every second. Let's say, 1,000 requests. If too many users come into the site at the same time (let's say 10,000), at some point, not everyone would get through.
  2. The server would try to serve all the requests for its content until it would fall over. At some point, the server hasn't got enough resources and it simply stops.
  3. If this is done on purpose to take the server out,it is called denial-of-service attack.
  1. How DDos
  1. Many internet connected devices:  lots of computers targeting a single server or website with the aim of making it stop.
  1. Azure DDoS protection service: detects the DDoS attack and deflects it
  2. No downtime: no interruption of service at all
  1. Network security group
  1. Resource firewall: personal firewalls for your resources.
  1.  Rules: rules for who and what can access any resource attached to the NSG.
  2. Example: if you have a virtual machine that is on a virtual network, the network can be behind a firewall protecting everything on the network, and then the VM can have its own network security group to define specific rules for just that machine. // two security level, firewall and NSG, provides extra layer of security to VM
  1. Application security group 
  1. Protects app infrastructure: focus the security on the app rather than IP endpoint
  2. Natural extension: group VMs and VNet into logical application groups and apply an application security group

Public and private endpoint

What for

  1. Service endpoint


  1. Secure access to VNet only:
  1. no private, on-premises access
  2. Must allow on-premises access over public IP
  1. PaaS public endpoint still exists
  1. Connection is still not private
  1. Service endpoint provide access to an entrie service
  1. Provides private access to all of storage accounts, not just a single storage account  


  1. Private endpoint

Microsoft defender for cloud (formerly azure security center)

The Azure Security Center is a portal within the Azure portal

  1. Threat alert: It alerts you to threats that Azure detects
  2. Ready for hybrid architecture
  3. Each VMs has an agent installed that send data to azure
  4. Azure analyze the data and send alerts if necessary
  1. Policy and complience metrics: are monitored by Azure, and the result is shown in the Security portal
  2. Secure score to entice great security hygiene: to make your Azure implementation as secure as possible.
  3. Integrate with other cloud providers: AWS, GCP using SEIM tool // provide single point for any muti-cloud security information
  4. Alerts for resources that arn’t secure
How to use
  1. Define polices: A security policy is a set of rules that Azure can use to evaluate if your configuration of a service is valid. Security Center comes with some predefined policies, but you will need to set up your own
  2. Protect resources
  3. Response 

Azure key vault

  1. Secure hardware: not ven microsoft can access keys
  2. Application isolation: app can’t pass on secrets, nor access another app’s secret
  3. Global scaling: scale globally like any other services

Azure information protection


  1. Classify data: on how sensitive it is wither using policies or manually
  2. Track activities: track what is happening with shared data and revoke access if needed
  3. Share data: safely share data s you can control who edits, views, print and forwards it
  4. Integration: microsoft office

How to use

if Melanie has to send an email with a sensitive attachment to Tony, then she can use Azure Information Protection to secure that attachment.

Melanie uses a label that is defined in Azure to tag the document and create a link to Information Protection. Every time a user opens it, the user is validated and the document is protected.

Azure sentinel


Sentinel is a security information and event management tool, often just called S-I-E-M or SIEM



  1. Data is collected from range of sources. Ex: DNS, VM, Network
  2. Aggregation and normalize data // more usable
  3. Analysis and threat detection
  4. Things happen (mostly magic)
  5. Take action
  1. Bahaviour analytics
  2. AWS integration
  3. Cloud scale
  4. Netflix uses it

Azure dedicated host

  1. When you don;t trust hardware your VMs runs on
  2. You want to run VM on a hardware you control
  1. Hardware control
  2. Maintenance: reduce impact on your system by choosing when to install updates to your dedicated host
  1. Compliance
  2. Global infrastructure
  3. OS of your choice

It’s Expensive

Microsoft defender for identity (formerly Advance threat protection)

  1. Monitor users: helps you monitor users in your on-premises environment and their behavior. It analyzes user activity and information across your network, including permissions and membership for each user.
  2. Baseline behaviour: record what a user’s normal behaviour and routine is. Any activity outside of the routine will be logged as suspicious
  3. Suggest changes: to meet best security practices
  4. Cyber attack kill chain
  1. Reconnaissance
  2. Brute force
  3. Increase priviledges

Privacy, Compliance And Trust

Azure allows you to apply consistent management and policies across your Azure resources,

use Azure Monitor to gain greater visibility into the performance of your Azure environment, and some supplemental lessons on Azure compliance


Tools & service

To implement adequate governance of your azure resources

  1. Policies:  Azure Policy documentation states, governance validates that your organization can achieve its goals through effective and efficient use of IT. In other words, use Azure Policy to make sure users don't make a mess of it.
  1. What:  set of rules. Rules to make sure that standards and agreements within your corporation are followed and that resources are compliant with these policies
  1. Role based access control(RBAC): lets you define which users have access to specific Azure resources, what they can do with those resources, and what areas they have access to.
  1. Define user access
  2. Minimum access
  3. Target specific use cases

How RBAC works: 

  1. Security principal: is an object that represents what type of entity can get access to the Azure resource. This can be user or group of users, for example. A role definition is a collection of permissions.
  2. Role definition: lists the operations that can be performed, such as read, write, and delete.
  3. Scope: is the set of resources that the access applies to. This is useful when you want a specific role assignment to have only access to a specific resource group


  1. Locks: efficient tool to manage changes and removal of resources are
  1. Assigning:  assign a lock to a subscription, RG, resource
  2. Types:  delete(can’t delete locked object), read-only(where you can’t make any changes to object)                 
  1. Blueprint: are templates for creating Azure resources
  2. Cloud adoption framework
  1. Collections of document
  2. Guidance
  3. Governance
  1. Azure advice for security assistance

Azure monitor


Monitoring tools

  1. Log analytics
  1. Lets you analyze logs/telemetry data  
  2. what?
  1. It allows a storage location for large logs/data and let you query and anayze data to gain valuable insight.
  2. Ex: disk size of VM, VPN connection logs, long term analysis, combine metrics for complex queries  
  1. Prebuilt and custom query // Kusto query
  1. Application insight
  1. Tool for Performance insight for your web application
  2. Answers 
  1.  How are users using the app?
  2. Where are our performance bottlenecks?
  3. Why are we getting website error?
  1. For what
  1. Works only for web based application
  2. Available for App service, azure VM, non-azure resources
  1. How
  1. VM required agent install  
  1. Azure Alerts
  1. When something breaks, send alert to someone
  2. Example:
  1. VM Unresponsive
  2. VM using excessive CPU
  3. Application latency over 500 ms
  1. How?
  1. Alert rule
  1. Monitored resources // VM
  2. Monitored telemetry // CPU Utilization
  3. Condition to trigger alert // 90% CPU for 5 mins
  4. Assigned severity // 2 - warning
  1. Action group - action take when rule is triggered
  1. Notification target -
  1. SMS/Email to support people
  2. Send to automation workflows(logic apps, functions)

Azure service health



  1. GDPR - general data protection regulation
  1. Why: to protect individual and processing of their data
  2. Gives control of personal data, instead of the company owning it  
  3. Companies need to implement lots of tool for consumers to control their data
  1. ISO standard
  1. Compliance with quality and customer satisfaction
  2. Covers industry(food safety, environment management) and standards for range of professions
  1. NIST - national institute of standards and technology
  1. Focus purly on tech industry
  2. Developed primarily for US federal agencies
  3. Compliance with NIST means compliance with multiple federal US regulation

Azure compliance manager

  1. Recommandations:  get recommandation for ensuring compliance with NIST, ISO, GDPR
  2. Tasks: assign compliance task to team member nd track progress
  3. Compliance score
  4. Secure storage: upload documents to prove complience and store them securely  
  5. Reports: get report of compliance data to provide to manages and auditors

Azure government cloud

  1. Dedicated region
  2. Exclusivity
  3. Compliance
  4. Azure benefits

China region

  1. Located in china
  2. Data is kept in china
  3. Compliant
Why compliance


  1. Azure info protection: classify, label, nd protect data based on data sensitivity  
  2. Azure policy: define and enforce rules to ensure privacy nd external regulation
  3. Guids: use guids on azure to respond and comply with GDPR privacy request    
  4. Compliance manager: make sure you’re following privacy guidelines, GDPR, ISO


  1. Trust center:
  1. How Microsoft’s efforts on security, privacy, GDPR, data location, compliance and more
  2. a hub for more information about trust in each product and service
  1. Service trust portal:
  1. review all the independent reports and audits performed on Microsoft products and services

azure Arc





  1. Multiple Subscriptions: useful for organization for who pays for what. Dev, prod
  2. Billing admin: one or more more user can be a billing admin which manages anything to do with billing and invoicing on azure. Ensures separation of responsibility
  3. Billing cycle: billing cycle is either 30 or 60 days  

Management groups

  1. Group subscription

What: Tool for managing azure subscriptions

When your organization has lots of subscriptions

  1. Organize
  1. Manage access, policies and complience in bulk
  2. Ex: have a management group per country or department
  1. Billing logic
  1. Maintain billing associated with right budget
  2. Nest management groups to indicated hierarchy and relationships  

Cost management

To Visuslize your spending

Get reports and recommandations

Optimizations: to save money

Spot VM

Pricing factors

  1. Resource size
  2. Resource type: and complexity
  3. Location: prices comes different with different location
  4. Bandwidth: howmuch data is coming to in and out to azure    
Billing zones

Azure has three billing zones in the world as well. Each of these zones include many Azure regions.

Any data transfer between Azure services  located in the same zone is free.

Any data transfer between two different billing zones is charged.

Ingress → data in, egress → data out.

Ingress data is always free, but egress data has a cost with it when it is transmitted between two different billing zones.

Azure pricing calculator
Total cost of ownership calculator

Best practices

  1. Spending limits
  1. Default limit:
  2. No increase spending limit
  3. No spending limit on pay-as-you-go accounts
  1. Quotas 
  1. Property limit
  1. quota is a limit on a certain property off in Azure services. for example a minimum of 100 name spaces for Event Hubs
  1. Ensure service level
  1. The quotas are necessary to ensure as you can maintain their high service level
  1. Quota change
  1. if you need to increase the quota for a particular service you can ask Microsoft to increase them
  1. Tags
  1. Labels that you can attach with your resources, RG
  2. Identify roles
  3. Related resources
  4. Filter
  5. Unambiguous
  1. Pay-As-You-Go account
  2. Reserved instance
  1. Can save a lot of cash
  2. Use for small azure services and products. Especially VMs
  1. Reserved capacity
  1. 1-3 year commitment
  2. Ex: database: SQL(80%), Cosmos DB(65%), Synapses Anaytics(65%), redis cache(55%)
  1. Azure hybrid benefits
  1. Saves on VMs and SQL server if you already have licence for them
  2. Azure lets you use your existing licences instead of purchasing new one with every new VM,SQL server
  1. Advisor
  1. Give you best practices and recommendations