Role-based access control (RBAC) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.

Security principal (who). An object that represents something that is requesting access to resources. Examples: user, group, service principal, managed identity
Role definition (what). Collection of permissions that lists the operations that can be performed. Examples: Reader, Contributor, Owner, User Access Administrator
Scope (where). Boundary for the level of access that is requested. Examples: management group, subscription, resource group, resource
Assignment. Attaching a role definition to a security principal at a particular scope. Users can grant access described in a role definition by creating an assignment. Deny assignments are currently read-only and can only be set by Azure.

You want the external team to collaborate with the internal developer team in a process that’s easy and secure. With Azure Active Directory (Azure AD) business-to-business (B2B), you can add people from other companies to your Azure AD tenant as guest users.

Why use Azure AD B2B instead of the federation?
With Azure AD B2B, you don’t take on the responsibility of managing and authenticating the credentials and identities of partners. Giving access to external users is much easier than in a federation. You don’t need an AD administrator to create and manage external user accounts.

Azure Cost Management helps you plan for and control your costs, the services include- Cost analysis, budgets, recommendations, and exporting cost management data.

Cost analysis. You use cost analysis to explore and analyze your organizational costs. You can view aggregated costs by the organization to understand where costs are accrued and to identify spending trends.
Budgets. Budgets help you plan for and meet financial accountability in your organization. They help prevent cost thresholds or limits from being surpassed. Budgets can also help you inform others about their spending to proactively manage costs.
Recommendations. Recommendations show how you can optimize and improve efficiency by identifying idle and underutilized resources. Or, they can show less expensive resource options.
Exporting cost management data. If you use external systems to access or review cost management data, you can easily export the data from Azure.

You can apply tags to your Azure resources to logically organize them by categories. Each tag consists of a name and a value. For example, you can apply the name Environment and the value Production or Development to your resources. After creating your tags, you associate them with the appropriate resources.

If your organization has several subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Azure management groups provide a level of scope above subscriptions. You organize subscriptions into containers called management groups and apply your governance conditions to the management groups.

Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules over your resources, so those resources stay compliant with your corporate standards and service level agreements.

A virtual machine is the basic compute service provided by any cloud service provider. It falls under Infrastructure as a service, where you create a Windows or Linux Machine and manage it.

Sample AZ CLI command

az vm create \
--resource-group resource-group-for-testing \
--location westus \
--name SampleVM \
--image UbuntuLTS \
--admin-username azureuser \
--generate-ssh-keys \
--verbose

Unmanaged vs. Managed disks
The final storage choice you’ll make is whether to use unmanaged or managed disks.

With unmanaged disks, you are responsible for the storage accounts that are used to hold the VHDs corresponding to your VM disks. You pay the storage account rates for the amount of space you use.

Managed disks are the newer (and recommended) disk-storage model. They elegantly solve the complexity of unmanaged disks by putting the burden of managing the storage accounts onto Azure.

Increased reliability: Azure ensures that VHDs associated with high-reliability VMs will be placed in different parts of Azure storage to provide similar levels of resilience.
Better security: This means they can use role-based access control to restrict who can work with the VHD data.
Snapshot support: You can use snapshots to create a read-only copy of a VHD.
Backup support: You can automatically back up managed disks to different regions for disaster recovery with Azure Backup, all without affecting the service of the VM.

What is a Network Security Group?
Virtual networks (VNets) are the foundation of the Azure networking model and provide isolation and protection. Network Security Groups (NSGs) are the main tool you use to enforce and control network traffic rules at the networking level.

Security group rules
NSGs use rules to allow or deny traffic moving through the network. Each rule identifies the source and destination address (or range), protocol, port (or range), direction (inbound or outbound), a numeric priority, and whether to allow or deny the traffic that matches the rule. The following illustration shows NSG rules applied at the subnet and network-interface levels.

Keep in mind that security groups are optional at both levels. If no security group is applied, then all traffic is allowed by Azure. If the VM has a public IP, this could be a serious risk, particularly if the OS doesn’t provide some sort of firewall.

Bastion connections
The Azure Bastion service is a new fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly in the Azure portal over SSL. When you connect via Azure Bastion, your virtual machines do not need a public IP address.

Azure AD (Active Directory) is a directory and identity management solution.

Concepts for AAD

Azure Active Directory has free as well as premium versions

There are times when you need to replicate a deployment environment. A very common example is that a team usually has multiple environments for development, testing, staging, and production. Also at times, you need a secondary production environment for resiliency. Manually creating environments can be a lengthy and error-prone process. A simple configuration miss can be hard to detect and cause major issues.

ARM or Azure Resource Manager templates comes to help here. ARM provides us to implement Infrastructure as Code.

ARM templates are JavaScript Object Notation (JSON) files that define the infrastructure and configuration for your deployment. The template uses a declarative syntax. The declarative syntax is a way of building the structure and elements that outline what resources will look like without describing its control flow. Declarative syntax is different than imperative syntax, which uses commands for the computer to perform. Imperative scripting focuses on specifying each step in deploying the resources.

https://docs.microsoft.com/en-gb/learn/modules/create-azure-resource-manager-template-vs-code/2-explore-template-structure?tabs=azure-cli

ARM templates are idempotent, which means you can deploy the same template many times and get the same resource types in the same state.

Element Description

• schema: A required section that defines the location of the JSON schema file that describes the structure of JSON data.
• contentVersion: A required section that defines the version of your template (such as 1.0.0.0).
• apiProfile: An optional section that defines a collection of API versions for resource types.
• parameters: An optional section where you define values that are provided during deployment.
• variables: An optional section where you define values that are used to simplify template language expressions.
• resources: A required section that defines the actual items you want to deploy or update in a resource group or a subscription.
• output: An optional section where you specify the values that will be returned at the end of the deployment.

Example

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.1",
  "apiProfile": "",
  "parameters": {},
  "variables": {},
  "functions": [],
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2019-06-01",
      "name": "learntemplatestorage123",
      "location": "westus",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {
        "supportsHttpsTrafficOnly": true
      }
    }
  ],
  "outputs": {}
}

AKS or Azure Kubernetes Service is a managed Kubernetes service by Azure. It helps developers to focus on development and let Azure take care of providing Kuebernets and in turn manage containers.

Before getting into AKS, Azure also provides Azure Container Instance to create and manage containers individually.

AKS Terminology

The kubelet is the Kubernetes agent that processes the orchestration requests from the Azure-managed node, and scheduling of running the requested containers.

Virtual networking is handled by the kube-proxy on each node. The proxy routes network traffic and manages IP addressing for services and pods.

The container runtime is the component that allows containerized applications to run and interact with additional resources such as the virtual network and storage.

https://docs.microsoft.com/en-us/learn/modules/configure-azure-kubernetes-service/3-kubernetes-clusters

Azure provides a set of compute options, ranging from Virtual Machines, Container-based deployment support (includes AKS or Azure Kubernetes Services), Azure Web apps, Azure functions, etc.

Virtual Machines: Give you control over infrastructure as well as Operation systems.

When one is provisioning VMs, be aware of two types of downtimes that can occur.

To handle these issues we have various options

Availability Zones: It is physically separate zones within an Azure region. There are usually three zones in one region. To increase the availability of your application, you should deploy it in more than one zone.

Multi-Region Deployment: Once can further deploy to multiple regions to avoid region failures.

Virtual Machine ScaleSet: Azure virtual machine scale sets let you create and manage a group of load-balanced VMs. You can set rules for scaling as CPU percent goes beyond 60%. In addition, one can set Load Balancer which helps manage traffic at layer 4, or Application Gateway which helps distribute traffic at layer 7.

Azure Functions: This helps serverless computing, one can use a consumption-based plan where you pay only for the time the function was running. But it has limitations like the function can run for a max of 10 minutes. One can upgrade to an App service plan to avoid these limitations.

Azure Logic Apps: You can create workflows, to create low code/ no code applications.

Azure Kubernetes Service: Azure implementation for managing Kubernetes and Container based deployments.

Azure Service Fabric: Another offering to manage container-based deployments, supports both synchronous and asynchronous applications.

Azure App Service: Works on the model where you get your code and directly deploy it on Azure, without worrying about deployment details. This supports deployment slots, for example, you can create stage and prod deployment slots, once you deploy and test on stage successfully, you can just swap with prod deployment.

Azure App Service is a fully managed web application hosting platform. This platform as a service (PaaS) allows developers to focus on designing and building applications while Azure takes care of the infrastructure to run and scale.

Deployment slots: You can create a staging deployment slot where you can push your code to test on Azure. Once you are happy with your code, you can easily swap the staging deployment slot with the production slot.

Advantages of Azure App Service

• Continuous integration/deployment support
• Integrated Visual Studio publishing and FTP publishing
• Built-in auto-scale support (automatic scale-out based on real-world load)

You use Azure Automation State Configuration to make sure that the virtual machines (VMs) in a cluster are in a consistent state, with the same software installed and the same configurations.

PowerShell Desired State Configuration (DSC): PowerShell DSC is a declarative management platform that Azure Automation State Configuration uses to configure, deploy, and control systems. A declarative programming language separates intent (what you want to do) from execution (how you want to do it). You specify the desired state and let DSC do the work to get there. You don’t have to know how to implement or deploy a feature when a DSC resource is available. Instead, you focus on the structure of your deployment.

Local configuration manager (LCM): LCM is a component of the Windows Management Framework (WMF) on a Windows operating system. The LCM is responsible for updating the state of a node, like a VM, to match the desired state.

Azure Backup is Microsoft’s cloud-based backup solution. It requires no additional infrastructure setup. The solution allows doing a one-of backup as well as a scheduled backup through backup policies. One can backup, SQL databases, Disks, VMs, Files, and Blobs.

MARS Agent: MARS or Microsoft Azure Recovery Service helps backup on-prem Windows machines.

Azure Backup Center: To view and manage backups for various resources from one place.

Backup Policies: You can create policies for resources like VMs, SQL, file share, etc. Backup policies are created on the backup-vault basis. One can set rules like when to take a backup along with retention details like how long each backup should be retained.

For any cloud, you need to keep a watch on your resource usage from security, health, and cost perspective. Azure provides multiple tools for this purpose.

Azure Monitor: helps facilitate logging and collection of logs.

Three types of logs in azure:

• Activity logs provide a record of operations executed against a resource.
• Diagnostic logs record change details against a resource. Diagnostic logs schema has the following required fields.
  • time
  • resource id
  • tenant id
  • operation name (format Microsoft.<providerName>/<ResourceType>/<Subtype>/<Write/Read/Delete/Action>)
• Application logs are logs generated by an application

Log Analytics: this is a log search and analytics tool that collects logs from various sources and correlates the data.

Alerting: Azure monitor provides support for alerting. There are two types of alerts – Metric Alert (e.g. CPU, Memory, disk, and network usage) and Log Alerts

Alert has three parts- Target (Resource), Criteria (Logic or Condition), and Action (Action Group)

Action Group is a reusable set of notifications, such as email, voice call, message, or push to an application such as creating a ticket.

Azure Advisor: Azure has some built-in algorithms to help identify cost savings. The advisor makes recommendations on the last 14 days and targets low utilization systems.

Monitoring cost: One way to monitor cost is by resource tagging. This helps view cost based on a tag. Tags can be enforced via Azure policies.

Azure Cost Management: A reporting tool for helping to analyze and understand Azure spending. You can apply a budget and generate alerts to monitor the spend.