Sefism.Cloud engineering: Azure

Tauseef Fayyaz

Chapter 02

Cloud concepts and billing

How a cloud is organised and paid for: service models, shared responsibility, regions, how accounts are structured, the free offers, pricing models and budgets. Includes a service name map across the three providers.

IaaS, PaaS and SaaS

Also called infrastructure as a service, platform as a service, software as a service, IaaS, PaaS, SaaS

What: IaaS rents you virtual machines, disks and networks to manage yourself. PaaS runs your code or database while the provider handles servers. SaaS is finished software you just use.
Why: The model decides how much you patch, scale and secure yourself, and so how much work and risk you take on.
Example: A VM running your own PostgreSQL is IaaS. A managed PostgreSQL service is PaaS. A hosted email product is SaaS.

Watch out

Running everything on VMs out of habit, then spending your weeks patching operating systems a managed service would handle.

Shared responsibility model

Also called security of the cloud, security in the cloud

What: The provider secures the physical data centres, hardware and the platform. You secure what you put on it: identities, data, network rules, and on IaaS the operating system too.
Why: Most cloud breaches are customer misconfiguration, such as a public bucket or an over-powerful key, not a provider failure.

Watch out

Assuming a managed service means the provider also decides who can read your data. Access is always your job.

Regions and availability zones

Also called region, availability zone, AZ, zone

What: A region is a geographic area with its own data centres. Inside it, zones are separate data centres with independent power and networking, close enough for fast links.
Why: Spreading an app across zones survives one data centre failing. The region you pick also sets latency to users, prices and which services exist.

Watch out

Building in the default region far from your users, or putting every instance in one zone and calling it highly available.

Subscriptions and resource groups

Also called management group, subscription, resource group, tenant

What: A Microsoft Entra tenant holds identities. Under it, management groups contain subscriptions, the billing and quota boundary, and each subscription holds resource groups that collect related resources.
Why: Access, policies and budgets are assigned at these scopes and inherited downwards, and deleting a resource group removes everything in it.

Shell

az account show --output table
az group create --name rg-shop-dev --location uksouth
az resource list --resource-group rg-shop-dev -o table
az group delete --name rg-shop-dev --yes

Watch out

Mixing unrelated projects in one resource group, so you cannot clean up or budget one without touching the others.

Azure free account and Azure for Students

Also called free account, Azure credits, Azure for Students, spending limit

What: As of September 2026 the Azure free account gives 200 USD of credit for 30 days plus 12 months of select free services. Azure for Students gives 100 USD for 12 months with no credit card, for full-time university students.
Why: The free account has a spending limit. To keep using services after 30 days or once the credit is used, you move to pay-as-you-go, which removes that limit.

Watch out

Upgrading to pay-as-you-go without setting a budget, and leaving a VM or database running that the credit used to hide.

On-demand, committed and spot pricing

Also called on-demand, reserved instances, savings plans, committed use discounts, spot

What: On-demand is pay per second or hour with no commitment. Committing to one or three years of usage buys a large discount. Spot capacity is spare capacity sold cheaply that can be taken back at short notice.
Why: The same workload can cost very different amounts depending on how you buy it, which is most of what cloud cost work is.
Example: AWS calls commitments Savings Plans and Reserved Instances, Azure calls them reservations and savings plans, Google Cloud calls them committed use discounts.

Watch out

Running a stateful database or a single important server on spot capacity and losing it mid-day.

Budgets and billing alerts

Also called budget, billing alarm, cost alert

What: A budget watches actual or forecast spend and emails you, or triggers an action, when it crosses thresholds you set, such as 50, 80 and 100 percent.
Why: It is the first thing to set up in any new account: most surprise bills are forgotten resources that a 10 USD alert would have caught in a day.

Watch out

Believing a budget is a hard cap. It alerts; it does not switch off your resources unless you wire up an action to do so.

Well-Architected frameworks

Also called Well-Architected Framework, pillars, architecture review

What: Each provider publishes a framework of design principles grouped in pillars such as security, reliability, performance, cost and operations, with review questions for a workload.
Why: It gives you a checklist for your own designs and the vocabulary that architecture reviews and associate-level exams use.

Watch out

Reading it cover to cover before building anything. Use it as a review checklist once you have something running.

Service map: compute and data

Also called AWS vs Azure vs GCP, service comparison, equivalent services

What: The same job has a different product name on each cloud. This table maps the compute, storage and database services you meet first.
Why: Knowing the equivalents lets you read tutorials, job posts and diagrams written for another provider and translate them to yours.

Code

Job        AWS            Azure            Google Cloud
VM         EC2            Virtual Machines Compute Engine
Scale set  Auto Scaling   VM Scale Sets    Managed inst. groups
Functions  Lambda         Functions        Cloud Run functions
Containers ECS, Fargate   Container Apps   Cloud Run
Kubernetes EKS            AKS              GKE
Objects    S3             Blob Storage     Cloud Storage
Disks      EBS            Managed Disks    Persistent Disk
Files      EFS            Azure Files      Filestore
SQL        RDS, Aurora    Azure SQL        Cloud SQL
NoSQL      DynamoDB       Cosmos DB        Firestore, Bigtable

Watch out

Assuming equivalent means identical: limits, pricing units and defaults differ, so check the docs of your provider.

Service map: network, identity and operations

Also called AWS Azure GCP equivalents, service names

What: The networking, identity, monitoring and infrastructure as code services on each cloud, side by side.
Why: These are the services every project touches, whatever it runs on, and the ones exam questions compare most.

Code

Job         AWS             Azure             Google Cloud
Network     VPC             Virtual Network   VPC
Firewall    Security group  NSG               Firewall rules
L7 LB       ALB             App Gateway       App Load Balancer
DNS         Route 53        Azure DNS         Cloud DNS
CDN         CloudFront      Front Door        Cloud CDN
Identity    IAM             Entra ID, RBAC    IAM
Secrets     Secrets Manager Key Vault         Secret Manager
Metrics     CloudWatch      Azure Monitor     Cloud Monitoring
Audit log   CloudTrail      Activity log      Cloud Audit Logs
IaC         CloudFormation  Bicep             Terraform

Watch out

Mapping VPC to VPC and stopping there: a Google Cloud VPC is global while AWS VPCs and Azure virtual networks are regional.

Go deeper