Azure ☁️

Microsoft Azure cloud platform — comprehensive architectural deep dives covering enterprise identity, software-defined regional networking, managed Kubernetes, distributed NoSQL, generative AI, hybrid multi-cloud operations, and platform governance. Built to match the depth of the AWS and GCP knowledge bases with Architecture & Mental Models + Production az CLI + Quotas & Limits + References + 2 Realistic Pricing Scenarios + 5+ Battle-Tested Nuggets & Gotchas.

Service Catalog by Architectural Domain

1. Compute & Containers

• AKS Architecture Hub — Master architectural directory indexing 22 specialized engineering deep dives (Automatic, CNI Overlay, Cilium eBPF, Gateway API, GPU AI/ML, Kata Containers, Fleet Manager, SRE Runbooks).
• Virtual Machines & Scale Sets (VMSS) — VM series taxonomy, Flexible VMSS, Availability Zones vs Fault Domains, and Proximity Placement Groups.
• Azure Spot VMs & Scheduled Events — Surplus compute at 90% discount, 30-second eviction handling, and resilient batch pipelines.
• Azure Container Apps (ACA), KEDA & Dapr — Serverless containers on AKS/Envoy, event-driven KEDA autoscaling, Dapr sidecars, and scale-to-zero.
• Azure App Service & Deployment Slots — Dedicated App Service Plans, zero-downtime deployment slots, and regional VNet integration.
• Azure Functions & Serverless Computing — Event-driven FaaS, Flex Consumption, Isolated Worker Model, Durable Functions stateful orchestrations, and cold-start optimization.

2. Networking & Connectivity

• Virtual Network (VNet) & Hybrid Routing — Regional VNet architecture, 5 reserved subnet IPs, VNet Peering with Gateway Transit, UDRs, and system routing.
• Network Security Groups (NSGs) & ASGs — Stateful L3/L4 filtering, rule priority (100–4096), Service Tags, Application Security Groups, and dual-layer evaluation.
• Azure Load Balancing, Application Gateway & Front Door — Layer 4 Azure Load Balancer, Layer 7 App Gateway WAF v2, and Azure Front Door Anycast edge CDN.
• Azure Firewall & IDPS — Standard vs Premium, TLS inspection, 67,000+ signature IDPS, FQDN filtering, and Virtual WAN Secured Hubs.
• Azure Virtual WAN (vWAN) — Global transit networking, Secured Virtual Hubs, any-to-any VNet transit, ExpressRoute, and S2S VPN.
• Azure Private Link & Private Endpoints — Private PaaS connectivity, Private DNS Zones, eliminating public IPs, and data exfiltration prevention.
• Azure DNS & Traffic Manager Architecture — Public Anycast DNS, Private DNS Zones, Azure DNS Private Resolver, and Traffic Manager’s 6 routing methods.
• Azure ExpressRoute & VPN Gateway Hybrid Architecture — Dedicated Layer 3 circuits, FastPath wire-speed bypass, Active-Active BGP (ASN 65515), and S2S VPN failover.
• Azure Bastion & NAT Gateway Architecture — Zero-public-IP browser/CLI jump hosts (Developer vs Standard SKU) and outbound SNAT port exhaustion mitigation.

3. Storage & Shared Filesystems

• Azure Blob Storage & Data Lake Storage Gen2 (ADLS) — Redundancy tiers (LRS, ZRS, GRS, GZRS), Access Tiers (Hot/Cool/Cold/Archive), ADLS Gen2 Hierarchical Namespace (HNS), and User Delegation SAS.
• Azure Files & Azure NetApp Files (ANF) — Cloud-native SMB 3.1.1 and NFSv4.1 shares vs bare-metal NetApp ONTAP infrastructure, sub-millisecond latencies, and FSLogix user profiles.
• Azure Managed Disks & Elastic SAN Architecture — Standard HDD/SSD, Premium SSD v1/v2, Ultra Disk, SCSI-3 Shared Disks, and cloud-native iSCSI SAN pools.

4. Databases & In-Memory Caching

• Azure SQL Database & Managed Instance — Single Database vs Managed Instance, vCore vs DTU, Serverless auto-pause, Hyperscale distributed storage, and Auto-Failover Groups.
• Azure Cosmos DB — Request Units (RUs), multi-region active-active writes, 5 mathematical consistency levels, partition key design, and Autoscale throughput.
• PostgreSQL Flexible Server — Zone-redundant HA failover, integrated PgBouncer connection pooling, storage autogrow, and maintenance windows.
• MySQL Flexible Server Architecture — Zone-redundant high availability, pre-provisioned vs Autoscale IOPS, read replicas, and server parameter tuning.
• Azure Cache for Redis — Basic vs Standard vs Premium (clustering, persistence) vs Enterprise (CRDT multi-region active-active).

5. Application Integration & Messaging

• Azure Messaging & Event Architecture — Dedicated enterprise message queuing and streaming hub (Service Bus, Event Hubs, Event Grid).
• Azure Event Grid Architecture & CloudEvents Broker — Namespaces, MQTT v5.0 broker, CNCF CloudEvents v1.0 standard, push vs pull delivery, and reactive event routing.
• Azure Service Bus Enterprise Architecture — Queues vs Topics, AMQP 1.0, FIFO message sessions, duplicate detection, dead-lettering, and transactions.
• Azure Event Hubs & Kafka Ingestion — Distributed partitioned streaming, Event Hubs Capture to ADLS Gen2, consumer groups, and Kafka protocol parity.
• Azure Logic Apps Architecture & Enterprise Integration — Standard (single-tenant containerized) vs Consumption runtimes, 400+ connectors, stateful vs stateless workflows, and VNet integration.
• Azure API Management (APIM) Architecture & Gateway — Modern v2 tiers (Standard v2, Premium v2), XML policy pipeline, developer portal, OAuth2/JWT validation, and internal VNet injection.

6. Artificial Intelligence & Machine Learning

• Azure OpenAI Service Architecture & Enterprise GenAI — Frontier LLMs (GPT-4o, o1), Provisioned Throughput Units (PTU) vs Pay-as-you-go TPM, Azure AI Content Safety, and zero model training boundaries.
• Azure AI Search Architecture & Enterprise Vector Retrieval — Dense vector search with HNSW, BM25 inverted indexes, Reciprocal Rank Fusion (RRF), deep Semantic Ranker reranking, and partition/replica scaling.
• Azure Machine Learning (AML) Architecture & MLOps Platform — Workspace architecture, Managed Online Endpoints with blue/green deployment traffic splitting, autoscaling GPU compute clusters, and MLflow tracking.

7. Developer Tools & DevOps

• Azure Container Registry (ACR) Architecture & Supply Chain Security — Premium SKU, Geo-replication, ACR Tasks for automated base image patching, OCI artifact store, private endpoints, and Defender for Containers.
• Azure DevOps & GitHub Actions on Azure Architecture — Workload Identity Federation (keyless OIDC authentication), Actions Runner Controller (ARC) on AKS, and multi-stage enterprise release pipelines.
• Azure Bicep & Deployment Stacks Architecture — Declarative DSL for ARM, zero-day provider support, actionOnUnmanage lifecycle cleanup, denySettingsMode drift prevention, and private registry modules.

8. Analytics & Modern Data Platform

• Microsoft Fabric & Azure Synapse Analytics Architecture — OneLake unified lakehouse, Direct Lake Power BI querying, Delta Parquet native storage, Serverless SQL pools, and Spark runtimes.
• Azure Data Factory (ADF) Architecture & Hybrid ETL — Control plane vs Integration Runtime, Self-Hosted IR (SHIR) on-premises clustering, Mapping Data Flows, and Data Integration Units (DIUs).
• Azure Databricks Architecture & Lakehouse Analytics — Dual-plane VNet injection, Unity Catalog three-level namespace governance, Photon vectorized C++ engine, and Lakehouse Federation.

9. Security & Zero Trust

• Microsoft Defender for Cloud Architecture & CNAPP — Cloud Security Posture Management (CSPM), Cloud Workload Protection Platform (CWPP), Secure Score, Defender for Servers/Containers/Storage, and multi-cloud security.
• Azure Key Vault & Managed HSM Architecture — FIPS 140-2 Level 3 hardware HSM, Azure RBAC authorization, Keys, Secrets, Certificates, Soft-Delete, and Purge Protection.

10. Identity & Access Management

• Microsoft Entra ID & Azure RBAC Architecture — Tenant architecture, Directory Roles vs Azure Resource RBAC, Managed Identities, PIM, and Conditional Access.
• Microsoft Entra ID Architecture & Administration — Identity Provider (IdP), dynamic security groups, administrative units, and hybrid synchronization.
• Workload Identity & Federated Credentials — Keyless authentication for AKS pods and GitHub Actions CI/CD using OIDC federation.

11. Governance & Platform Operations

• Azure Governance — Management Groups, Policy & Locks — Management Group hierarchy, Azure Policy evaluation engines (Deny vs DeployIfNotExists), Initiatives, and Resource Locks.
• Azure Resource Groups & ARM Lifecycle Architecture — ARM control plane boundaries, regional metadata constraints, resource locking, tagging strategies, and cross-group migration.
• Azure Resource Graph (ARG) Architecture & Governance Querying — Distributed KQL search engine, cross-subscription inventory queries, schema tables, throttling mitigation, and FinOps audit automation.

12. Monitoring & Cloud Observability

• Azure Monitor & Log Analytics Architecture (KQL) — Centralized log workspaces, Kusto Query Language (KQL), diagnostic settings, commitment tiers, data retention, and Data Collection Rules (DCR).
• Microsoft Sentinel Architecture, Threat Intelligence & SOAR — Cloud-native SIEM/SOAR, multi-cloud data connectors, KQL threat analytics, incident investigation graphs, and automated Logic Apps playbooks.
• AKS Observability & Monitoring Deep Dive — Container Insights, Managed Prometheus, Azure Managed Grafana, and ContainerLogV2 schema optimization.

13. Hybrid, Multi-Cloud & Migration

• Azure Arc Architecture & Hybrid Multi-Cloud Governance — Arc-enabled servers, Arc-enabled Kubernetes with Flux v2 GitOps, Azure Policy guest configuration, zero-public-IP Arc SSH access, and Extended Security Updates (ESU).
• Azure Migrate Architecture & Datacenter Modernization — Agentless discovery appliance, performance-based right-sizing, dependency mapping, business case modeling, and wave migration planning.

14. Cost Management & FinOps

• Microsoft Cost Management & Enterprise FinOps Architecture — Azure Savings Plans vs Reserved Instances (RIs), FOCUS schema exports, automated budgets with forecast alerts, and Azure Advisor cost rules.
• AKS FinOps & Cost Allocation Deep Dive — Container cost attribution, Microsoft Cost Management AKS integration, OpenCost metrics, and capacity overprovisioning.

Multi-Cloud Architecture Translation Matrix (AWS vs. GCP vs. Azure)

Related Hubs

• AWS — Amazon Web Services catalog and deep dives
• GCP — Google Cloud Platform catalog and deep dives
• Kubernetes — Cloud-native container orchestration and deep dives
• Azure Security Hub — Cloud-native security operations