Azure Cloud Deep — Identity, Storage, Networking
A deep-dive on Azure Cloud Deep — part of a 36-topic evergreen learning series.
Why this session matters
Part of a 36-topic learning series on engineering, ML, and LLM systems. Each session is a 90-minute deep-dive on one topic — designed so anyone can pick it up cold. Every two topics are followed by a revision session with recall prompts and hands-on drills.
Session 28 · SYS track ☁️
Azure runs your day job — knowing its primitives deeply is table stakes. This session covers Entra ID (AAD) & managed identities, storage (Blob/ADLS/Files/Queue), networking (VNets, NSGs, Private Endpoints, Front Door), compute (App Service, AKS, Functions), and Azure-specific gotchas (subscription/resource-group model, RBAC, service principals, ARM/Bicep).
Pre-read (30 min before session)
Watch 1–2 of these before the deep-dive:
- Azure Fundamentals — John Savill
- Azure Networking Deep Dive — John Savill
- Azure AD / Entra ID — John Savill
Then skim Azure Well-Architected Framework — Security.
Deep-dive (90 min)
1. Identity & access (25 min)
Entra ID (AAD): tenants, users, groups, apps. Service principals vs managed identities (system-assigned vs user-assigned). RBAC scopes (mg → sub → rg → resource). Custom roles. Conditional access. Key vault as the identity boundary for secrets.
2. Storage (20 min)
Blob (hot/cool/cold/archive tiers). ADLS Gen2 = Blob + hierarchical namespace + POSIX ACLs (the data lake choice). Files (SMB/NFS). Queue. Table. Choosing: analytics → ADLS; streaming ingestion → Event Hub → Blob; app state → Cosmos or Table.
3. Networking (25 min)
VNets, subnets, NSGs (stateless allow/deny). Private endpoints (kill public data path). Service endpoints (cheaper, subnet-scoped). Front Door (global L7 + WAF). Application Gateway (regional L7). Load Balancer (L4). ExpressRoute / VPN for hybrid.
4. Compute + ops gotchas (20 min)
App Service (PaaS, easiest). AKS (K8s, most control). Functions (serverless, cold start). Container Apps (in between). ARM vs Bicep vs Terraform. Cost gotchas: unattached disks, log ingestion pricing, egress. Azure Monitor + Log Analytics as the observability backbone.
Reading list
- Azure Well-Architected Framework (Microsoft Learn)
- John Savill's Azure master classes (YouTube)
- Cloud Adoption Framework (Microsoft Learn)
Research links
Hands-on drill
In your exploration subscription: create a resource group, a VNet with two subnets, a Private Endpoint for a Storage Account. Verify the storage is unreachable from public internet + reachable from a VM in the same VNet. Delete everything at the end (az group delete).
Post-session checklist
- Can you explain managed identity vs service principal in 60 seconds?
- Can you explain private endpoint vs service endpoint in 60 seconds?
- Can you explain ADLS Gen2 vs plain Blob in 60 seconds?
- Did you complete the hands-on drill above?
- Did you write 3 flashcards for tomorrow's recall?
- What's the one thing you'd want to revisit in the next revision session?
What's next
Session 29 continues the series. See the hub page for the full sequence and revision pattern.