Azure, from decisions to practice
Cloud Trips explains Azure architecture through practical walkthroughs covering networking, identity, security, and more.
The Trips use the Azure portal where possible so you can follow each step directly. Basics covers cloud-agnostic foundations, and the Bicep Trips show how to deploy infrastructure consistently.
Trips
- Kubernetes Package Needs Installation? Install and Configure a Helm Chart
- App Needs More Capacity? Scale a Deployment and Enable the Cluster Autoscaler
- HTTP Requests Need Routing? Route Requests to Application Services
- App Needs Network Access? Configure Internal and External Kubernetes Services
- App Needs Managed Replicas? Create a Namespace and Deploy an Application
- Kubernetes Needs a Cluster? Create AKS and Connect with kubectl
- Container Images Need Storage? Create Azure Container Registry, Push an Image, and Verify a Pull
- A Simple Container Needs Hosting? Deploy Azure Container Instances from Your Registry
- A Private API Needs a Nearby Gateway? Deploy an API Management Self-Hosted Gateway
- API Access Needs OAuth Protection? Validate Tokens in API Management
- API Requests Need Controls? Apply and Test API Management Policies
- Events Need Automatic Archiving? Configure Event Hubs Capture
- APIs Need a Central Gateway? Create API Management and Import an API
- API Changes Need Separate Versions? Create and Test an API Version
- Business Partners Exchange EDI Documents? Create an Integration Account and B2B Workflow
- Business Workflow Needs an HTTP Endpoint? Create a Logic App with a Request and Response
- Workflows Need a Dedicated Hosting Environment? Create Logic Apps Standard
- Many Applications Need Separate Event Channels? Configure an Event Grid Domain
- Messages Need Ordered Processing? Configure Service Bus Sessions
- Events Must Trigger Another Service? Create an Event Grid Topic and Subscription
- App Needs High-Volume Event Streaming? Create an Event Hub, Send, and Read Events
- App Needs Reliable Messaging? Create a Service Bus Queue
- Subscribers Need Different Messages? Create a Service Bus Topic and Filters
- Failed Messages Need Investigation? Inspect and Resubmit a Dead-Letter Message
- Website Uptime Needs Monitoring? Create an Availability Test
- Resource Metrics Need Notifications? Create a Metric Alert and Action Group
- Resource Logs Need Centralized Analysis? Configure Log Analytics
- VM Performance and Logs Need Monitoring? Enable VM Insights and DCRs
- Metrics Need Shared Dashboards? Connect Managed Grafana to Prometheus
- Operations Need Visual Reports? Create a Workbook and Azure Dashboard
- App Performance Needs Monitoring? Enable Application Insights
- Deployment Failures Need Investigation? Inspect Errors, Activity Log, and Changes
- SQL Performance Needs Investigation? Review Metrics and Query Store
- Storage Performance Needs Investigation? Review Metrics, Logs, and Failures
- Kubernetes Needs Monitoring? Enable Container Insights and Managed Prometheus
- Distributed Requests Need Investigation? Trace Them with OpenTelemetry
- Alerts Need Tuning? Configure Dynamic Thresholds and Suppression Windows
- Data Needs Discovery and Governance? Configure Microsoft Purview
- Keys Need a Dedicated HSM Service? Configure Azure Managed HSM
- Incident Response Needs Automation? Configure a Sentinel Rule and Playbook
- Vault Keys Need Hardware Protection? Create HSM-Backed Keys in Key Vault Premium
- SOC Needs Investigation Context? Create a Sentinel Watchlist and Workbook
- Time-Series Analytics Needed? Create an Azure Data Explorer Cluster
- App Needs Passwordless Secret Access? Use Managed Identity with Key Vault
- Cloud Security Posture Needs Improvement? Review Defender for Cloud
- Security Events Need Investigation? Configure Microsoft Sentinel
- VM Needs Protection? Configure JIT Access and Host Encryption
- App Needs Secure Secret Storage? Create Key Vault and Store a Secret
- App Needs Certificates and Encryption Keys? Manage Them in Key Vault
- Visual Data Transformation Needed? Configure Mapping Data Flow
- Cache Data Must Persist? Configure Redis Persistence
- Data Pipelines Needed? Create Azure Data Factory
- App Needs a Cache? Create Azure Managed Redis
- Real-Time Analytics Needed? Create a Stream Analytics Job
- Large-Scale Analytics Workspace Needed? Create a Synapse Workspace
- App Needs Consistency Control? Change Cosmos DB Consistency Level
- Cosmos Data Needs Analytics? Analyze Cosmos Data with SQL Queries
- Cosmos Needs a Backup Policy? Configure Cosmos DB Backup Policies
- App Reacts to Cosmos Changes? Configure Change Feed
- Cosmos Needs Multi-Region Writes? Configure Multi-Region Writes
- App Needs NoSQL Globally? Create Cosmos DB Account
- App Needs MySQL? Create MySQL Server
- Read-Heavy PostgreSQL App? Create Read Replica
- PostgreSQL Needs High Availability? Configure PostgreSQL HA
- PostgreSQL Needs Backup Restore? Configure PostgreSQL PITR
- SQL Needs Threat Protection? Configure Defender for SQL
- SQL Needs Auditing? Configure SQL Auditing
- SQL Needs Tamper Evidence? Configure SQL Ledger
- App Needs PostgreSQL? Create PostgreSQL Server
- SQL Server Compatibility Needed? Create Managed Instance
- SQL Needs Multiple Databases with Shared Resources? Configure Elastic Pool
- SQL Needs Automatic Failover? Configure Failover Group
- SQL Access Must Be Restricted? Configure SQL Firewall
- SQL Needs Very Large Scale? Configure SQL Hyperscale
- Developer Needs a SQL Connection? Connect to Azure SQL
- App Needs a Relational Database? Create Azure SQL Database
- SQL Needs a Secondary Region? Enable Geo-Replication
- Database Was Damaged? Restore SQL Database
- SQL Database Needs Scaling? Scale Database
- Storage Needs Zone or Regional Resilience? Compare and Configure ZRS and GRS
- Storage Needs Customer-Controlled Encryption? Configure CMK and Encryption Scopes
- Blob Records Must Not Be Changed? Configure Retention and Legal Hold
- Storage Must Block Public Networks? Configure the Storage Firewall
- Admin Needs GUI and Large-File Transfers? Use Storage Explorer and AzCopy
- File Share Needs High Performance? Configure Premium Azure Files
- App Needs a Shared File System? Create, Mount, and Snapshot Azure Files
- App Needs Simple Background Messaging? Create and Test a Storage Queue
- Static Website Needs Cheap Browser Hosting? Enable Static Website and Configure CORS
- Linux App Needs NFS Storage? Configure NFS for Blob Storage
- Partner Needs SFTP Upload? Create Data Lake Gen2 and Enable SFTP
- Blobs Must Replicate to Another Account? Configure Change Feed and Object Replication
- Blob Data Must Be Recoverable and Cost-Efficient? Configure Versioning, Soft Delete, Lifecycle, and Inventory
- App Needs Secure Cloud File Storage? Create Blob Storage and Revocable SAS Access
- Short Background Container Task Needed? Create a Container Apps Job
- Long Workflow Needed? Create a Durable Function
- Containerized Web App Needs Scaling and Safe Rollout? Create a Container App
- App Service Needs VNet Access? Configure App Service Networking
- Code Must Run on Demand or Schedule? Create HTTP and Timer Functions
- Web App Needs Backup? Configure App Service Backup
- Web App Needs a Staging Environment? Create a Deployment Slot
- Web App Needs a Custom Domain? Map a Custom DNS Name
- Web App Needs More Power or Instances? Scale App Service Plan
- Patch Management Needed? Configure Azure Update Manager
- Sensitive Workload Needs Hardware Isolation? Configure a Confidential VM
- VM Configuration Needs Automation? Configure Desired State Configuration
- Fast Temporary OS Disk Needed? Configure an Ephemeral OS Disk
- Simple Web App Needs Hosting? Create App Service
- Low-Latency VM Placement Needed? Configure a Proximity Placement Group
- VMs Need Datacenter Fault Protection? Create an Availability Set
- Dedicated Hardware Required? Evaluate a Dedicated Host
- Cheap Interruptible VM Needed? Create a Spot VM
- VMs Need Zone Resilience? Deploy Across Availability Zones
- VM Won't Boot? Enable Boot Diagnostics
- VM Needs an Agent or Script Install? Install a VM Extension
- VMs Must Scale Automatically? Configure VM Autoscale
- Need Many Identical VMs? Create a VM Scale Set
- VM Needs Extra Storage? Add a Data Disk
- VM Is Too Small? Resize the VM
- Need a Linux Server Quickly? Create a Linux VM
- Need a Windows Server Quickly? Create a Windows VM
- What Should You Use? ExpressRoute, Route Server, IPv6, and SNAT
- PaaS Network Boundary Needed? Configure Network Security Perimeter
- Global DNS Failover Needed? Configure Traffic Manager
- Packet-Level Evidence Is Needed? Capture Packets
- Many VNets Need Central Governance? Configure Network Manager
- A Public App Needs DDoS Protection? Enable DDoS Protection
- A Network Issue Must Be Diagnosed? Use Network Watcher
- Traffic Flow Records Are Needed? View Flow Logs
- Custom Service Should Expose Private Link? Configure a Private Link Service
- Storage Must Stay Private? Create a Private Endpoint
- PaaS Access Should Stay on the Azure Backbone? Create a Service Endpoint
- Hybrid DNS Needs a Resolver? Configure Azure DNS Private Resolver
- Private Service Needs a Private Name? Create a Private DNS Zone
- Front Door Needs Routing Logic? Configure Rules Engine
- DNS Name Must Point to the App? Create an Azure DNS Zone
- Headers and URLs Need Modification? Configure Application Gateway Rewrite Rules
- Global Traffic Needs Regional Balancing? Configure a Cross-Region Load Balancer
- Front Door Needs Multiple Origins? Configure an Origin Group
- URLs Need Different Backend Pools? Configure Path-Based Routing
- An HTTP App Needs Layer 7 Routing? Create an Application Gateway
- A Global Web App Needs an Edge Entry? Create Azure Front Door
- A Web App Needs OWASP Protection? Enable WAF
- Threat Traffic Must Be Blocked? Configure Firewall IDPS
- A Web App Needs Traffic Distribution? Create a Load Balancer
- Encrypted Traffic Needs Inspection? Configure Firewall Premium TLS Inspection
- Inbound Firewall Publishing Needed? Configure Firewall DNAT
- Firewall Rules Need Central Management? Create a Firewall Policy
- An Admin Needs Secure VM Access? Create Azure Bastion
- Network Needs Firewall Inspection? Create Azure Firewall
- Internet Egress Needs a Static IP? Create a NAT Gateway
- Remote Worker Needs Private Azure Access? Configure a Point-to-Site VPN
- Virtual WAN Traffic Needs Control? Configure Routing Intent
- Office Network Needs Private Azure Access? Configure a Site-to-Site VPN
- Global Branch Network Needs a Hub? Create Virtual WAN
- VNets in Different Regions Need Connection? Configure Global Peering
- Spoke Networks Need a Central Hub? Configure a Hub-Spoke Network
- Two VNets Need Private Communication? Create VNet Peering
- Private Azure Access Needs a VPN Endpoint? Create a VPN Gateway
- Rule Should Target App Servers Only? Create an Application Security Group
- Traffic Must Use a Custom Path? Create a Route Table
- Need to See Why Traffic Is Blocked? Evaluate Effective NSG Rules
- VM Needs a Network Adapter? Create a Network Interface
- Subnet Needs Traffic Filtering? Create an NSG
- VM Needs an Internet Address? Create a Public IP
- Workload Needs Its Own Network Segment? Create a Subnet
- App Needs a Private Network? Create a VNet
- CloudTrips Needs a Complete Repeatable Environment? Build It with Bicep
- Modules Cannot Be Reused Across Repositories? Publish a Bicep Registry
- Removing Bicep Code Does Not Always Remove the Resource? Use Deployment Stacks
- Manual Bicep Deployment Does Not Scale? Deploy with GitHub Actions
- Teams Keep Rebuilding the Same Azure Patterns? Use Azure Verified Modules
- Some Resources Exist Above the Resource Group? Use Deployment Scopes
- Infrastructure Changes Are Too Risky to Deploy Blindly? Validate and Test Bicep
- One Bicep File Has Become Too Large? Create Modules
- DEV, TEST, and PROD Need Different Values? Use Bicep Parameter Files
- Repeated Resource Definitions Create Duplication? Use Conditions and Loops
- Connected Resources Are Difficult to Maintain? Use References and Dependencies
- Manual Deployments Are Inconsistent? Deploy a Storage Account with Bicep
- Hard-Coded Templates Cannot Be Reused? Use Parameters, Variables, and Outputs
- Azure Billing Hierarchy Is Confusing? Understand MCA Billing Scopes
- Cloud Adoption Needs Standard Patterns? Configure CAF Archetypes
- Predictable Usage Should Cost Less? Configure Reservations
- Leadership Needs a Cloud Cost View? Create a FinOps Dashboard
- New Subscriptions Must Be Consistent? Configure Subscription Vending
- Need a Standard Enterprise Structure? Create a Landing Zone Structure
- Team Needs a Spend Warning? Create a Cost Alert
- Company Needs a Custom Rule? Create a Custom Policy Definition
- Need Cost and Security Recommendations? Review Azure Advisor
- Need to Search Across Subscriptions? Use Azure Resource Graph
- Temporary Exception Needed? Configure a Policy Exemption
- Costs Need Department Tracking? Apply Azure Tags
- Resources Must Only Be in Approved Regions? Assign Azure Policy
- Regional Deployment Fails Because of Quota? Check Usage and Quotas
- Multiple Policies Must Apply Together? Create a Policy Initiative
- Resource Must Not Be Deleted? Create a Delete Lock
- Monthly Spend Must Be Controlled? Create an Azure Budget
- Resource Must Not Be Modified? Create a Read-Only Lock
- Deployment Fails Because a Provider Is Missing? Register the Resource Provider
- User Needs Limited Azure Access? Assign an RBAC Role
- Need Access to Only One Resource? Assign a Role at Resource Scope
- Need to Know Why a User Has Access? Check Access Assignments
- Built-In Role Is Too Broad? Create a Custom Azure Role
- Multiple Subscriptions Need a Hierarchy? Create a Management Group
- Subscription Needs Governance? Manage Its Settings
- You Need a Clean Project Boundary? Create a Resource Group
- Resource Is in the Wrong Group? Move It to the Correct Resource Group
- Confused by Sign-In Flows? Compare Microsoft Entra Authentication Flows
- Users Request App Permissions? Configure Admin Consent Workflow
- Admin Needs Emergency Fallback? Create Emergency Access Account
- Enterprise App Should Not Be Open to Everyone? Require User Assignment
- Customer Identities Need Sign-Up/Sign-In? Configure External ID
- Company Wants a Branded Login Page? Configure Company Branding
- Company Wants Custom Domain Login? Add a Custom Domain
- User Needs Verifiable Digital Credential? Configure Verified ID
- Azure DevOps Pipeline Needs Azure Access? Configure Azure DevOps Federation
- Workload Should Not Store Secrets? Configure Workload Identity Federation
- Partner Needs Access? Configure Cross-Tenant Access
- Partner Users Must Sync Automatically? Configure Cross-Tenant Synchronization
- Contractor Needs Time-Limited Access? Create an Access Package
- Guest Access Must Be Reviewed? Create an Access Review
- Admin Role Should Be Temporary? Enable PIM
- App Needs Microsoft Graph Access? Configure API Permissions
- App Needs Certificate Authentication? Upload Certificate Credential
- User Risk Must Be Remediated? Configure User Risk Policy
- SaaS App Needs SSO? Create Enterprise Application
- Who Changed Identity Settings? Review Audit Logs
- Login Failed? Review Sign-In Logs
- Old Apps Use Insecure Sign-In? Block Legacy Authentication
- Only Office Countries Should Sign In? Configure Named Locations
- Risky Sign-In Detected? Configure Sign-In Risk Policy
- App Needs Role-Based Access? Assign App Roles to Users and Groups
- API Needs User Permissions? Expose a Delegated Scope
- Company Wants Passwordless Login? Register Passkey
- Admin Tasks Need Stronger Login? Require Authentication Strength
- SPA Needs Secure Login? Use Authorization Code Flow with PKCE
- Web App Needs User Login? Use Authorization Code Flow
- CLI Tool Needs Login? Use Device Code Flow
- User Has No Phone Yet? Create Temporary Access Pass
- Admin Account Needs Extra Protection? Require MFA for Admins
- User Left the Company? Disable the Entra Account and Revoke Sessions
- Users Need Password Reset Without Admin? Configure Self-Service Password Reset
- User Was Deleted by Mistake? Restore Deleted User
- Background App Needs Access? Use Client Credentials Flow
- Background App Needs Access? Use Managed Identity
- Helpdesk Should Manage Only One Department? Create an Administrative Unit
- Devices Should Join Group Automatically? Create a Dynamic Device Group
- Users Should Join Group Automatically? Create a Dynamic User Group
- Department Needs Collaboration Mailbox or Team? Create a Microsoft 365 Group
- Team Needs Shared Permissions? Create a Security Group
- HR Sends 50 New Users? Bulk Create Users
- New Employee Needs Azure Access? Create a Microsoft Entra User
- Contractor Needs Temporary Access? Invite a B2B Guest User