Deploying On Azure

Azure Patterns

Design and implement Azure cloud architectures following Microsoft's Well-Architected Framework and best practices for service selection, cost optimization, and security.

When to Use

Use this skill when:

• Designing new applications for Azure cloud
• Selecting Azure compute services (Container Apps, AKS, Functions, App Service)
• Architecting storage solutions (Blob Storage, Files, Cosmos DB)
• Integrating Azure OpenAI or Cognitive Services
• Implementing messaging patterns (Service Bus, Event Grid, Event Hubs)
• Designing secure networks with Private Endpoints
• Applying Azure governance and compliance policies
• Optimizing Azure costs and performance

Core Concepts

Service Selection Philosophy

Azure offers 200+ services. Choose based on:

1. Managed vs. IaaS - Prefer fully managed services (lower operational burden)
2. Cost Model - Consumption vs. dedicated capacity
3. Integration Requirements - Microsoft 365, Active Directory, hybrid cloud
4. Control vs. Simplicity - More control = more operational overhead

Azure Well-Architected Framework (Five Pillars)

Reference references/well-architected.md for detailed pillar implementation patterns.

Compute Service Selection

Decision Framework

Container-based workload?
  YES → Need Kubernetes control plane?
          YES → Azure Kubernetes Service (AKS)
          NO → Azure Container Apps (recommended)
  NO → Event-driven function?
         YES → Azure Functions
         NO → Web application?
                YES → Azure App Service
                NO → Legacy/specialized → Virtual Machines

Service Comparison

Recommendation: Start with Azure Container Apps for 80% of containerized workloads (simpler and cheaper than AKS).

Reference references/compute-services.md for detailed comparison with Bicep and Terraform examples.

Storage Architecture

Blob Storage Tier Selection

Pattern: Use lifecycle management policies to automatically move data to lower-cost tiers.

Storage Service Decision

File system interface required?
  YES → Protocol?
          SMB → Azure Files (or NetApp Files for high performance)
          NFS → Azure Files (NFS 4.1)
  NO → Object storage → Blob Storage
       Block storage → Managed Disks (Standard/Premium SSD/Ultra)
       Analytics → Data Lake Storage Gen2

Reference references/storage-patterns.md for lifecycle policies, redundancy options, and performance tuning.

Database Service Selection

Decision Framework

Relational data?
  YES → SQL Server compatible?
          YES → Need VM-level access?
                  YES → SQL Managed Instance
                  NO → Azure SQL Database
          NO → Open source?
                 PostgreSQL → PostgreSQL Flexible Server
                 MySQL → MySQL Flexible Server
  NO → Data model?
         Document/JSON → Cosmos DB (NoSQL API)
         Graph → Cosmos DB (Gremlin API)
         Wide-column → Cosmos DB (Cassandra API)
         Key-value cache → Azure Cache for Redis
         Time-series → Azure Data Explorer

Cosmos DB Consistency Levels

Reference references/database-selection.md for capacity planning, indexing strategies, and migration patterns.

AI and Machine Learning Integration

Azure OpenAI Service

Use Cases:

• Chatbots and conversational AI (GPT-4)
• Content generation and summarization
• Semantic search with embeddings (RAG pattern)
• Code generation and completion
• Function calling for structured outputs

Key Advantages:

• Enterprise data privacy (no model training on customer data)
• Regional deployment for data residency
• Microsoft enterprise SLAs
• Built-in content filtering

Integration Pattern:

from openai import AzureOpenAI
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = AzureOpenAI(
    azure_endpoint="https://myopenai.openai.azure.com",
    azure_ad_token_provider=token_provider,
    api_version="2024-02-15-preview"
)

response = client.chat.completions.create(
    model="gpt-4-turbo",
    messages=[{"role": "user", "content": "Hello!"}]
)

Other AI Services

Reference references/ai-integration.md for RAG architecture, function calling, and fine-tuning patterns.

Messaging and Integration

Service Selection Matrix

When to Use What:

• Service Bus: Reliable messaging with transactions (e.g., order processing)
• Event Grid: React to Azure resource events (e.g., blob created, VM stopped)
• Event Hubs: High-throughput streaming (e.g., IoT telemetry, application logs)

Reference references/messaging-patterns.md for implementation examples, retry policies, and dead-letter handling.

Networking Architecture

Private Endpoints vs. Service Endpoints

Best Practice: Use Private Endpoints for all PaaS services in production (treat public endpoints as anti-pattern).

Hub-and-Spoke Topology

Components:

• Hub VNet: Shared services (Azure Firewall, VPN Gateway, Private Endpoints)
• Spoke VNets: Application workloads (isolated per environment or team)
• VNet Peering: Low-latency connectivity between hub and spokes

Benefits:

• Centralized security (firewall, DNS)
• Cost optimization (shared egress)
• Simplified governance

Reference references/networking-architecture.md for hub-spoke Bicep templates, NSG patterns, and DNS configuration.

Identity and Access Management

Managed Identity Pattern

Always use Managed Identity instead of:

• Connection strings in code
• Storage account keys
• Service principal credentials
• API keys

System-Assigned vs. User-Assigned:

Example Flow:

1. Enable Managed Identity on Container App
2. Grant identity access to Key Vault (RBAC or Access Policy)
3. Application authenticates automatically (no credentials)

from azure.identity import DefaultAzureCredential

# Works automatically with Managed Identity
credential = DefaultAzureCredential()
keyvault_client = SecretClient(vault_url="...", credential=credential)

Azure RBAC Best Practices

• Use built-in roles when possible (Owner, Contributor, Reader)
• Apply least privilege principle
• Assign roles at resource group level (not subscription)
• Use Azure AD groups for user management
• Audit role assignments regularly

Reference references/identity-access.md for Entra ID integration, Conditional Access policies, and B2C patterns.

Governance and Compliance

Azure Policy for Guardrails

Common Policy Patterns:

• Require tags on all resources (Environment, Owner, CostCenter)
• Restrict allowed Azure regions
• Enforce TLS 1.2 minimum
• Require Private Endpoints for storage accounts
• Deny public IP addresses on VMs

Policy Effects:

• Deny: Block non-compliant resource creation
• Audit: Log non-compliance but allow creation
• DeployIfNotExists: Auto-remediate missing configurations
• Modify: Change resource properties during deployment

Cost Management

Optimization Strategies:

Monitoring:

• Set budgets and alerts in Azure Cost Management
• Review Azure Advisor cost recommendations weekly
• Tag resources for cost allocation
• Use FinOps Toolkit for Power BI dashboards

Reference references/governance-compliance.md for Azure Landing Zones, Policy definitions, and Blueprints.