Azure Core Services Cheatsheet: Microsoft Cloud Quick Reference

This page is a quick reference for Microsoft Azure services. It covers the core services across compute, storage, networking, database, identity, security, and monitoring that you will encounter in Azure cloud and DevOps roles.

Compute#

Azure Virtual Machines#

IaaS virtual machines. Full control over OS, disk, and configuration. Azure VMs are grouped into series based on workload type.

VM series

Virtual Machine Scale Sets (VMSS)#

Automatically scale a group of identical VMs based on metrics or a schedule. Integrates with Azure Load Balancer and Application Gateway. Supports rolling upgrades and automatic OS patching.

Azure App Service#

Fully managed platform for web applications and APIs. Supports .NET, Java, Node.js, Python, PHP, and Ruby. Runs on Windows or Linux. Scale horizontally with auto-scale rules or vertically by changing the pricing tier. No OS management required.

App Service plan tiers: Free, Shared, Basic, Standard, Premium, Isolated (dedicated environment for compliance and performance).

AKS (Azure Kubernetes Service)#

Managed Kubernetes service. Azure manages the control plane at no charge. You manage agent node pools (or use Virtual Nodes for serverless burst capacity). Integrates with Entra ID for RBAC, Azure Monitor for observability, and Azure Container Registry for images.

Azure Container Apps#

Serverless container platform built on Kubernetes and KEDA (Kubernetes Event-Driven Autoscaling). Scales to zero. No Kubernetes knowledge required. Supports microservices, background processing, and event-driven workloads. Good choice when you want containers without managing Kubernetes directly.

Azure Functions#

Serverless function execution. Write a function; attach it to a trigger (HTTP, Timer, Service Bus, Event Hub, Blob, Cosmos DB, etc.).

Hosting plans

Storage#

Azure Blob Storage#

Object storage for unstructured data. Organise objects into containers within a storage account. Access via REST API, SDKs, or Azure Storage Explorer.

Blob access tiers

Lifecycle management policies can automatically move blobs between tiers based on age or last access time.

Azure Disk Storage#

Managed block storage for Azure VMs. Disks are created as standalone resources and attached to VMs.

Disk types

Azure Files#

Managed file shares accessible via SMB (Windows, Linux, macOS) and NFS (Linux). Mount directly on VMs or sync to on-premises servers using Azure File Sync. Good for shared application state, lift-and-shift of file servers, and persistent storage for containers.

Azure Data Lake Storage Gen2#

Azure Blob Storage with a hierarchical namespace enabled. Supports directory-level access control (ACLs), which is required for big data analytics workloads. Native integration with Azure Synapse Analytics, HDInsight, and Databricks.

Networking#

Virtual Network (VNet)#

Your private network in Azure. Similar to AWS VPC. Define address spaces, subnets, and routing rules. VNets are regional resources.

NSG (Network Security Group)#

Stateful firewall applied to a subnet or network interface. Define inbound and outbound rules based on source/destination IP, port, and protocol. Priority-based — lower priority number = evaluated first.

Load Balancing Services#

Connectivity#

Database#

Azure SQL Database#

Managed SQL Server as a service. Choose from single database, elastic pool (shared resources across databases), or managed instance (near-full SQL Server compatibility for migrations). Serverless tier automatically pauses and resumes. Built-in intelligence for automatic performance tuning.

Azure Cosmos DB#

Globally distributed, multi-model NoSQL database. Distribute data across any number of Azure regions with single-digit millisecond reads and writes. Multiple API options:

Choose the MongoDB API when migrating a MongoDB workload; choose the native NoSQL API for new projects.

Azure Database for PostgreSQL / MySQL#

Managed open-source relational databases. Flexible Server deployment provides zone-redundant HA, point-in-time restore, and configurable maintenance windows.

Azure Synapse Analytics#

Unified analytics platform combining a data warehouse (formerly SQL Data Warehouse), Apache Spark, and data integration (Pipelines). Query data in Azure Data Lake Storage Gen2 without loading it. Use when you need a single workspace for both data engineering and BI.

Azure Cache for Redis#

Managed Redis. Use for session caching, data caching, leaderboards, and message brokering. Supports Redis Cluster for higher throughput. Enterprise tier supports Redis modules (RediSearch, RedisBloom, RedisTimeSeries).

Identity#

Microsoft Entra ID#

Formerly Azure Active Directory. The cloud identity platform for Microsoft 365 and Azure. Every Azure subscription has a linked Entra tenant. Provides authentication (OAuth 2.0, OIDC, SAML), authorisation (RBAC), and directory services.

Entra ID is not a domain controller — it is a cloud identity provider. For traditional Active Directory features (Kerberos, LDAP, Group Policy), use Azure Active Directory Domain Services (Entra Domain Services).

Managed Identities#

Allow Azure resources (VMs, App Service, Functions, AKS pods) to authenticate to other Azure services without any credentials in code. Two types:

• System-assigned: tied to the lifecycle of the resource; deleted when the resource is deleted
• User-assigned: standalone identity; can be assigned to multiple resources

Azure RBAC#

Role-based access control on Azure resources. Assign roles (Owner, Contributor, Reader, or custom roles) to a principal (user, group, service principal, or managed identity) at a scope (management group, subscription, resource group, or resource).

Entra ID Conditional Access#

Policy-based access control. Define conditions (user location, device compliance, application being accessed, sign-in risk level) and grant or block access accordingly. Requires Entra ID P1 or P2 licences.

Security#

Serverless and Integration Services#

Monitoring and Observability#

KQL quick example — query application errors in the last 24 hours:

requests
| where timestamp > ago(24h)
| where success == false
| summarize count() by resultCode, bin(timestamp, 1h)
| order by timestamp desc

Azure Certification Path#

For most engineers entering Azure roles, AZ-900 followed by AZ-104 is the standard path. Developers often choose AZ-204 instead of AZ-104.