Azure — Cheat Sheet

Tags: azure, cloud, compute, networking, security, storage, devops

Level: intermediate

TL;DR: Core Azure architecture, resource hierarchy, identity model, serverless computing, and enterprise networking patterns for technical interviews.

Key concepts

Resource hierarchy: Management Groups contain Subscriptions, which contain Resource Groups, which contain individual resources.

Resource Groups are logical containers sharing lifecycle, permissions, and deployment boundaries.

Azure Resource Manager (ARM) provides declarative deployments via ARM templates and Bicep.

Microsoft Entra ID manages authentication, identity federation, conditional access, and role-based access control.

Azure RBAC controls control-plane access; data plane access often requires separate role assignments or access keys.

App Service hosts managed web apps with built-in autoscaling, deployment slots, and TLS termination.

Azure Functions provides serverless execution with consumption, premium, and dedicated hosting plans.

Virtual Networks (VNets) isolate compute workloads, segmented with subnets and filtered via Network Security Groups (NSGs).

Private Endpoints connect PaaS services securely inside a VNet, avoiding public internet exposure.

Storage Accounts offer Blob, Queue, Table, and File storage with configurable redundancy: LRS, ZRS, GRS.

Typical questions and ready answers

Q: How do you structure access control and governance across multiple Azure subscriptions?R: I structure management groups mapped to business units or environments, enforce baseline policies via Azure Policy, and assign RBAC roles at the management group or subscription level using least-privilege principles.

Q: What is the difference between Azure App Service deployment slots and a full redeploy?R: Deployment slots allow deploying to a warm staging environment for validation and automated warm-up before performing an instant, zero-downtime traffic swap with production.

Q: When would you choose Azure Functions over Azure Container Apps?R: I choose Azure Functions for event-driven, trigger-based micro-tasks with rapid bursts; I choose Container Apps for long-running microservices, custom runtimes, or complex background workers.

Q: How do you secure communications between Azure App Service and Azure SQL?R: I use VNet integration on App Service, enable a Private Endpoint on Azure SQL, and authenticate using System-Assigned Managed Identity rather than connection strings with secrets.

Pitfalls and common mistakes

Storing secrets or database connection strings in App Service configuration instead of Azure Key Vault.

Using standard public endpoints with IP whitelisting instead of VNet integration and Private Endpoints.

Confusing Microsoft Entra ID tenant administrators with Azure subscription RBAC Owners.

Forgetting that deleting a Resource Group irreversibly deletes every child resource nested inside it.

Neglecting cold starts on consumption-tier Azure Functions for latency-sensitive HTTP APIs.

Omitting diagnostic settings forwarding to Log Analytics workspaces, losing critical application telemetry.

Snippets and commands

# Log in and set active subscription
az login
az account set --subscription "MySubscriptionId"

# Create a resource group
az group create --name rg-production-westeurope --location westeurope

# Deploy a Bicep template
az deployment group create \
  --resource-group rg-production-westeurope \
  --template-file main.bicep \
  --parameters environment=prod

# Query resources using JMESPath
az resource list --resource-group rg-production-westeurope --query "[].{Name:name, Type:type}" -o table

Snippet di codice

// Sample Bicep module for secure App Service with Managed Identity
param location string = resourceGroup().location
param appName string

resource appServicePlan 'Microsoft.Web/serverfarms@2022-09-01' = {
  name: 'plan-${appName}'
  location: location
  sku: {
    name: 'P1v3'
    tier: 'PremiumV3'
  }
}

resource webApp 'Microsoft.Web/sites@2022-09-01' = {
  name: 'app-${appName}'
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
  }
}

To review

[ ] Azure Front Door vs Application Gateway routing capabilities

[ ] Bicep module composition and registry publishing

[ ] Private DNS zone resolution mechanics with Private Endpoints

[x] Azure Resource Manager lifecycle and tagging strategies

[x] Managed Identities (System-assigned vs User-assigned)

Jarvis Interviews
Jarvis