Domain 2: Architecture and Services
Domain 2 of 3, and the largest at 35 to 40 percent. It is broad: architecture, compute, networking, storage, and identity. Focus on "which service would you use when," not just names.
Core architectural components
Regions, region pairs, and availability zones
- A region is a set of datacenters in one geographic area (for example, West Europe). You deploy resources into a region.
- A region pair is two regions in the same geography (usually 300 or more miles apart) that Azure links for resilience. Updates roll out to one at a time, and some services replicate to the pair for disaster recovery.
- Availability zones are physically separate datacenters within a single region, each with independent power, cooling, and networking. Spreading resources across zones protects an app from a datacenter failure.
- Sovereign regions are isolated instances of Azure (for example, Azure Government or Azure China) for specific compliance needs.
Management hierarchy (top to bottom)
- Management groups: containers to organize multiple subscriptions and apply governance (like policy) across them.
- Subscriptions: a billing and access boundary that holds resources. Costs are reported and limits are applied per subscription.
- Resource groups: logical containers that hold related resources for an application. A resource lives in exactly one resource group, and deleting the group deletes everything in it.
- Resources: the individual services you create, such as a VM, a database, or a storage account.
Azure Resource Manager (ARM) is the deployment and management layer that all requests pass through, whether from the portal, CLI, PowerShell, or templates. It enforces access control and lets you deploy resources together as a group using ARM templates (infrastructure as code).
Compute services
- Virtual Machines (VMs): IaaS, full control over the OS. Use when you need a specific configuration or to lift and shift a server.
- Virtual Machine Scale Sets: a group of identical, load balanced VMs that scale automatically with demand.
- Availability sets: spread VMs across fault and update domains inside a datacenter to avoid downtime from hardware failure or maintenance.
- Azure App Service: PaaS for hosting web apps, APIs, and mobile backends without managing servers, with built in scaling and deployment.
- Azure Container Instances (ACI): run a single container quickly, serverless, without managing infrastructure.
- Azure Kubernetes Service (AKS): managed Kubernetes for orchestrating many containers at scale.
- Azure Functions: serverless, event driven code that runs on demand, and you pay only while it runs.
- Azure Virtual Desktop: a full desktop and app virtualization service running in Azure, delivered to any device.
Rule of thumb: VM for full control, App Service for web apps, Containers to package and scale, Functions for small event driven tasks.
What a virtual machine needs
When you create a VM, Azure also creates or attaches the resources it depends on: a size (how much CPU and memory), an operating system disk and optional data disks, a network interface, a virtual network and subnet, an optional public IP address, and a network security group that controls what traffic is allowed in and out.
Choosing where to host an application
- Virtual Machines: full control of the OS and installed software, and the most responsibility.
- Containers (ACI or AKS): package the app with its dependencies so it runs the same anywhere, and scale it easily.
- App Service (web apps): managed hosting for web apps and APIs with the least infrastructure to manage.
Networking services
- Virtual Network (VNet): your private network in Azure, divided into subnets, where your resources communicate securely.
- VNet peering: connect two VNets so they communicate as one network.
- VPN Gateway: an encrypted connection between your on-premises network and Azure over the public internet.
- ExpressRoute: a private, dedicated connection to Azure that does not go over the public internet, for higher reliability and speed.
- Azure DNS: hosting for your DNS domains, resolving names to IP addresses on Azure infrastructure.
- Public and private endpoints: a public endpoint is reachable over the internet, while a private endpoint gives a service a private IP address inside your virtual network so its traffic stays on the Azure backbone and never touches the public internet.
- Load balancing distributes traffic across resources for availability and performance.
VPN Gateway goes over the internet and is encrypted, ExpressRoute is a private line that does not. That contrast is a common exam point.
Storage services
Everything lives in a storage account. The main data services are: - Blob storage: massive amounts of unstructured data such as images, video, backups, and logs. - Azure Files: fully managed file shares you can mount like a network drive. - Queue storage: messages between application components. - Table storage: large amounts of structured, non relational (NoSQL) data. - Disk storage: virtual disks attached to VMs.
Storage account types
Most data lives in a general purpose v2 account, which supports blobs, files, queues, and tables. Performance comes in two tiers: Standard (on hard disks, for most workloads) and Premium (on solid state disks, for low latency needs such as busy databases).
Blob access tiers (by how often you read the data)
| Tier | Use for | Cost profile |
|---|---|---|
| Hot | Frequently accessed data | Higher storage cost, lowest access cost |
| Cool | Infrequently accessed, kept 30+ days | Lower storage, higher access cost |
| Cold | Rarely accessed, kept 90+ days | Even lower storage, higher access cost |
| Archive | Rarely accessed, offline, kept 180+ days | Lowest storage, highest access and retrieval time |
Redundancy (how many copies, and where)
- LRS (Locally redundant): three copies in one datacenter. Cheapest, least resilient.
- ZRS (Zone redundant): copies across availability zones in one region.
- GRS (Geo redundant): LRS in your region plus a copy in the paired region.
- GZRS (Geo zone redundant): ZRS in your region plus a copy in the paired region. Most resilient.
Moving data into Azure
- AzCopy: command line tool to copy data to and from storage.
- Azure Storage Explorer: a graphical app to manage storage.
- Azure File Sync: centralize file shares in Azure while keeping local access.
- Azure Migrate: assess and migrate servers, databases, and apps to Azure.
- Azure Data Box: a physical appliance Microsoft ships to you for moving very large amounts of data offline.
Identity, access, and security
- Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud identity and access service. It manages users, groups, and sign in to Azure and thousands of apps.
- Authentication proves who you are. Authorization decides what you are allowed to do. Authentication first, then authorization.
- Single sign on (SSO): sign in once and access many applications.
- Multi factor authentication (MFA): require more than one proof of identity, such as a password plus a code on your phone.
- Passwordless authentication: sign in without a password using something you have and something you are, such as Windows Hello, the Microsoft Authenticator app, or a security key. It is both more secure and more convenient than a password.
- Conditional Access: apply sign in rules based on signals like user, location, device, and risk (for example, require MFA from outside the office).
- Microsoft Entra ID vs Active Directory Domain Services (AD DS): Entra ID is cloud based and built for web and modern apps, AD DS is the traditional on-premises directory. They are not the same, and are often connected in a hybrid setup.
- Microsoft Entra Domain Services: managed domain services in Azure (such as domain join and group policy) without you having to build and patch your own domain controllers.
- External identities: let guests and partners (B2B) or customers (B2C) sign in.
Role based access control (RBAC)
RBAC grants the least privilege each person needs by assigning roles at a scope (management group, subscription, resource group, or resource). A role plus a person plus a scope makes a role assignment, and access inherits down the hierarchy.
Zero Trust and defense in depth
- Zero Trust: never trust automatically, always verify every request, and assume breach.
- Defense in depth: layer protections (identity, network, compute, application, data) so if one fails the next holds.
- Microsoft Defender for Cloud: monitors your security posture, gives a secure score, and protects workloads across Azure, on-premises, and other clouds.
Domain 2 quick recap
- Hierarchy: management groups hold subscriptions, which hold resource groups, which hold resources, all through Azure Resource Manager.
- Regions group datacenters, availability zones protect within a region, region pairs protect across regions.
- Compute: VM for control, App Service for web apps, containers to scale, Functions for events.
- VPN Gateway is encrypted over the internet, ExpressRoute is a private line.
- Storage tiers trade storage cost for access cost, redundancy trades cost for resilience (LRS to GZRS).
- Entra ID handles identity, MFA and Conditional Access strengthen sign in, RBAC grants least privilege at a scope.