Video summary

Azure Basics Tutorial

Main summary

Key takeaways

Educational

Main ideas, concepts, and lessons

Course overview (Azure Fundamentals)

  • The instructor introduces cloud computing as the delivery of computing services over the internet (servers, storage, databases, networking, plus software/analytics/intelligence).
  • Key motivations for using cloud:
    • Faster innovation and quicker time-to-market
    • Scalability to meet changing needs
    • Potential for lower costs and more efficient resource usage
  • The course focuses on Microsoft Azure for learners seeking basic cloud concepts and Azure services.
  • Encourages pausing for unfamiliar topics and using provided worksheets/exercises.

Module 1: Cloud Concepts

Learning objectives (stated at module start)

  • Explain why cloud services are beneficial.
  • Define cloud service models:
    • IaaS (Infrastructure as a Service)
    • PaaS (Platform as a Service)
    • SaaS (Software as a Service)
  • Distinguish public, private, and hybrid cloud deployment models.

“Why cloud services?” (benefits)

  1. Cost
    • Pay-as-you-go, only for what you use → lower operating costs
    • Better efficiency + ability to scale as business changes
  2. Quicker innovation / production
    • Test environments can be created quickly (weeks → days/weeks)
    • Releases can happen more frequently (including multiple updates per day)
  3. Modern resource capabilities
    • Cloud powers modern devices and services (examples: biometrics, smart home connectivity)
    • Nearly limitless pooled compute/storage/networking
    • On-demand access to cognitive services and near-real-time analytics telemetry
  4. Operational / reliability advantages
    • High availability with SLA options and minimal downtime
    • Scalability
      • Vertical: add RAM/CPU to a VM
      • Horizontal: add more instances/resources
    • Elasticity via autoscaling
    • Agility (rapid deployment/configuration)
    • Geodistribution for better performance near customers
    • Disaster recovery improvements via backups, replication, and geo-distribution
  5. Accounting model shift
    • Cloud costs are typically operational expenditure (OPEX) vs on-prem capital expenditure (CAPEX)

Cloud service models (IaaS, PaaS, SaaS)

Infrastructure as a Service (IaaS)

  • Most flexible: close to full control over underlying hardware (as a “rented data center”)
  • Provider maintains hardware; customer manages:
    • OS maintenance
    • Network configuration
  • Benefits:
    • No upfront CAPEX
    • Fast provisioning and deprovisioning
    • Shared responsibility model
    • Consumption-based billing (pay for what you use)
    • Provider helps ensure security/safety/high availability

Platform as a Service (PaaS)

  • Managed hosting environment
  • Provider manages:
    • Virtual machines and networking resources
  • Customer focuses on:
    • Deploying and supporting applications
  • Example: developers upload web apps to ready-to-use cloud servers
  • Unique benefits:
    • Access to cutting-edge dev tools across an app lifecycle
    • Provider handles many environment variables → higher productivity
    • Supports collaboration across geographically dispersed teams
  • Disadvantage:
    • Platform limitations may conflict with app requirements (needs vetting)

Software as a Service (SaaS)

  • Provider manages everything: hardware → OS → application → delivery to end users
  • Example: Microsoft Office 365
  • Primary limitation:
    • Usually cannot be customized for individual user special requests

Cloud deployment models (public, private, hybrid)

Public cloud

  • Services offered by third parties over the internet; available to anyone who can use/purchase
  • Often pay-on-demand (or free tiers)
  • Provider responsible for management/maintenance
  • Pros:
    • Faster deployment vs on-prem
    • Very scalable
    • Employees can access apps from any location via internet
  • Security note:
    • Security concerns exist, but when implemented correctly, can be as secure as well-managed private clouds

Private cloud

  • Services offered to select users (over internet or internal private network)
  • Also called internal/corporate clouds
  • Pros:
    • Similar advantages to public cloud (self-service, scalability, elasticity)
    • More controls/customizations using dedicated resources (often hosted on-prem)
    • Higher security/privacy via company firewalls and internal hosting
  • Cons:
    • Company still responsible for costs/accountability and must staff/manage/maintain similarly to data center ownership
  • Two service models that can be delivered in a private cloud:
    • IaaS: infrastructure resources as a service
    • PaaS: platforms from cloud-based apps up to enterprise-level apps

Hybrid cloud

  • Combines public + private cloud features
  • Organizations share data and applications between them
  • Organizations decide where apps run but take on added responsibilities for:
    • Security
    • Compliance
    • Legal requirements

Module 2: Core Azure Services

Learning objectives (stated at module start)

  • Understand core Azure architectural components
  • Understand core Azure services/products
  • Understand Azure management tools

Core Azure architectural components (organizational structure)

  • Azure is organized in four levels:
    1. Resources
    2. Resource groups
    3. Subscriptions
    4. Management groups

Resources

  • Instances of services you create (e.g., VMs, storage, SQL databases)

Resource groups

  • Containers for organizing and managing resources
  • If a resource group is deleted, contained resources are deleted too
  • Support:
    • Lifecycle management (e.g., group test resources then delete after testing)
    • Role-based access controls applied at the group level

Subscriptions

  • Group user accounts and created services
  • One Azure account can have one or many subscriptions
  • Used for organizing billing and access management policies
  • Limits exist for number of resources per subscription
  • Often structured by environment (dev/stage/prod) or org/billing needs

Management groups

  • Manage access policy and compliance across multiple subscriptions
  • Subscriptions under a management group inherit top-level conditions
  • Can form hierarchy reflecting organization policy/access needs
  • Examples described in a hierarchy diagram:
    • Root management group → HR/IT/Marketing management groups
    • Env-based subscriptions under each

Management group facts

  • Up to 10,000 groups in a directory
  • Management group hierarchy depth up to 6 layers
  • Each management group/subscription has only one parent but can have many children

Azure portal overview (navigation and tools)

  • Portal accessed at: https://portal.azure.com
  • Homepage shows common links:
    • Create resources, manage subscriptions, create SQL servers, VMs, management groups, etc.
  • Key portal capabilities mentioned:
    • Dashboards with charts/reports for VMs, app services, databases, monitoring, security status
    • All services categorized into areas like compute, networking, storage, apps
    • Service descriptions appear on hover/click (example: Azure VMware Solutions description)
    • Cloud Shell: run bash or PowerShell
    • Direct navigation to directories/subscriptions, notifications, settings
    • Help & support: service health, documentation, migration tools, quick start center, tickets
  • Search is available for services (example: Azure Active Directory)

Core Azure services/products (4 major categories)

  1. Compute
    • Virtual Machines (spin up servers on demand)
    • Virtual Desktops
    • Azure Web Apps (autoscaling web hosting without managing server hardware)
    • Container service using Kubernetes
  2. Storage
    • File storage (managed file shares via URL for most OS)
    • Disk storage (VM-like disks; SSD/HDD tiers)
    • Blob storage (unstructured object storage; containers to organize data)
  3. Databases
    • SQL databases / hosting SQL servers in the cloud
    • NoSQL with Cosmos DB (schemaless; API-based abstractions; MongoDB/Cassandra/Gremlin examples)
    • Cloud versions of open source DBs: PostgreSQL, MySQL
  4. Networking
    • Virtual networks (secure communication between VMs/web apps/databases and users/on-prem)
    • VPN gateways (encrypted tunnels; site-to-site / point-to-site / network-to-network)
    • ExpressRoute (private connection to Microsoft cloud; no public internet; improved reliability/speed/latency/security)

Example methodology: create and configure a VM as a web server

  • Navigate to Azure portal and open Virtual Machines
  • Select Create
  • Choose VM creation option: Azure Virtual Machine (example chosen)
  • Configure Basics
    • Select Subscription
    • Choose/create a Resource Group (example name: “class VM servers”)
    • Set Region (example: US East)
    • Set Availability/Redundancy (example: “no infrastructure redundancy required”)
    • Set Security (example: standard)
    • Choose Image (example: Windows Server 2019 Datacenter)
    • Set Instance type/size (example: 2 vCPUs, 8 GB RAM)
    • Configure username/password (example username: “Azure user”)
    • Configure Inbound port rules
      • Allow RDP (3389)
      • Allow HTTP (80)
  • Configure Networking
    • Verify inbound ports allow traffic on 80 and 3389
  • Configure Management
    • Disable boot diagnostics for the example
  • Click Review and create
    • Azure validates configuration and shows pricing estimate + warnings
    • Note: RDP open to the internet is flagged as testing-only
  • Click Create
    • Wait for deployment completion (check notifications)
  • Connect to the VM
    • Use Connect → RDP
    • Download RDP file, connect, enter credentials
    • Accept certificate warning if no certificate is configured
  • Turn the VM into a web server using PowerShell (admin)
    • Run PowerShell as administrator
    • Install IIS (example command described):
      • Install-WindowsFeature Web-Server -IncludeManagementTools
    • Wait for installation completion
    • Reconnect/refresh and validate the server serves web content
  • Test web availability
    • Copy the VM public IP
    • Open in browser to confirm IIS homepage loads (example IP given in subtitles)
  • Cleanup to avoid ongoing charges
    • Delete the resource group associated with the VM (deletes VM and related resources)

Management tools highlighted in Module 2

  • Azure portal (web portal) as primary UI
  • Mobile app to monitor health/status, alerts, diagnose issues, restart VMs, run commands
  • Command-line automation:
    • Bash / PowerShell (for scripts and repeatable tasks)
  • Serverless technologies:
    • Azure Functions: write a single function/method and chain functions
    • Azure Logic Apps: declarative workflow automation (no/low-code)
  • IoT offerings:
    • Azure IoT Hub (message hub)
    • Azure IoT Central (UI + management/monitoring on top of IoT Hub)
    • Azure Sphere (end-to-end secure IoT solution: hardware/software, secure comms, malicious activity monitoring)
  • AI/ML offerings:
    • Azure Machine Learning: train/evaluate predictive models and deploy as API endpoints
    • Azure Cognitive Services: pre-built models for vision/speech/language/reasoning, etc.
    • Azure Bot Service: virtual agents that answer/respond
  • DevOps/Agile tools:
    • Azure DevOps: user stories, boards, GitHub integration
  • Monitoring and advisory:
    • Azure Advisor: recommendations to improve reliability/security/performance and reduce costs
    • Azure Monitor: collect/analyze/visualize metrics/logs across Azure + on-prem; possibly take actions
    • Azure Service Health: personalized service health view (issues, planned maintenance, advisories)

Module 3: Security, Privacy, Compliance, and Trust

Learning objectives (stated at module start)

  • Know Azure security tools/features
  • Secure network connectivity in Azure
  • Explain core identity services
  • Understand governance methodologies/tools
  • Know where to find privacy/compliance/data protection documentation

Security tools/features mentioned

  • Microsoft Defender
    • Monitoring service for security policies/controls
    • Predict/prevent/respond to threats
    • Uses ML to analyze environment and recommend improvements
  • Microsoft Sentinel
    • SIEM that aggregates security data across cloud and on-prem
    • Uses AI and analytics/custom rules for detection/investigation
    • Generates alerts for action/ignore
  • Azure Key Vault
    • Centralized storage for sensitive app information (passwords, encryption keys, certificates)
    • Access control + logging
    • Integrates with Azure services to securely reference secrets
  • Azure Dedicated Host
    • Physical servers in provider datacenters for regulatory scenarios where customers need exclusive server use
    • Supports host groups for more capacity

Defense-in-depth strategy (layered protection)

Layers described (outer → inner):

  1. Physical security layer
  2. Identity and access layer
  3. Perimeter layer (DDoS protection/filtering)
  4. Network layer (segmentation + access controls)
  5. Compute layer (secure VM access; malware and configuration protection)
  6. Application layer (reduce vulnerabilities)
  7. Data layer (protect business/customer data; central target)

Network security tools: NSG and Azure Firewall + DDoS tiers

Network Security Groups (NSGs)

  • Act like internal firewalls inside a VNet
  • Configure inbound/outbound rules filtering by:
    • source/destination IP
    • port
    • protocol

Azure Firewall

  • Stateful firewall (context of full connection vs individual packets)
  • Features: high availability, scalability, inbound/outbound rules, DNAT support, Azure Monitor logging

Azure DDoS protection tiers

  • Basic: free enablement to protect Azure infrastructure
  • Standard: extra mitigation tuned for Azure VNets

Example methodology: secure VM connectivity with NSGs

  • Initial state: VM network interface has no NSGs, so inbound traffic rules effectively deny access
  • Attempt RDP via public IP:
    • Connection fails with “remote access not enabled / cannot connect” style error
  • Create an NSG
    • Go to Network Security Groups
    • Create new NSG in same resource group
    • Example name: “my NSG secure”
    • Default behavior includes “deny all inbound” with limited allowed rules (e.g., allow within VNet, allow load balancer probes)
  • Associate NSG to VM’s network interface
    • Find the VM’s NIC and link it via “associate”
  • Verify NSG rules on VM networking tab now reference the NSG
  • Add inbound rule for RDP
    • Add inbound port rule:
      • Service: RDP (port 3389, TCP)
      • Action: Allow
      • Priority set higher than deny/other rules (example: priority 300)
    • Name the rule (example: “allow RDP”)
  • Retry RDP connection
    • RDP now succeeds (certificate warning may still appear)
  • Example experiment: verify outbound to internet
    • Open browser (Internet Explorer) to Bing works initially
  • Modify NSG outbound to block internet access
    • Add outbound rule:
      • Destination service tag: Internet
      • Action: Deny
      • Destination ports: any
      • Protocol: TCP any
      • Priority: high number (example: 4000)
    • Name example: “deny internet”
  • Retest:
    • Bing and Google fail to load, confirming outbound blocking
  • Reminder:
    • Delete resources afterward to avoid charges

Identity services and governance tools

  • Azure Active Directory (Azure AD)
    • Cloud IAM for user accounts
    • Features: Multi-factor authentication (MFA), conditional access
  • Authentication vs authorization
    • Authentication: verifying identity (credentials)
    • MFA: adds a second factor (code via email/phone/auth app)
    • Authorization: permissions/role-based access
  • Authorization via RBAC
    • Role-based access controls
    • Applied at various scopes:
      • management groups
      • subscriptions
      • resource groups
      • individual resources
  • Single Sign-On (SSO)
    • Sign in once to access multiple apps/resources
  • Governance strategy tooling
    • Cloud Adoption Framework for Azure
      • Steps: define strategy → plan → ready organization → adopt cloud → govern/manage
    • Resource locks
      • “Cannot delete” and “Read-only” lock levels to prevent accidental deletion
    • Tags
      • Organize resources by scripts/templates/REST/portal
    • Azure Policy
      • Define/assign/evaluate compliance rules
      • Can audit existing resources and prevent noncompliant new ones
      • Steps: define → assign → evaluate
    • Azure Blueprints
      • Repeatable governance sets across subscriptions
      • Orchestrate deployment of:
        • templates/artefacts
        • role assignments
        • policy assignments
        • ARM templates
        • resource groups

Privacy/compliance documentation

  • Microsoft provides documentation for privacy policy, licensing, customer agreements, compliance offerings, and audit reports.
  • Example given: healthcare and HIPAA/HIT-related standard (“HIPPO” mentioned in subtitles) via a compliance portal.

Module 4: Azure Pricing and Support

Learning objectives (stated at module start)

  • Explain subscription types
  • Plan/manage costs
  • Support options
  • Explain SLAs and service lifecycle and their organizational impact

Azure subscription types and purchasing options

  • Free trial
    • 12 months access to 25 free services
    • Credit to explore any Azure service for 30 days
    • Services disabled after trial unless upgraded
  • Pay-as-you-go
    • Attach credit/debit card and pay for usage
    • Volume discounts and prepaid invoicing possible
  • Reduced rates / credits for existing Microsoft ecosystems:
    • Visual Studio subscribers
    • Microsoft Partner Network
    • Microsoft for Startups
    • Microsoft Imagine
  • Purchasing methods
    1. Enterprise Agreement (3-year commitment for enterprise customers; best customized pricing)
    2. Web direct (purchase in Azure portal; monthly payment)
    3. Cloud solution provider (Microsoft partner bills and handles support)

Cost planning and cost management (what affects cost + tools)

Factors affecting cost

  • Resource type and configuration (storage type/performance/tier/access tier)
  • Resource usage (Azure meters track usage)
    • Deallocating a VM stops compute charges, but storage may still incur cost
  • Region/zone selection (pricing varies by location)

Tools

  • (Not included in the provided summary beyond the header “Tools”)

Original video