This Azure tutorial introduces Microsoft Azure, its core cloud concepts, commonly used services, resource hierarchy, management tools, security controls, pricing considerations, and a practical learning path for beginners. It is intended for developers, administrators, DevOps engineers, students, and anyone learning how applications and infrastructure are deployed in Azure.

What is Microsoft Azure?

Microsoft Azure is a cloud computing platform for building, deploying, and managing applications and infrastructure. It provides services for compute, storage, databases, networking, analytics, artificial intelligence, security, identity, integration, Internet of Things, and application development.

Instead of purchasing and maintaining all hardware locally, an organization can provision Azure resources when required and pay according to the selected service, configuration, and usage. Azure can also be integrated with on-premises infrastructure to create hybrid environments.

Azure cloud service models: IaaS, PaaS, and SaaS

Azure services are commonly understood through three cloud service models. The main difference is how much of the technology stack is managed by the customer and how much is managed by the cloud provider.

Service modelWhat it providesCustomer responsibilityAzure examples
Infrastructure as a Service (IaaS)Virtualized compute, storage, and networkingOperating system, applications, data, and many configuration tasksAzure Virtual Machines and Azure Virtual Network
Platform as a Service (PaaS)Managed application or database platformApplication code, data, and service configurationAzure App Service and Azure SQL Database
Software as a Service (SaaS)Complete software delivered over the internetUser access, data usage, and application-level settingsMicrosoft-hosted business applications

Managed services generally reduce infrastructure administration, but they do not remove the customer’s responsibility for application security, access control, data protection, monitoring, and appropriate configuration.

Public, private, and hybrid cloud deployment models

  • Public cloud: Applications and resources run on infrastructure operated by a cloud provider and shared securely among customers.
  • Private cloud: Cloud-style infrastructure is dedicated to one organization, often in its own datacenter or a hosted environment.
  • Hybrid cloud: On-premises or private-cloud systems are connected to public-cloud services.
  • Multicloud: An organization uses services from more than one cloud provider.

The appropriate model depends on workload requirements, existing systems, compliance obligations, latency, operational skills, and cost.

Azure regions, availability zones, and datacenters

An Azure region is a geographic area containing one or more datacenters connected through high-capacity, low-latency networking. When creating many Azure resources, you select a region in which the resource will operate.

An availability zone is a separated group of datacenters within an Azure region. Supported services can use multiple zones to reduce the effect of a datacenter or zone-level failure. Zone availability and implementation differ by region, service, tier, and resource type, so they must be checked before designing a workload.

  • Region: Geographic deployment location for Azure resources.
  • Availability zone: Physically separated datacenter grouping within a supported region.
  • Region pair: A relationship used by some Azure regions and services for platform resiliency and recovery planning.
  • Geography: A broader data-residency boundary containing one or more regions.

Choosing a nearby region can reduce latency, but location is only one factor. Check service availability, data-residency requirements, pricing, zone support, connectivity, and disaster-recovery needs.

Azure resource hierarchy and organization

Azure uses a hierarchy to organize resources and apply access, policy, billing, and governance controls.

LevelPurpose
Management groupOrganizes multiple subscriptions and allows governance controls to be inherited by subscriptions below it.
SubscriptionProvides a billing, access, quota, and management boundary for Azure resources.
Resource groupLogical container for resources that are managed together.
ResourceAn individual service instance, such as a virtual machine, storage account, database, or virtual network.

A common hierarchy is:

</>
Copy
Microsoft Entra tenant
└── Management group
    └── Subscription
        └── Resource group
            ├── Virtual machine
            ├── Storage account
            └── Virtual network

A resource belongs to one resource group at a time. A resource group may contain different resource types and resources from different regions, although a consistent organizational strategy usually makes administration easier.

Core Azure services for beginners

Azure contains many specialized services. Beginners should first understand the following categories and representative services.

Azure compute services

  • Azure Virtual Machines: Windows or Linux virtual machines with control over the operating system and installed software.
  • Azure App Service: Managed hosting for web applications and APIs.
  • Azure Functions: Event-driven code execution without managing a complete server environment.
  • Azure Kubernetes Service: Managed Kubernetes for orchestrating containerized applications.
  • Azure Container Apps: Managed environment for running containerized applications without administering Kubernetes directly.

Azure storage services

  • Blob Storage: Object storage for files, media, backups, logs, and application data.
  • Azure Files: Managed file shares accessible through supported file-sharing protocols.
  • Queue Storage: Message storage for communication between application components.
  • Table Storage: NoSQL key-value storage for structured, non-relational data.
  • Managed Disks: Persistent block storage used by Azure virtual machines.

Azure database services

  • Azure SQL Database: Managed relational database based on the SQL Server database engine.
  • Azure SQL Managed Instance: Managed SQL environment with broader SQL Server compatibility requirements.
  • Azure Database for PostgreSQL: Managed PostgreSQL database service.
  • Azure Cosmos DB: Distributed NoSQL database service supporting globally distributed application patterns.

Azure networking services

  • Azure Virtual Network: Private network boundary for Azure resources.
  • Network Security Group: Inbound and outbound traffic filtering rules for supported network interfaces and subnets.
  • Azure Load Balancer: Layer 4 load distribution for supported TCP and UDP workloads.
  • Azure Application Gateway: Web traffic load balancing with application-layer capabilities.
  • Azure VPN Gateway: Encrypted connectivity between Azure networks, on-premises networks, or remote clients.
  • Azure ExpressRoute: Private connectivity between an organization’s network and Microsoft cloud services through a connectivity provider.
  • Azure DNS: DNS domain and record hosting on Azure infrastructure.

Azure identity, security, and monitoring services

  • Microsoft Entra ID: Cloud identity and access management for users, applications, and service identities.
  • Azure role-based access control: Authorization system used to grant specific actions at selected Azure scopes.
  • Azure Key Vault: Managed storage for secrets, certificates, and cryptographic keys.
  • Azure Monitor: Monitoring platform for metrics, logs, alerts, and application or infrastructure telemetry.
  • Microsoft Defender for Cloud: Security posture management and workload-protection capabilities for supported environments.
  • Microsoft Sentinel: Cloud-based security information and event management and security orchestration platform.

Azure Portal, CLI, PowerShell, and ARM tools

Azure resources can be managed through graphical, command-line, API, and infrastructure-as-code tools.

Management toolTypical use
Azure PortalBrowser-based creation, configuration, monitoring, and troubleshooting.
Azure CLICross-platform commands, shell scripts, and automation.
Azure PowerShellPowerShell-based administration and automation.
Azure Cloud ShellBrowser-accessible shell environment with Azure management tools.
ARM templatesDeclarative JSON-based Azure Resource Manager deployments.
BicepDeclarative Azure infrastructure language compiled into ARM templates.
Azure SDKsProgrammatic resource and service access from supported languages.

Create and inspect an Azure resource group with Azure CLI

The following example signs in, lists available locations, creates a resource group, and displays its details. Replace the example resource group and location with values appropriate for your subscription.

</>
Copy
az login
az account show
az account list-locations --output table
az group create --name tutorial-rg --location centralindia
az group show --name tutorial-rg --output table

When the practice resource group is no longer needed, it can be deleted with the resources it contains:

</>
Copy
az group delete --name tutorial-rg --yes --no-wait

Deletion is destructive. Confirm that the resource group contains no required resources before running this command.

Create an Azure storage account with Azure CLI

This example creates a general-purpose storage account in the resource group. Storage account names must meet Azure naming rules and must be globally unique, so change the placeholder name before running the command.

</>
Copy
az storage account create \
  --name uniquetutorialstorage123 \
  --resource-group tutorial-rg \
  --location centralindia \
  --sku Standard_LRS \
  --kind StorageV2

After creating the account, inspect its properties:

</>
Copy
az storage account show \
  --name uniquetutorialstorage123 \
  --resource-group tutorial-rg \
  --output table

Azure Resource Manager and infrastructure as code

Azure Resource Manager is the deployment and management layer used for Azure resources. Requests from the portal, CLI, PowerShell, SDKs, Bicep, and ARM templates are processed through this management layer.

Infrastructure as code stores resource definitions in source-controlled files. This makes deployments easier to review, reproduce, test, and automate than relying only on manual portal changes.

The following Bicep example defines a storage account. The generated name includes the resource group’s unique identifier to reduce naming conflicts.

</>
Copy
param location string = resourceGroup().location

resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: 'st${uniqueString(resourceGroup().id)}'
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
  }
}

output storageAccountName string = storage.name

Deploy the Bicep file with Azure CLI:

</>
Copy
az deployment group create \
  --resource-group tutorial-rg \
  --template-file main.bicep

Azure identity and role-based access control

Authentication confirms an identity, while authorization determines what that identity can do. Azure commonly uses Microsoft Entra ID for authentication and Azure role-based access control for authorization.

An Azure role assignment consists of three main parts:

  1. Security principal: The user, group, managed identity, or service principal receiving access.
  2. Role definition: The set of permitted actions, such as Reader, Contributor, or a more specialized role.
  3. Scope: The management group, subscription, resource group, or resource where the access applies.

Apply least privilege by granting only the permissions required and by choosing the narrowest practical scope. Avoid assigning broad administrative roles merely to resolve an access problem.

Azure security responsibilities beginners should understand

Cloud security follows a shared-responsibility model. Microsoft protects the physical datacenters and underlying cloud infrastructure, while customers remain responsible for areas such as their identities, data, application code, access assignments, network rules, and workload configuration. The exact division depends on whether the workload uses IaaS, PaaS, or SaaS.

  • Require multifactor authentication for privileged accounts.
  • Use separate identities rather than sharing administrator credentials.
  • Store application secrets in Azure Key Vault or another approved secret-management system.
  • Prefer managed identities when an Azure resource must access another Azure service.
  • Limit inbound network access and avoid exposing management ports unnecessarily.
  • Enable diagnostic logs, metrics, alerts, and activity monitoring.
  • Apply supported updates to virtual machines, containers, dependencies, and application frameworks.
  • Back up important data and test restoration procedures.

Azure pricing, budgets, and cost control

Azure charges depend on the service, region, tier, quantity, runtime, storage volume, transactions, outbound data transfer, licensing, and other configuration choices. A resource that appears small can still create continuing costs if it remains active.

  • Review the current Azure pricing page before deploying a service.
  • Use the Azure Pricing Calculator to estimate a proposed configuration.
  • Create budgets and cost alerts in Microsoft Cost Management.
  • Add tags such as project, environment, department, and owner.
  • Stop or deallocate eligible development resources when they are not needed.
  • Delete unused disks, public IP addresses, snapshots, gateways, databases, and test environments.
  • Review costs by subscription, resource group, service, location, and tag.
  • Do not assume that deleting an application automatically deletes every related resource.

Free-account offers, credits, service allowances, and eligibility rules can change. Confirm the current terms on the official Azure account options page before creating an account or relying on a free allowance.

A practical Azure learning path for beginners

The most effective learning sequence combines foundational study with small deployments. Reading service descriptions without creating and troubleshooting resources leaves important operational gaps.

  1. Learn cloud concepts: Understand public, private, and hybrid cloud; consumption-based pricing; scalability; availability; and IaaS, PaaS, and SaaS.
  2. Study Azure architecture: Learn regions, availability zones, resource groups, subscriptions, management groups, and Azure Resource Manager.
  3. Use the Azure Portal: Create a resource group and inspect deployments, activity logs, access control, tags, and costs.
  4. Learn Azure CLI or PowerShell: Repeat common portal operations from a terminal.
  5. Deploy a small project: Host a static site, deploy a basic web application, or create a storage-backed API.
  6. Add identity and networking: Configure role assignments, managed identity, virtual networking, and restricted access.
  7. Add monitoring: Review metrics and logs, create an alert, and test how the application responds to failure.
  8. Use infrastructure as code: Recreate the environment with Bicep, ARM templates, or another supported infrastructure tool.
  9. Review governance and cost: Add tags, budgets, policy controls, and a cleanup procedure.

Microsoft provides beginner learning paths and guided exercises through Microsoft Learn for Azure. Learners preparing for the Azure Fundamentals exam should also use the current official study guide because exam objectives can be revised.

Beginner Azure projects for hands-on practice

Practice projectAzure concepts covered
Host a static websiteStorage, content delivery, DNS, access configuration, and monitoring
Deploy a web APIApp Service or containers, application settings, identity, logs, and deployment
Create a virtual machine labCompute, disks, virtual networks, network security groups, and remote administration
Build an event-driven image processorBlob Storage, Azure Functions, events, permissions, and observability
Deploy a database-backed applicationManaged databases, connection security, backups, application configuration, and scaling
Rebuild a project using BicepInfrastructure as code, parameters, outputs, repeatable deployments, and source control

For each project, document how resources are created, secured, monitored, estimated for cost, and deleted. Cleanup is part of the exercise rather than an optional final step.

Common Azure beginner mistakes

  • Leaving test resources running: Development virtual machines, gateways, databases, disks, and public IP resources may continue to generate charges.
  • Using one resource group for everything: This makes ownership, access, lifecycle management, and cleanup harder.
  • Granting excessive permissions: Broad roles at subscription scope increase risk and make access reviews difficult.
  • Exposing services to the internet by default: Public endpoints and permissive firewall rules should be used only when required.
  • Storing credentials in code: Secrets committed to source control can remain exposed even after the original file is removed.
  • Ignoring region capabilities: Not every service, feature, tier, or availability-zone option is offered in every region.
  • Skipping monitoring: A deployed application is not operationally complete until failures, performance, and costs can be observed.
  • Learning only for an exam: Certification study should be reinforced with deployments, troubleshooting, and cleanup practice.

Azure tutorial editorial QA checklist

  • Verify that Azure service names match current Microsoft documentation.
  • Confirm that each CLI command uses supported parameters before publishing an update.
  • Check that example regions, SKUs, and API versions remain available.
  • Avoid stating fixed free-account credits, durations, or allowances without checking the current official offer.
  • Distinguish Microsoft Entra ID from Azure role-based access control and explain authentication separately from authorization.
  • Explain that availability-zone support varies by service, region, tier, and configuration.
  • Include resource cleanup instructions wherever a tutorial creates billable Azure resources.
  • Review security examples for least-privilege access and avoid publishing real credentials, keys, tenant IDs, or subscription IDs.

Frequently asked questions about Azure tutorials

What is the best way to learn Azure as a beginner?

Start with cloud concepts and Azure architecture, and then deploy small projects using the portal and Azure CLI. Add identity, networking, monitoring, cost controls, and infrastructure as code as your projects become more complete. Microsoft Learn provides official beginner modules and guided projects.

Do I need programming knowledge to learn Azure?

Programming is not required for introductory cloud concepts or basic administration. Developers need a programming language for application-focused work, while administrators benefit from command-line scripting, networking, operating-system, identity, and security knowledge.

Can I learn Azure without creating a paid subscription?

You can study concepts through Microsoft Learn and documentation without deploying paid resources. Some guided environments may provide temporary practice access, and eligible users may have access to current Azure account offers. Always review the official terms and monitor costs when using your own subscription.

Should beginners learn Azure Portal or Azure CLI first?

Use the Azure Portal first to understand resources, settings, deployments, access control, and monitoring. Then repeat the same tasks with Azure CLI or PowerShell. This connects visual understanding with repeatable administration and automation.

Is the AZ-900 certification required to work with Azure?

No. AZ-900 is a fundamentals certification and is not required to use Azure. Its syllabus can provide a structured introduction to cloud concepts, Azure architecture, services, management, and governance, but practical skills require hands-on work beyond exam preparation.

Official Azure learning and reference resources