Azure Tutorial with Examples.
Microsoft Azure tutorial: Virtual Machines, AKS, Azure Functions, Entra ID, Blob Storage and the wider Microsoft cloud ecosystem.
Architecture at a glance
Click any box to open the lesson that teaches it
Azure architecture at a glance
az CLI → Entra ID → VNet → VMs / Functions → Blob / SQL, watched by Monitor
How it fits together (5 steps)
- Every call starts from the az CLI, confirmed against the right subscription before anything runs, inside a resource group that holds everything created below so it can be deleted as one unit.
- That call only works as far as its Entra ID role assignment allows: a role scoped to the wrong resource group gets a real authorization error until the scope is fixed — RBAC roles are separate from Entra ID's own identity-management roles.
- Compute lives inside a VNet, where a subnet's NSG has to allow a port before anything reaches it, independently of what the VM's own NSG allows. VMs run a server you SSH into once port 22 is open; Functions run the same kind of code with no server to manage, at the cost of a cold start on the first invocation.
- Both call the data layer: Blob Storage holds objects in a container across hot, cool and archive tiers, and Azure SQL runs a managed database you can restore to a point in time.
- Two services wrap the whole stack: Bicep and ARM templates deploy every resource above as one declarative file that validates before anything is created, and Azure Monitor collects the metrics and KQL-queried logs that watch it while it runs. Cost Management and the Well-Architected Framework's five pillars are the last check before calling it production-ready.
Beginner
Start here — no prior experience needed
Introduction to Azure
Understand Azure's subscription and resource-group model, then log in with the CLI and confirm which subscription your commands will actually hit.
Entra ID: Users, Roles, and RBAC
Create a role assignment scoped too narrowly, hit a real authorization error, then fix the scope and watch the same command succeed.
Azure Virtual Machines Fundamentals
Create a Linux VM with az vm create, open port 22 through its network security group, and connect over SSH using the generated key pair.
Azure Blob Storage Fundamentals
Create a storage account and container, upload and download a blob with az storage blob, and compare hot, cool, and archive access tiers.
Intermediate
For developers with core concepts down
Azure Virtual Network Basics
Build a VNet with two subnets, apply an NSG, then walk the exact debugging sequence for a VM that can't reach the internet.
Azure SQL Basics
Provision an Azure SQL Database and logical server, connect with sqlcmd past a firewall error, then restore to a point in time after a bad delete.
Azure Functions Fundamentals
Write an HTTP-triggered function, deploy it with func and az functionapp, invoke it twice, and see the timing gap between cold start and a warm call.
Bicep and ARM Templates Basics
Write a minimal Bicep file, deploy it with az deployment group create, then read the exact error output from a deployment that fails validation.
Azure Monitor Basics
Read a VM's CPU metrics, query its logs with Kusto (KQL) in Log Analytics, and wire both into an alert rule that fires on a real threshold breach.
Azure Cosmos DB: Items and Partition Keys
Create a Cosmos DB container with a partition key, upsert items into it, and read one back with the Python SDK against the official vNext emulator — then see why reading with the wrong partition key 404s instead of finding the item a different way.
Azure Cosmos DB: Queries
Run a parameterised SQL query and a cross-partition aggregate against Cosmos DB's vNext emulator with the Python SDK, and find enable_cross_partition_query is never enforced client-side — it's just a request option the server acts on.
Azure Cosmos DB: ETags and Patch
Patch a Cosmos DB item atomically with the Python SDK, then see what an optimistic-concurrency replace actually does: a stale ETag raises a 412, and the fix is reading the item's current ETag again before retrying, not just resubmitting the same write.
Azure Service Bus: Queues and Settlement
Send and receive messages through an Azure Service Bus queue with the Python SDK against the official Service Bus Emulator in Docker, and see what complete_message actually does: a message a reader already received doesn't come back on the next receive.
Azure Service Bus: Dead-Lettering
Reject a bad message into Azure Service Bus's dead-letter queue with the Python SDK against the official emulator, and read it back from the DLQ with the reason attached — a message a consumer actively rejects, not one that silently vanished.
Azure Service Bus: Topics and Filters
Publish one message to an Azure Service Bus topic and see it fan out to two subscriptions with the Python SDK against the official emulator — then find out a SQL filter matches application properties, not whatever's inside the message body.
Azure Key Vault: Secrets and Versions
Store and read Key Vault secrets with the Python SDK against the Lowkey Vault emulator: every set_secret call creates a new version rather than overwriting, get_secret without a version returns the newest one, and a stale version id raises a 404.
Azure Key Vault: Soft-Delete and Recovery
Delete a Key Vault secret against Lowkey Vault: get_secret 404s immediately, but the secret stays recoverable in a deleted-items list until purge_deleted_secret removes it — which purge protection can block even in the emulator.
Advanced
Production-grade patterns for experienced engineers
Azure Cost Management Basics
Break down spend with az costmanagement, weigh real pay-as-you-go vs. reserved instance pricing for one VM size, and skim the Well-Architected cost pillar.
Azure Cosmos DB: Change Feed
Read a Cosmos DB container's change feed from the beginning with the Python SDK against the vNext emulator, save its continuation token, make another write, and resume from the token to see only that one new change.
Also part of Azure
Taught in other topics. Each link opens the lesson in its home topic.
Dead-Letter Queues: What Happens When Retries Keep Failing
A consumer retrying a poison message forever wastes work on something that will never succeed — route it to a dead-letter queue, then replay once fixed.
Idempotent Consumers: Surviving a Duplicate Delivery
The outbox pattern can deliver the same event twice; a consumer that tracks processed event IDs stays correct even when it does.
Envelope Encryption and Key Rotation Without Re-encrypting Data
Encrypt data once with a data key, wrap that key with a KEK, rotate the KEK by re-wrapping 32 bytes, and rotate Fernet tokens with MultiFernet in Python.
Deployments and Rollouts
Learn how Deployments manage replica sets, rolling updates, rollbacks, and rollout strategies in Kubernetes.
Services and Networking
Put a real backend behind ClusterIP, NodePort and LoadBalancer Services, then trace DNS across namespaces, EndpointSlices and headless Services.