Building and running applications on Azure: compute, storage, secrets, identity, messaging and observability, and wiring them together from code.

Services at a glance

Compute is in 2. Azure Compute, storage in 4. Azure Storage, identity in 5. Azure Identity and Security.

Talking to Azure from Code

Use the Azure SDKs (Python azure-*, .NET Azure.*, JavaScript @azure/*, Java). Authenticate with DefaultAzureCredential, which tries, in order: environment variables, managed identity, Azure CLI login, VS Code login. The same code works locally and in Azure with no secrets.

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

cred = DefaultAzureCredential()
svc = BlobServiceClient("https://stdemo12345.blob.core.windows.net", credential=cred)
container = svc.get_container_client("images")
container.upload_blob("hello.txt", b"hello", overwrite=True)

App Service in Depth

• App settings become environment variables; reference Key Vault with @Microsoft.KeyVault(SecretUri=...)
• Deployment slots: deploy to staging, test, swap; mark settings as slot-specific where needed
• Autoscale: by CPU/memory/schedule (Standard tier and above)
• Easy Auth: built-in sign-in with Entra ID, Google, GitHub etc.
• WebJobs / background tasks, VNet integration, Hybrid Connections
• Diagnostics: log stream, Kudu console

Functions in Depth

Triggers and bindings from 2. Azure Compute.

• Input / output bindings remove boilerplate: a queue trigger plus a Cosmos DB output binding needs no SDK code
• function.json (or decorators / attributes) declares bindings
• Cold start on Consumption; use Premium / Flex for pre-warmed instances
• Durable Functions patterns: chaining, fan-out/fan-in, async HTTP API, monitor, human interaction

Containers

Build → push to ACR → run on App Service, ACI, Container Apps or AKS.

$ az acr build -r myregistry123 -t shop-api:1.0 .
$ az containerapp create -g rg-demo -n shop-api \
    --image myregistry123.azurecr.io/shop-api:1.0 \
    --environment env-demo --ingress external --target-port 8080

Container Apps features: revisions (versions, traffic splitting), scale rules (HTTP, queue length), Dapr sidecars, scale to zero.

Data Access Patterns

Blob Storage

• Upload with SDK; give clients limited access via SAS tokens or user delegation SAS (signed with Entra, safer than the account key)
• Blob properties and metadata, leases (exclusive write lock), change feed, events to Event Grid on create
• Lifecycle management and tiers in 4. Azure Storage

Cosmos DB

• Container + partition key, items are JSON
• Cost is RUs: a point read by id + partition key is about 1 RU, queries and cross-partition scans cost more
• Change feed streams inserts/updates, trigger Functions from it
• Consistency level per account or per request

from azure.cosmos import CosmosClient
client = CosmosClient(url, credential=cred)
items = client.get_database_client("shop").get_container_client("orders")
items.upsert_item({"id": "1", "customerId": "c42", "total": 99.5})

Redis Cache

Cache-aside pattern: check cache, on miss read DB and populate with a TTL.

Secrets and Configuration

• Key Vault for secrets, keys, certs. Access from apps via Managed Identity
• App Configuration for feature flags and shared settings across apps, with labels per environment and dynamic refresh

Authentication in Apps (Microsoft identity platform)

• App registration creates a client ID; add redirect URIs, client secret or certificate
• OAuth 2.0 flows: authorization code (+ PKCE) for web / SPA, client credentials for daemon services, on-behalf-of for APIs calling APIs
• MSAL libraries acquire and cache tokens
• Protect your API by validating the JWT (aud, iss, scp / roles)
• Scopes (delegated permissions) vs app roles (application permissions); admin consent

Messaging and Events

Rules of thumb: - Message = intent, one consumer should process it → Service Bus / Queue - Event = notification of a fact, many listeners → Event Grid - Stream = firehose of data → Event Hubs

Service Bus concepts: peek-lock (message hidden until complete or abandoned), dead-letter queue for failures, TTL, sessions for FIFO per key.

API Management (APIM)

Gateway in front of your APIs: authentication, rate limiting, caching, transformation, versioning, developer portal. Behaviour is set with policies (XML) such as rate-limit, validate-jwt, set-header.

CI/CD

• GitHub Actions or Azure Pipelines build, test and deploy
• Authenticate pipelines with OIDC federated credentials (no stored secrets)
• Deploy to slots then swap; blue/green and canary via Container Apps revisions
• IaC with Bicep (1. Azure Core Concepts)

Monitoring and Troubleshooting

• Application Insights SDK or auto-instrumentation: requests, dependencies, exceptions, custom events, distributed tracing
• Availability tests (ping / multi-step) from many regions
• Alerts on failure rate or latency
• Query with KQL (6. Azure Governance and Cost Management)
• Use sampling to control telemetry cost