Azure networking, Functions, databases and monitoring

VNets and subnets

An Azure Virtual Network (VNet) is the same idea as an AWS VPC: a private address range, such as 10.10.0.0/16, in one region. You split it into subnets, such as 10.10.1.0/24 for web servers and 10.10.2.0/24 for databases. Azure reserves 5 addresses in every subnet (the first four and the last), so a /24 gives 251 usable addresses. One difference from AWS: Azure subnets span all availability zones in the region.

Microsoft is retiring the old automatic "default outbound access" to the internet for VMs in new networks. Plan an explicit way out, such as a NAT gateway or a load balancer outbound rule, and check the current docs.

Network security groups (NSGs)

An NSG is a list of allow and deny rules for traffic. You attach it to a subnet, a network interface, or both. Each rule has a priority from 100 to 4096, a source and destination (an IP range or a service tag such as Internet or VirtualNetwork), a port, a protocol, a direction and an action. Azure checks rules from the lowest number upwards and stops at the first match. NSGs are stateful: if inbound traffic is allowed, the reply is allowed automatically.

Outbound has matching defaults: AllowVnetOutBound, AllowInternetOutBound and DenyAllOutBound. You cannot delete default rules, but your own rules (100 to 4096) are checked first, so they can override them.

az network nsg rule create --resource-group rg-web --nsg-name nsg-web \
  --name Allow-HTTPS --priority 300 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 443

Connecting networks

• VNet peering joins two VNets over Microsoft's backbone, in the same or different regions. Address ranges must not overlap, and peering is not transitive: if A peers with B and B with C, A cannot reach C through B.
• VPN Gateway connects your office or data centre over an encrypted IPsec tunnel across the internet (site-to-site), or single laptops (point-to-site).
• ExpressRoute is a private connection through a connectivity provider that does not travel over the public internet. It gives steadier speed for banks and large firms, at a higher price.

Spreading traffic

Azure Functions

Azure Functions is Azure's serverless compute, like AWS Lambda. Each function has exactly one trigger, the event that runs it: an HTTP request, a timer, a new blob, a queue message, a Cosmos DB change and more. Bindings connect a function to other services without boilerplate code: an input binding reads data in, an output binding writes data out, for example to a storage queue.

import azure.functions as func

app = func.FunctionApp()

@app.route(route="hello", auth_level=func.AuthLevel.ANONYMOUS)
def hello(req: func.HttpRequest) -> func.HttpResponse:
    name = req.params.get("name", "friend")
    return func.HttpResponse(f"Namaste, {name}!")

@app.timer_trigger(schedule="0 30 2 * * *", arg_name="timer")
def nightly(timer: func.TimerRequest) -> None:
    print("Nightly clean-up ran")

Function apps run on a hosting plan. Flex Consumption is the current recommended serverless plan (pay per use, scale to zero), Premium keeps warm instances for no cold starts, and a Dedicated plan runs on an App Service plan you already pay for. Timeouts, memory and scaling limits differ by plan and change over time, so check the hosting options page.

Databases

Azure SQL Database is managed SQL Server: Microsoft handles patching, backups (with point-in-time restore) and high availability. You choose a purchasing model (vCore or DTU), and a serverless compute tier can pause when idle. Azure Cosmos DB is a globally distributed NoSQL database. You pick an API (NoSQL, MongoDB, Cassandra, Gremlin or Table), a partition key, and throughput in request units (RU/s), or the serverless mode. It offers five consistency levels, from strong to eventual.

Azure Monitor and Log Analytics

Azure Monitor collects metrics and logs from every resource. Logs go into a Log Analytics workspace, where you query them with KQL (Kusto Query Language). The Activity Log records control-plane operations in a subscription, such as who deleted a VM, much like AWS CloudTrail. Application Insights watches application performance. Alerts send notifications through action groups (email, SMS, webhook).

Heartbeat
| summarize LastSeen = max(TimeGenerated) by Computer
| where LastSeen < ago(10m)

AppRequests
| where TimeGenerated > ago(1h)
| summarize requests = count(), failed = countif(Success == false), p95 = percentile(DurationMs, 95) by bin(TimeGenerated, 5m)

Microsoft Defender for Cloud checks your subscriptions against security best practices, gives a secure score with recommendations, and with paid Defender plans adds threat protection for servers, storage, databases and containers.

AWS to Azure: the services in this module