Master Microsoft Azure with the Interactive Editor
Portal, CLI, ARM/Bicep, VMs, App Service, Functions, AKS, Cosmos DB, Redis, VNets, DevOps, Key Vault, Monitor — plus the real patterns enterprise teams ship: Entra ID + MSAL, Spring Boot resource servers, Service Bus, Azure Artifacts, Helm on AKS, and Key Vault at scale. 36 lessons with exercises and quizzes.
Let’s figure it out.
Ask me about this course or where to start.
Foundations
0/8 visitedCloud concepts, the portal, CLI, ARM/Bicep, RBAC, cost, policy, tags.
- Step 1
Azure 1: Cloud Concepts & Azure Portal
Microsoft Azure is one of the three major cloud platforms. Understanding cloud computing models (Iaa...
Start Lesson - Step 2
Azure 2: Resource Groups & Subscriptions
Everything in Azure lives inside a hierarchy: Management Groups > Subscriptions > Resource Groups > ...
Start Lesson - Step 3
Azure 3: Azure CLI Essentials
The Azure CLI (`az`) is the primary command-line tool for managing Azure resources. Learning it is e...
Start Lesson - Step 4
Azure 4: ARM Templates & Bicep
Infrastructure as Code (IaC) is how you define Azure resources declaratively. ARM templates use JSON...
Start Lesson - Step 5
Azure 5: Role-Based Access Control (RBAC)
Azure RBAC controls who can do what on which resources. It uses role assignments that combine a prin...
Start Lesson - Step 6
Azure 6: Cost Management & Budgets
Azure costs can spiral quickly without monitoring. Cost Management + Billing helps you analyze spend...
Start Lesson - Step 7
Azure 7: Azure Policy & Governance
Azure Policy enforces organizational standards and assesses compliance at scale. Policies can audit,...
Start Lesson - Step 8
Azure 8: Tags & Resource Organization
Tags are key-value pairs attached to Azure resources for organization, cost tracking, automation, an...
Start Lesson
Compute
0/6 visitedVMs, App Service, Functions, Container Instances, AKS, Logic Apps.
- Step 9
Azure 9: Virtual Machines
Azure VMs are the core IaaS compute offering. Full control over OS, runtime, and configuration....
Start Lesson - Step 10
Azure 10: Azure App Service
App Service is Azure's PaaS for hosting web apps, REST APIs, and mobile backends. Deploy code or con...
Start Lesson - Step 11
Azure 11: Azure Functions (Serverless)
Azure Functions is the serverless compute service. Write code that runs in response to events and pa...
Start Lesson - Step 12
Azure 12: Container Instances
Azure Container Instances (ACI) is the fastest way to run containers in Azure. No VM management, no ...
Start Lesson - Step 13
Azure 13: Azure Kubernetes Service (AKS)
AKS is Azure's managed Kubernetes. Azure manages the control plane; you manage worker nodes....
Start Lesson - Step 14
Azure 14: Logic Apps & Workflow Automation
Logic Apps is a low-code platform for building automated workflows that integrate services and data....
Start Lesson
Storage & Data
0/5 visitedBlob, Table/Queue, Cosmos DB, SQL Database, Cache for Redis.
- Step 15
Azure 15: Blob Storage
Azure Blob Storage is massively scalable object storage for unstructured data — images, videos, logs...
Start Lesson - Step 16
Azure 16: Table Storage & Queue Storage
Table Storage is a NoSQL key-value store. Queue Storage provides reliable messaging between componen...
Start Lesson - Step 17
Azure 17: Azure Cosmos DB
Cosmos DB is Azure's globally distributed, multi-model NoSQL database with single-digit ms reads and...
Start Lesson - Step 18
Azure 18: Azure SQL Database
Azure SQL Database is a fully managed relational database engine based on SQL Server with auto-patch...
Start Lesson - Step 19
Azure 19: Azure Cache for Redis
Azure Cache for Redis provides an in-memory data store for caching, session management, and real-tim...
Start Lesson
Networking
0/4 visitedVNets, NSGs, Load Balancer, App Gateway, DNS, custom domains.
- Step 20
Azure 20: Virtual Networks & Subnets
Azure VNet is the foundation of Azure networking — isolation, segmentation, and connectivity for clo...
Start Lesson - Step 21
Azure 21: Network Security Groups (NSGs)
NSGs are Azure's built-in firewall for filtering traffic based on IP, port, and protocol....
Start Lesson - Step 22
Azure 22: Load Balancer & Application Gateway
Azure Load Balancer (Layer 4) and Application Gateway (Layer 7 with WAF) distribute traffic across b...
Start Lesson - Step 23
Azure 23: Azure DNS & Custom Domains
Azure DNS hosts your DNS zones on Azure's global anycast network for both public and private resolut...
Start Lesson
DevOps & CI/CD
0/4 visitedAzure Pipelines, GitHub Actions, Terraform, ACR.
- Step 24
Azure 24: Azure DevOps Pipelines
Azure DevOps Pipelines provides CI/CD with YAML-based pipelines that live in your repo....
Start Lesson - Step 25
Azure 25: GitHub Actions for Azure
GitHub Actions integrates natively with Azure using official actions for login, deployment, and reso...
Start Lesson - Step 26
Azure 26: Terraform on Azure
Terraform is a multi-cloud IaC tool. The AzureRM provider lets you manage Azure resources with HCL....
Start Lesson - Step 27
Azure 27: Azure Container Registry (ACR)
ACR is a managed Docker registry integrated with AKS, App Service, and Azure DevOps....
Start Lesson
Security & Monitoring
0/3 visitedKey Vault, Azure Monitor, Application Insights.
- Step 28
Azure 28: Azure Key Vault
Key Vault centralizes secrets, encryption keys, and certificates. Never store secrets in code....
Start Lesson - Step 29
Azure 29: Azure Monitor & Application Insights
Azure Monitor is the unified monitoring platform. App Insights adds APM with request tracking and an...
Start Lesson - Step 30
Azure 30: Cloud Architecture - Putting It All Together
Final lesson! Combine everything to architect a complete solution using the Azure Well-Architected F...
Start Lesson
Production patterns
0/6 visitedEntra ID for SPA & Spring, Service Bus, Artifacts, Helm, Key Vault at scale.
- Step 31
Azure 31: Entra ID & MSAL.js — SPA Authentication
Microsoft Entra ID (formerly Azure AD) is Azure's identity platform. MSAL.js lets Single-Page Apps s...
Start Lesson - Step 32
Azure 32: Entra ID + Spring Boot — Resource Server
A resource server accepts a JWT access token and validates it before serving data. Spring Boot apps ...
Start Lesson - Step 33
Azure 33: Service Bus — Topics, Queues & Dead-Letter
Azure Service Bus is the enterprise messaging broker — **queues** for 1-to-1 work distribution, **to...
Start Lesson - Step 34
Azure 34: Azure Artifacts — Private Package Feeds
Azure Artifacts hosts private Maven, npm, NuGet, and Python package feeds inside Azure DevOps. Feeds...
Start Lesson - Step 35
Azure 35: Helm on AKS — Values Overlays
Helm is the package manager for Kubernetes. A **chart** is a templated bundle of manifests + a `valu...
Start Lesson - Step 36
Azure 36: Key Vault Integration at Scale — Pipeline, CSI, App Service
A Key Vault full of secrets is only useful if your workloads can read them safely. In practice there...
Start Lesson
Contoso Production Patterns
New0/24 visitedThe full real-world stack: pipeline-templates, VMSS agents, Service Bus, AKS multi-cluster, Istio + Argo Rollouts, terraform-common, Datadog APM, end-to-end deploy.
- Step 37
Azure 37: YAML Pipeline Templates — the `extends` + `parameters` pattern
Contoso has ~35 service repos. Each repo's `pipelines/{env}.yml` is tiny — 30-50 lines — because all...
Start Lesson - Step 38
Azure 38: Variable Groups & Service Connections — the secret backbone
Pipeline YAML is public in git. The credentials it uses to talk to Azure (ARM SPN, AKS kubeconfig, A...
Start Lesson - Step 39
Azure 39: GitVersion → image tag → chart version
Every artifact Contoso ships — a Docker image, a Helm chart, an npm package, a Maven JAR — needs the...
Start Lesson - Step 40
Azure 40: Multi-Registry Docker Build & Push — the loop pattern
Contoso runs one ACR per environment: `contosodevcontainerregistry.azurecr.io`, `contosotestcontaine...
Start Lesson - Step 41
Azure 41: Self-Hosted ADO Build Agents on VMSS — pipeline-agents
Microsoft-hosted ADO agents are fine for small projects, but Contoso builds JVMs with private Gradle...
Start Lesson - Step 42
Azure 42: Service Bus Topics with terraform-common Publisher/Subscriber
Contoso's microservices talk asynchronously through **Azure Service Bus topics**: `availability`, `e...
Start Lesson - Step 43
Azure 43: AKS Multi-Cluster Topology — apps + elasticsearch
Contoso runs **two** AKS clusters per environment: `AKS-apps-k8s-{env}` for the customer-facing micr...
Start Lesson - Step 44
Azure 44: Helm Universal Charts — api | headless | cron | frontend
Instead of every service maintaining its own chart, Contoso ships **four** charts in `platform-unive...
Start Lesson - Step 45
Azure 45: Istio VirtualService + DestinationRule for canary
Istio is the data plane that turns AKS into a real service mesh: mTLS between every pod, weighted tr...
Start Lesson - Step 46
Azure 46: Argo Rollouts canary steps + Analysis
Argo Rollouts is the controller that orchestrates Contoso's canary releases. The `api` universal cha...
Start Lesson - Step 47
Azure 47: Environment Rollout Strategies — dev=direct, uat=optional canary, prod=canary+promote
Different environments need different release safety. Contoso's `mesh.canary.requiresApproval` value...
Start Lesson - Step 48
Azure 48: Per-Service Key Vault naming — `{service}-{abbrev}-kv-{env}`
Contoso provisions a Key Vault **per service per environment**, not one giant vault per env. The nam...
Start Lesson - Step 49
Azure 49: PostgreSQL Flexible Server per-service + Liquibase auxiliary images
Most Contoso services own their own **Azure Database for PostgreSQL Flexible Server** instance. The ...
Start Lesson - Step 50
Azure 50: Azure Artifacts npm feed — `@contoso/react` (Lib)
Contoso's shared React component library lives at `Lib/` and is published as `@contoso/react` to a *...
Start Lesson - Step 51
Azure 51: Azure Artifacts Maven/Gradle — `ado_artifacts_token` for backend libs
Contoso's Java/Kotlin services publish shared libraries to a Maven feed in Azure Artifacts. The `Doc...
Start Lesson - Step 52
Azure 52: AzureKeyVault@2 chained with Helm `--set secrets`
The final piece of Contoso's secret-flow puzzle: how a value in Key Vault becomes an environment var...
Start Lesson - Step 53
Azure 53: Terraform plan/apply with exit-code-2 gating
`pipeline-templates/cd/stages/terraform-deploy.yaml` is Contoso's IaC entry point. It runs `terrafor...
Start Lesson - Step 54
Azure 54: createprodcr — ADO Change Request work items for prod
Prod deploys at Contoso require a **Change Request** (CR) work item in Azure Boards before the apply...
Start Lesson - Step 55
Azure 55: Front Door + APIM + AKS Ingress — north-south traffic path
A customer request reaching `cart-api` traverses: **Azure Front Door** (global TLS termination, WAF,...
Start Lesson - Step 56
Azure 56: End-to-end deploy — from `git push v1.5.0` to canary promote in prod
Time to wire everything together. A merge to `cart-service/main` with `+semver: minor` and a `v1.5.0...
Start Lesson - Step 57
Azure 57: Datadog APM wired through the universal chart
Every Contoso backend service ships with **Datadog APM** baked in: a `dd-java-agent.jar` copied into...
Start Lesson - Step 58
Azure 58: AAD App Registrations via terraform-common
Every Contoso API that authenticates with Entra ID needs an **AAD App Registration**: a service prin...
Start Lesson - Step 59
Azure 59: Standardized resource tagging — `terraform-common/azure/tags`
Contoso has thousands of Azure resources across 5 environments. Without standardised tagging, asking...
Start Lesson - Step 60
Azure 60: Multi-Component Services — `services[]` + `auxiliaryImages[]`
Many Contoso services are not a single container. `offer-api` ships an `api` (REST endpoint), an `of...
Start Lesson
Reliability & Operations
0/7 visitedHealth probes, SLOs & error budgets, distributed tracing, structured logging, retries/timeouts/circuit breakers, multi-region failover, and a chaos-engineering capstone.
- Step 61
Azure 61: Health Probes — Liveness, Readiness & Startup
Resilience starts with honesty: a pod must tell the platform when it's alive, when it's ready for tr...
Start Lesson - Step 62
Azure 62: SLOs, SLIs & Error Budgets
You can't prioritize reliability without a number. SLIs measure, SLOs target, and the error budget t...
Start Lesson - Step 63
Azure 63: Distributed Tracing with OpenTelemetry
When a request crosses five services, a single stack trace is useless. Distributed tracing stitches ...
Start Lesson - Step 64
Azure 64: Structured Logging & Dashboards
A log line is only useful if a machine can query it. Structured logs — JSON with consistent fields —...
Start Lesson - Step 65
Azure 65: Retries, Timeouts & Circuit Breakers
A flaky dependency shouldn't take you down with it. Timeouts bound the wait, retries paper over blip...
Start Lesson - Step 66
Azure 66: Multi-Region Failover & Traffic Manager
A single region is a single point of failure. Health-based global routing sends users to a healthy r...
Start Lesson - Step 67
Azure 67: Capstone — Chaos Engineering & a Resilience Scorecard
Chaos engineering is the discipline of breaking things on purpose, in controlled experiments, to fin...
Start Lesson
Infrastructure as Code — Deep Dive
New0/3 visitedAuthor reusable Terraform modules, loop resources with for_each & dynamic blocks, and template Helm charts from values — then drill the commands in the Command Lab.
- Step 68
Azure 68: Terraform Module Authoring
A reusable Terraform module is a folder with variables.tf (inputs), main.tf (resources), and outputs...
Start Lesson - Step 69
Azure 69: Terraform for_each & dynamic blocks
for_each creates one resource per element of a map/set, keyed stably. dynamic blocks generate repeat...
Start Lesson - Step 70
Azure 70: Helm Chart Templating
A Helm template renders Kubernetes manifests by interpolating values. Change values.yaml and the sam...
Start Lesson