Azure Cloud Fundamentals Course
A structured beginner course covering Azure cloud concepts, core services, identity, governance, security, and cost management.
What you will learn
- Explain core cloud concepts and the Azure global infrastructure
- Identify core Azure compute, storage, networking, and database services
- Describe Azure identity, access, and governance tools
- Apply Azure security, privacy, and compliance practices
- Understand Azure cost management and service-level agreements
Before you start
- No prior Azure experience required
- Basic computer and internet familiarity
- A free Azure account is useful but optional
Lesson 1 Cloud Concepts and Azure Global Infrastructure
Cloud computing delivers compute, storage, and networking resources on demand over the internet. Azure organizes these resources in Regions and Availability Zones. A Region is a geographic area, and each Region contains at least three Availability Zones with independent power, cooling, and networking.
Resource groups group related Azure resources for management and billing. Resource tags add metadata for organization and cost reporting.
Cloud services offer scalability, elasticity, high availability, and fault tolerance. Customers can scale out during demand and scale in when demand drops, paying only for what they use.
Resource organization drill: learn the order management groups -> subscriptions -> resource groups -> resources. Subscriptions are billing and access boundaries, resource groups keep related resources together, and tags add metadata for cost reporting. Choose the region closest to users and replicate across availability zones for resilience.
Example
An application deployed across two Availability Zones in the same Region can continue serving traffic if one zone fails. Adding a second resource group with clear tags makes the deployment easier to manage and track by cost center.
Worked example: A company has finance and engineering workloads.
Create one subscription per workload or use resource groups, then apply tags such as cost center and environment to track spending.
Lesson 2 Core Azure Compute, Storage, Networking, and Database Services
Azure Virtual Machines provide resizable virtual servers, while VM Scale Sets run multiple VMs with automatic scaling. App Service hosts web apps without managing the underlying server, Azure Functions runs serverless code, and Azure Kubernetes Service (AKS) manages container workloads.
Azure Blob Storage stores unstructured data such as images and documents, Azure Disk Storage provides durable disks for VMs, and Azure Files offers managed file shares. Azure SQL Database and Cosmos DB provide managed relational and NoSQL database options.
Azure Virtual Network creates isolated networks with subnets and routing. Load Balancer distributes traffic, Azure DNS resolves domain names, VPN Gateway connects on-premises networks securely, and Azure CDN caches content closer to users.
Service selection: Virtual Machines for full OS control, App Service for managed web apps, Functions for event-driven code, AKS for Kubernetes, Blob Storage for objects, Azure SQL Database for managed relational data, and Cosmos DB for globally distributed NoSQL. Match the workload to the service before memorizing details.
Example
A small web application can use Azure Functions for serverless processing, Cosmos DB for flexible data storage, Blob Storage for user uploads, and Azure CDN to deliver static assets quickly around the world.
Worked example: A team needs a managed web app with minimal server work.
App Service handles scaling and patching; the team focuses on the application code.
Lesson 3 Azure Identity, Access, and Governance
Microsoft Entra ID (formerly Azure AD) provides cloud identity and access management. Users sign in once, and organizations can enforce multi-factor authentication, conditional access, and password protection policies.
Role-based access control (RBAC) grants permissions based on job function. Follow the principle of least privilege so users receive only the access they need. Subscriptions, management groups, and resource groups create a hierarchy for organizing resources and applying governance.
Azure Policy enforces rules such as allowed regions or required tags. Azure Blueprints assemble policies, roles, and templates into repeatable packages. Azure tags support cost reporting and resource classification.
Access control flow: authenticate users with Microsoft Entra ID, enforce MFA and conditional access, then authorize with RBAC using the least-privilege principle. Review roles regularly and use Azure Policy to enforce organizational rules across resources.
Example
A company assigns the Contributor role only to the application team, enforces multi-factor authentication for administrators, and uses Azure Policy to block resource creation outside approved regions. This reduces accidental exposure and keeps governance consistent.
Worked example: A developer only needs to deploy to one app.
Assign a contributor role scoped to that app instead of giving subscription-level owner access.
Lesson 4 Azure Security, Privacy, and Compliance
Azure uses a defense-in-depth strategy with multiple layers: physical security, identity and access, network controls, compute security, application security, and data protection. Microsoft is responsible for the physical infrastructure, while customers secure their data, identities, and applications.
Network Security Groups filter traffic between subnets, Azure Firewall protects resources centrally, and DDoS Protection mitigates large-scale attacks. Microsoft Defender for Cloud provides security recommendations, while Azure Sentinel collects and analyzes security signals across the environment.
Azure Key Vault stores secrets, keys, and certificates. Encryption protects data at rest and in transit. Azure compliance offerings map services to standards such as ISO 27001, GDPR, and SOC, and the Microsoft Trust Center publishes compliance information.
Defense layers: protect physical infrastructure, identities, networks, compute, applications, and data separately. Use Network Security Groups to filter traffic, Azure Firewall for central protection, DDoS protection for attacks, and Azure Key Vault for secrets and certificates.
Example
A web application uses a Network Security Group to allow HTTPS only, stores database credentials in Key Vault, and enables Microsoft Defender for Cloud to detect misconfigured resources. This combines network, identity, and monitoring controls.
Worked example: A web app must not be reachable directly from the internet.
Place it behind Azure Firewall or Application Gateway and allow only approved traffic through network security rules.
Lesson 5 Azure Cost Management and Service Agreements
Azure pricing depends on factors such as service, region, tier, and usage. The Azure Pricing Calculator estimates costs, while Cost Management + Billing tracks actual spending. Budgets and alerts notify teams when costs approach limits.
Tags help assign costs to teams or projects. Rightsizing, reserved capacity, and choosing the correct service tier can reduce spending without changing functionality.
An Azure Service Level Agreement (SLA) describes the guaranteed uptime for a service. Composite SLAs combine the availability of multiple components, so adding dependencies can reduce overall availability. Azure Monitor tracks performance and service health.
Cost control loop: estimate with the Pricing Calculator, track with Cost Management + Billing, set budgets and alerts, apply tags to allocate costs, right-size resources, and use reserved capacity for stable workloads. Review Azure Advisor recommendations regularly.
Example
A team estimates a workload with the Pricing Calculator, applies tags for each department, and sets a monthly budget alert at 80 percent of the limit. They choose Reserved Capacity for a steady production database to reduce cost while keeping flexible services for development.
Worked example: A VM runs 24/7 for a predictable workload.
Reserved capacity reduces the hourly price; right-size the VM if utilization is low.