Home / Lab Collections / Building Redundant Cloud Solutions in Azure

Hands-On Azure Labs: Building Redundant Cloud Solutions

Lab 3 of 29: Deploy vNet-East and Subnet-East

Lab Instructions

Learning Objectives

Exam Relevance

Lab Instructions

Learning Objectives

Exam Relevance

Step-by-Step Lab Instructions

To complete this lab, you will:

- Create a virtual network named vNet-East and place it in the RG-Lab resource group within the East US region.
- Change the default address space to 10.1.0.0/16 to accommodate future resource deployments.
  - This provides a large pool of IP addresses for subnets and other network components as the project expands.
- Modify the subnet configuration:
  - Remove the automatically created default subnet.
  - Create a new subnet named Subnet-East.
  - Assign Subnet-East a starting address of 10.1.1.0 with a /24 mask.
  - This defines the subnet address range as 10.1.1.0 through 10.1.1.255, dedicated for the East US virtual machines that will later serve as web servers.
- After deployment, confirm that Subnet-East appears on the Subnets page of vNet-East.
- Defining this custom subnet allows for more efficient traffic flow management, easier implementation of security policies, and optimized network performance for application workloads.

How This Lab Fits into the Overall Project

Deploying vNet-East and Subnet-East helps establish a structured and scalable network environment for the distributed web application that you’re deploying. This network will serve as the foundation for all virtual machines and services deployed in the East US region, ensuring secure and efficient communication between resources.

Complete the Lab Simulation

Watch the full instruction video in the Lab Instructions tab to unlock the Launch Lab Simulation button.

Have a question about this lab? Ask The Author

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Azure Virtual Machines — Exam Prep Cheat Sheet

Key facts for AZ-900/AZ-104: sizes, disks, availability, networking, identity, costs & common commands.

Exam Highlights (Know These!)

Sizing families: B (burstable), D (general), E (memory), F (compute), Ls (storage I/O), M (SAP HANA), N (GPU).
Disks: Premium SSD v2 / Premium SSD / Standard SSD / Standard HDD; managed disks by default.
Availability: Availability Sets (fault/update domains), Availability Zones (physically separate), Scale Sets (autoscale VMs).
Networking: NICs, NSGs, VNet/subnets, Public IP, Azure Bastion (no public RDP/SSH), Load Balancer (L4), App Gateway (L7/WAF).
Identity: System/User-assigned Managed Identity; use Key Vault for secrets.
Images: Marketplace, custom images, Azure Compute Gallery (share/version/replicate).
Costs: Pay-as-you-go, Reservations (1/3-yr commit), Spot (evictable); Hybrid Benefit & stop-deallocate.

VM Sizes (Family → Best Fit)

Family	Profile	Use
B	Burstable	Dev/Test, low baseline usage
D	Balanced	Web/app servers, general workloads
E	Memory-optimized	DB/analytics, in-memory cache
F	Compute-optimized	CPU-bound, batch, microservices
Ls	Storage I/O	NoSQL, data stores, high throughput
M	Very high RAM	SAP HANA
N	GPU	AI/ML, rendering, visualization

Start with D-series; move to E/F/Ls/N for specialized needs.

Disks & Storage

Type	Perf	Typical Use
Premium SSD v2	High, flexible IOPS/throughput	Production apps with tuning needs
Premium SSD	High	Most production workloads
Standard SSD	Moderate	Balanced cost/perf
Standard HDD	Lower	Cold data, backups, cost-sensitive

OS disk required; add data disks for app/data.
Ephemeral OS: OS on host cache/local SSD (fast, stateless).
Disk caching: ReadOnly vs ReadWrite (useful for OS/DB patterns).
Encryption at rest enabled by default; can use customer-managed keys.

Availability & Scale

Availability Set: distributes across fault domains & update domains (same datacenter).
Availability Zones: place VMs in zone 1/2/3 for datacenter-level fault isolation within region.
Scale Set: manage a group of identical VMs with autoscale rules & load balancing.
Use Managed Disks for availability features and simpler management.
Back up with Azure Backup; replicate images via Azure Compute Gallery.

Zones > Sets for resiliency; scale sets for horizontal scale.

Networking Essentials

Each VM has one or more NICs attached to a subnet in a VNet.
NSGs filter traffic at NIC/subnet; default deny inbound.
Public IP optional; prefer Azure Bastion for RDP/SSH without exposing VM.
Azure Load Balancer (L4) distributes TCP/UDP; App Gateway (L7) does HTTP(S)/WAF.
Private connectivity: Private Link to PaaS; VPN/ExpressRoute for hybrid.

Identity & Security

Managed Identity (system/user-assigned) to access Azure resources without secrets.
Store secrets/keys in Azure Key Vault; use RBAC for control plane, NSG for data plane.
Enable Microsoft Defender for Cloud recommendations & just-in-time VM access.
Patch via Update Manager; use Extensions for agents/config.

Images & Deployment

Sources: Marketplace, custom image (managed image), or Azure Compute Gallery (version/share).
Gen2 images support modern features (UEFI, larger disks, vTPM).
Use ARM/Bicep/Terraform for repeatable deployments.
Boot diagnostics for console screenshots/serial logs.

Cost Controls

Pricing: Pay-as-you-go; Reservations (1/3-yr); Spot (evictable).
Azure Hybrid Benefit: apply existing Windows Server/SQL licenses.
Stop (deallocate) to stop compute charges; storage still billed.
Right-size VMs; choose disk tier appropriately; use auto-shutdown for dev/test.

Ops & Troubleshooting

Capture image when generalized; use run command/serial console for recovery.
Common fixes: NSG rules, route conflicts, disk attachment, extension failures.
Move across resource groups/subscriptions with constraints (region/image support).

CLI Quick Commands

az group create -n rg-vm -l eastus az vm create -g rg-vm -n vm1 --image Win2022Datacenter --size Standard_D2s_v5 \ --admin-username azureuser --admin-password "P@ssw0rd1234!" --public-ip-sku Standard az vm stop -g rg-vm -n vm1 az vm deallocate -g rg-vm -n vm1 az vm start -g rg-vm -n vm1 az vm run-command invoke -g rg-vm -n vm1 --command-id RunPowerShellScript --scripts "ipconfig"

Remember: deallocate stops compute billing; stopping alone may not.

PowerShell Quick Commands

New-AzResourceGroup -Name 'rg-vm' -Location 'EastUS' New-AzVM -ResourceGroupName 'rg-vm' -Name 'vm1' -Location 'EastUS' ` -Image 'Win2022Datacenter' -Size 'Standard_D2s_v5' ` -Credential (Get-Credential) -PublicIpSku Standard Stop-AzVM -ResourceGroupName 'rg-vm' -Name 'vm1' -Force Set-AzVM -ResourceGroupName 'rg-vm' -Name 'vm1' -Generalized:$true Start-AzVM -ResourceGroupName 'rg-vm' -Name 'vm1'

Use Az modules; run in Cloud Shell or local with Az installed.

Rapid Q&A (Exam Triggers)

Need RDP/SSH without public IP? Use Azure Bastion.
Need zone-level resiliency? Deploy across Availability Zones.
Share custom images? Azure Compute Gallery with versions/replicas.
Cut VM cost for steady workloads? Reservations; apply Hybrid Benefit if eligible.
Autoscale front-end VMs? VM Scale Set + Load Balancer.
App-level routing/WAF? Application Gateway.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Instance Protection

Prevent accidental scale-in or deletion of specific VMs.
Useful for running long-lived or stateful workloads.
Protected instances still receive updates & patching.
Supported in both Flexible & Uniform modes.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Scaling Limits & Quotas

Max 1,000 VMs (Flexible/Uniform on Marketplace).
Custom images: Uniform max 600 VMs, Flexible 1,000.
Large scale sets (>100): Multiple placement groups; requires managed disks.
Overprovisioning: Spin extra VMs for faster provisioning; not billed.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

Azure Files — Quick Reference

Fast lookup for protocols, access tiers, billing, authentication & CLI.

Core Overview

Fully managed file shares in the cloud via SMB, NFS, or REST API.
Mount on Windows, macOS, Linux, or directly in Azure VMs.
Serverless; no file server or NAS management needed.
Supports identity-based auth (AD DS, Microsoft Entra, Kerberos).
Works with Azure File Sync for hybrid/on-premises caching.

Can replace on-premises file servers or support lift-and-shift migrations.

Storage Account Types

Account Type	Media	Billing Model
StorageV2 (GPv2)	HDD	Pay-as-you-go
FileStorage (SSD v2)	SSD	Provisioned v2
FileStorage (SSD v1)	SSD	Provisioned v1
FileStorage (HDD v2)	HDD	Provisioned v2

FileStorage accounts are dedicated to file shares only (no blobs/queues/tables).

Media Tiers (Performance)

Tier	Type	Latency	Use
Premium (SSD)	SSD	Single-digit ms	I/O intensive, low latency
Standard (HDD)	HDD	Higher	General-purpose, cost-effective

Choose at storage account creation; cannot change post-creation. Must migrate to new account.

Access Tiers (Standard/HDD Only)

Tier	Cost Profile	Best For
Transaction Optimized	Lowest tx cost	High transactions (migrations, backups)
Hot	Low storage, moderate tx	General-purpose, frequent access
Cool	Lower storage, high tx	Infrequent access, cost savings

All three run on same HDD hardware; differences are pricing-based.

Redundancy Options

LRS: Local (within datacenter). Low cost, no regional protection.
ZRS: Zone redundant (within region). HA across zones.
GRS: Geo-redundant (to secondary region). Regional DR; read-only on failover.
GZRS: Zone + Geo redundant. Best resilience.
Premium: LRS or ZRS only.

Protocols

Protocol	Clients	Use
SMB 3.x	Windows, Linux, macOS	General-purpose file shares
NFS 4.1	Linux only	High-performance, POSIX compliance
REST API	App-driven access	Programmatic file operations

Keep SMB and NFS shares in separate storage accounts for security.

Identity-Based Authentication (SMB)

On-premises AD DS: Domain-joined via Microsoft Entra Connect Sync.
Microsoft Entra Domain Services: Managed domain in Azure.
Microsoft Entra Kerberos: Hybrid user identities (cloud + on-premises).
Share-level: Azure RBAC. File/directory-level: Windows ACLs.
No additional service charge for identity-based auth.

Azure File Sync (Hybrid)

Cache Azure file shares on Windows Servers on-premises or in cloud.
Cloud tiering: Auto-tier infrequently used files to cloud; recall on demand.
Single source of truth in Azure; servers become disposable caches.
Distribute access across offices; seamless migrations without disruption.
Syncs namespaces first for quick recovery on server failover.

Billing Models

Model	How Charged	Best For
Pay-as-you-go	Storage used + transactions	Variable/bursty workloads
Provisioned v2	GiB provisioned (not used)	Predictable capacity, performance guarantees
Provisioned v1	GiB provisioned	Legacy; similar to v2

Provisioned v2 recommended for new deployments. Reserve capacity for up to 36% discount.

Common Use Cases

Lift & Shift: Move on-premises apps + data to cloud.
Shared configs: Centralized app settings for distributed workloads.
Diagnostics/Logs: Cloud apps write logs; local access via mount.
Dev/Test: Shared tools/utilities across VMs.
Containers: Persistent volumes for stateful containers.
FSLogix: VDI profile containers with Azure Virtual Desktop.

Data Protection & Recovery

Soft delete: Recover deleted shares/files within retention window.
Share snapshots: Differential snapshots (VSS-like); billing based on differential size.
Immutable storage: Legal hold or time-based retention for compliance.
Azure Backup: Integrated backup solutions available.

Quotas & Limits

Standard: Up to 100 TiB per share (or 5 TiB without large file shares property).
Premium: Quota set at provisioning time.
Max file size: 4 TiB per file (via SMB).
Max throughput: Depends on tier and provisioning; SSD much higher.

Hands-On Azure Labs: Building Redundant Cloud Solutions

Lab 3 of 29: Deploy vNet-East and Subnet-East

Step-by-Step Lab Instructions

How This Lab Fits into the Overall Project

Complete the Lab Simulation

Ask The Author

Azure vNets Explained

Azure Files in Under a Minute

An Introduction to Microsoft Entra ID

VMs Made Easy: A Deep Dive Into All VM Settings