Learn Cloud the Hands-On Way

The labIT PRO Suite gives you access to interactive cloud lab simulations that let you practice real-world tasks in the cloud — all without the cost or complexity of maintaining your own cloud subscription.

Access Our Suite of Cloud Lab Simulations

Create a new labITpro account to access our free labs, or add a subscription to one of our paid collections to your existing account.

Unlock the Labs!

E-mail *

First Name

Last Name

Password *

Repeat Password *

Please notify me of new labs and special discounts on IT training courses.

Free labITpro Membership - Free
Those with a Free labITpro Membership receive free access to the Base Collection of Azure labs.
Select a Payment Method
PayPalCredit / Debit Card
No payment methods are available for the selected subscription plan.

Payment Details

Azure Files — Quick Reference

Fast lookup for protocols, access tiers, billing, authentication & CLI.

Core Overview

Fully managed file shares in the cloud via SMB, NFS, or REST API.
Mount on Windows, macOS, Linux, or directly in Azure VMs.
Serverless; no file server or NAS management needed.
Supports identity-based auth (AD DS, Microsoft Entra, Kerberos).
Works with Azure File Sync for hybrid/on-premises caching.

Can replace on-premises file servers or support lift-and-shift migrations.

Storage Account Types

Account Type	Media	Billing Model
StorageV2 (GPv2)	HDD	Pay-as-you-go
FileStorage (SSD v2)	SSD	Provisioned v2
FileStorage (SSD v1)	SSD	Provisioned v1
FileStorage (HDD v2)	HDD	Provisioned v2

FileStorage accounts are dedicated to file shares only (no blobs/queues/tables).

Media Tiers (Performance)

Tier	Type	Latency	Use
Premium (SSD)	SSD	Single-digit ms	I/O intensive, low latency
Standard (HDD)	HDD	Higher	General-purpose, cost-effective

Choose at storage account creation; cannot change post-creation. Must migrate to new account.

Access Tiers (Standard/HDD Only)

Tier	Cost Profile	Best For
Transaction Optimized	Lowest tx cost	High transactions (migrations, backups)
Hot	Low storage, moderate tx	General-purpose, frequent access
Cool	Lower storage, high tx	Infrequent access, cost savings

All three run on same HDD hardware; differences are pricing-based.

Redundancy Options

LRS: Local (within datacenter). Low cost, no regional protection.
ZRS: Zone redundant (within region). HA across zones.
GRS: Geo-redundant (to secondary region). Regional DR; read-only on failover.
GZRS: Zone + Geo redundant. Best resilience.
Premium: LRS or ZRS only.

Protocols

Protocol	Clients	Use
SMB 3.x	Windows, Linux, macOS	General-purpose file shares
NFS 4.1	Linux only	High-performance, POSIX compliance
REST API	App-driven access	Programmatic file operations

Keep SMB and NFS shares in separate storage accounts for security.

Identity-Based Authentication (SMB)

On-premises AD DS: Domain-joined via Microsoft Entra Connect Sync.
Microsoft Entra Domain Services: Managed domain in Azure.
Microsoft Entra Kerberos: Hybrid user identities (cloud + on-premises).
Share-level: Azure RBAC. File/directory-level: Windows ACLs.
No additional service charge for identity-based auth.

Azure File Sync (Hybrid)

Cache Azure file shares on Windows Servers on-premises or in cloud.
Cloud tiering: Auto-tier infrequently used files to cloud; recall on demand.
Single source of truth in Azure; servers become disposable caches.
Distribute access across offices; seamless migrations without disruption.
Syncs namespaces first for quick recovery on server failover.

Billing Models

Model	How Charged	Best For
Pay-as-you-go	Storage used + transactions	Variable/bursty workloads
Provisioned v2	GiB provisioned (not used)	Predictable capacity, performance guarantees
Provisioned v1	GiB provisioned	Legacy; similar to v2

Provisioned v2 recommended for new deployments. Reserve capacity for up to 36% discount.

Common Use Cases

Lift & Shift: Move on-premises apps + data to cloud.
Shared configs: Centralized app settings for distributed workloads.
Diagnostics/Logs: Cloud apps write logs; local access via mount.
Dev/Test: Shared tools/utilities across VMs.
Containers: Persistent volumes for stateful containers.
FSLogix: VDI profile containers with Azure Virtual Desktop.

Data Protection & Recovery

Soft delete: Recover deleted shares/files within retention window.
Share snapshots: Differential snapshots (VSS-like); billing based on differential size.
Immutable storage: Legal hold or time-based retention for compliance.
Azure Backup: Integrated backup solutions available.

Quotas & Limits

Standard: Up to 100 TiB per share (or 5 TiB without large file shares property).
Premium: Quota set at provisioning time.
Max file size: 4 TiB per file (via SMB).
Max throughput: Depends on tier and provisioning; SSD much higher.

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Instance Protection

Prevent accidental scale-in or deletion of specific VMs.
Useful for running long-lived or stateful workloads.
Protected instances still receive updates & patching.
Supported in both Flexible & Uniform modes.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Scaling Limits & Quotas

Max 1,000 VMs (Flexible/Uniform on Marketplace).
Custom images: Uniform max 600 VMs, Flexible 1,000.
Large scale sets (>100): Multiple placement groups; requires managed disks.
Overprovisioning: Spin extra VMs for faster provisioning; not billed.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

Learn Cloud the Hands-On Way

Access Our Suite of Cloud Lab Simulations

Unlock the Labs!

Select a Payment Method

Payment Details

Ask The Author

Azure vNets Explained

Azure Files in Under a Minute

An Introduction to Microsoft Entra ID

VMs Made Easy: A Deep Dive Into All VM Settings