What is Azure? A complete guide for beginners

Written by Mario Larrúa Vega.

Creating an application often starts with a simple idea. Then come the questions: where will it run, where will it store data, who can access it, and what happens if traffic increases or a server fails?

Microsoft Azure is Microsoft’s cloud platform for building and running solutions using infrastructure, application, data, networking and artificial intelligence services. It lets you combine resources you manage directly with services where Microsoft handles a larger share of operations. The platform is presented this way in the Microsoft Cloud Adoption Framework.

This guide helps you understand those decisions from scratch. You will find examples, criteria for choosing services and a complete lab to upload and retrieve a file in Azure. It also provides a foundation if you are preparing for AZ-900.

Updated on October 15, 2026. Features and commands have been checked against official documentation. The scenarios are educational examples. Availability, quotas and prices must be checked for your subscription and region before deployment.

1. What working in the cloud means

Cloud computing means using computing resources delivered as services: processing, storage, networking or databases, among others. You can provision and manage them without buying and personally maintaining all the physical infrastructure behind them.

Imagine a training provider that needs to publish its learning platform. In its own environment, it might need to buy servers, install operating systems, configure networks and prepare sufficient enrollment capacity.

In Azure, it can use services to run the application and store its data. The work changes: it must choose capabilities, configure access, monitor operation and control consumption.

The cloud makes it easier to match resources to needs, but configuration and design remain the team’s responsibility. To explore the fundamentals, start with the official cloud computing module.

Scalability and elasticity, with an example

Suppose the training provider normally receives one hundred simultaneous visits and needs to serve many more during a campaign.

• Scaling up would increase an instance’s capacity, such as its memory or CPUs.
• Scaling out would use more instances to distribute the workload.
• Elasticity means adapting capacity to demand variations, increasing and decreasing resources as needed.

A service’s ability to scale does not mean every application scales well. An overloaded database, slow dependency or connection limit can still be the bottleneck. Microsoft covers these concepts in its training on the benefits of cloud services.

2. Public, private, hybrid and multicloud

These terms describe how the environment is organized:

“Public” does not mean your data is public. The term describes the cloud model. Access to an application or its data depends on its identity, permissions and network configuration.

Microsoft explains these differences in cloud models.

For the training provider, a hybrid solution could make sense if it needs to retain an internal application and integrate it with its learning portal. That would be a decision based on its needs, not a mandatory starting stage.

3. IaaS, PaaS and SaaS: how much you manage

Service models help explain which part of the solution the provider manages:

Microsoft maintains the physical infrastructure of its cloud services. Your responsibilities for data, identities and configuration remain, while others vary by service. The reference is the shared responsibility model.

To host the provider’s website, a virtual machine offers control over the operating system. App Service lets you focus more on the application. The choice requires evaluating the control you need and the tasks you are willing to operate.

Where does serverless fit?

In a serverless approach, the platform manages execution infrastructure and provides mechanisms to respond to events or demand. Servers still exist, even though you do not manage them directly.

Azure Functions is an example for running code in response to events. Scaling and billing behavior depends on the chosen plan. In current documentation, Microsoft recommends Flex Consumption for new serverless function apps. Review the Azure Functions hosting options.

4. How Azure is organized: from tenant to resource

Before deploying, distinguish identity, administration and billing.

Microsoft Entra tenant

The directory that organizes identities such as users, groups and applications. Microsoft Entra ID provides identity and access features used by Azure and other Microsoft services. Learn more in the introduction to Microsoft Entra.

A tenant and a subscription serve different purposes: the directory organizes identities; the subscription establishes a scope for managing resources and attributing consumption.

The management hierarchy

A common structure is:

Tenant de Microsoft Entra
└── Grupo de administración
    └── Suscripción de Azure
        ├── Grupo de recursos: formación-desarrollo
        │   ├── Aplicación web
        │   └── Cuenta de almacenamiento
        └── Grupo de recursos: formación-producción
            ├── Aplicación web
            └── Base de datos

The management groups let you organize subscriptions and apply governance at greater scale. Subscriptions within one management group must trust the same tenant. Microsoft explains the structure and inheritance in the management groups documentation.

Other concepts you will use daily include:

• Subscription: administrative and consumption scope containing resource groups.
• Resource group: logical container for managing related resources, especially those sharing a lifecycle.
• Resource: a manageable item, such as a storage account, web application or virtual network.

These distinctions are covered in Azure resource management fundamentals.

Azure Resource Manager provides the layer to create, modify and delete these resources. Scopes also allow access and governance controls. See the introduction to Azure Resource Manager.

Four details that prevent confusion

1. A resource belonging to one resource group cannot simultaneously belong to another.
2. Resources in a group can be in different regions; the group’s location corresponds to its metadata.
3. Group tags are not automatically inherited by its resources.
4. Deleting the group deletes the resources it contains.

These rules are detailed in the official section on what a resource group is. For practice, creating a dedicated group for each lab is useful.

5. Regions and availability zones

A region is a geographic location where Azure offers infrastructure and services. When choosing one, review user proximity, service and tier availability, data-location requirements, quotas and cost.

Spain has Spain Central, whose identifier is spaincentral. Check its characteristics and those of other regions in the official Azure regions list.

A availability zone is a grouping of one or more physically separate data centers within a region, with independent power, cooling and network infrastructure. Using zones can provide resilience against a zone failure.

Support depends on both the region and the service. Some services distribute resources across zones automatically; others require configuration. Deploying a resource in a region with zones does not, by itself, prove that the resource uses them. See how availability zones work.

Not every region has a paired region. Microsoft lists Spain Central among unpaired regions. A regional pair does not by itself provide automatic disaster recovery: the solution must be designed and configured. The reference is paired and unpaired regions.

6. Services to learn first

Learning Azure does not require memorizing the catalog. Start with the problem you need to solve.

Running applications

The official guide to hosting applications in Azure compares alternatives by simplicity, control and execution needs.

For the provider’s first API, I would evaluate App Service before introducing Kubernetes. This recommendation applies to that example: the team should justify the operational complexity it introduces.

Storage and databases

Azure Blob Storage stores objects such as images, documents and other files. Its basic organization is storage account, container and blob. You can use it for course PDFs and images. The introduction to Blob Storage explains its uses and structure.

Azure SQL Database is a managed database service that handles tasks such as platform updates, patching and backups. It can suit an application that needs to query enrollments or relationships between students and courses. Review what Azure SQL Database is.

The initial criterion is the type of information and the operations the application needs. A PDF file and an enrollment record have different access and query needs.

Networking

Azure Virtual Network helps organize private connectivity and segmentation. Azure Private Link provides access to compatible services through private endpoints, and Azure DNS participates in name resolution. Their relationship is explained in Azure core networking services.

Two questions must be resolved separately: where a service can be reached from and who has permission to use it. A container with anonymous access disabled can still use a public network endpoint.

Observability and artificial intelligence

Azure Monitor brings together capabilities for metrics, logs, traces and events. Application Insights is part of its application-observability offering. These tools help investigate issues and performance; configuration should be part of the design. See the introduction to Azure Monitor.

For AI solutions, Microsoft Foundry brings together models, agents and tools, along with evaluation and management capabilities. Older material uses the names Azure AI Studio or Azure AI Foundry. Current documentation explains the evolution in what Microsoft Foundry is.

Adding AI to the training portal would still require addressing identity, data, evaluation and consumption. The model is one part of the solution.

7. Security: identity, permissions and configuration

A good starting practice is to grant the necessary access at the narrowest scope that allows the task.

Azure RBAC, role-based access control, answers three questions: which identity receives access, which operations the role permits and which scope it applies to. You can assign roles to users, groups and other identities. The explanation is in what Azure RBAC is.

For our training provider, we could allow one team to manage development resources and another to read certain data. Permission design should reflect their tasks.

Managing a resource and accessing its data

Creating a storage account does not automatically grant permission to read its blobs using Microsoft Entra ID. Data access requires an appropriate role, such as Storage Blob Data Reader or Storage Blob Data Contributor. Microsoft documents this distinction in assigning roles for Blob Storage data.

Azure Policy and managed identities

Azure Policy lets you evaluate and enforce resource rules, such as restricting regions or requiring specific configuration. RBAC controls permissions; Policy controls governance conditions. An authorized operation can be rejected if it violates a policy. See what Azure Policy is.

For communication between applications and compatible services, managed identities let you obtain Microsoft Entra tokens without the developer managing those credentials. You still need to authorize the identity to access the target service. The introduction to managed identities explains how this works.

8. How to think about Azure costs

Cost depends on resources and their configuration: capacity, execution time, storage, operations, transfers and additional services you use.

To estimate the training provider’s costs, I would separate at least application execution, the database, documents, traffic and observability. I would then compare typical demand with an enrollment campaign. The Azure pricing calculator lets you build estimates by product and configuration.

The estimate helps inform decisions and can later be compared with observed consumption. Avoid budgeting a solution solely from its main resource’s displayed price.

A budget generates alerts

Cost Management lets you set budgets and alerts for actual or forecast spending. Reaching the budget does not automatically stop resources or consumption. Data and evaluations are also delayed; they are not an instant counter. This is explained in the official budgets tutorial.

For a lab, create a budget appropriate to your circumstances, review consumption and delete resources when finished.

Stopping a virtual machine does not always eliminate its cost

A VM in the state Stopped may still have allocated capacity and compute charges. In Deallocated that capacity is released, but charges for other resources, such as disks or network components, may continue. See virtual machine states and billing.

What a free account includes

Microsoft publishes an offer for new customers with USD 200 in credit for up to 30 days, along with free allowances for certain services subject to conditions. Continuing with pay-as-you-go means reviewing which consumption exceeds those allowances. Check the current offer and eligibility on the official Azure account page.

An account with free benefits does not make every deployment free. When learning, know what you have created and how to remove it.

9. Example: a training platform

We can turn these concepts into an initial proposal for the training provider:

Alumno
  │
  ▼
Aplicación web en App Service
  ├── Consulta matrículas en Azure SQL Database
  └── Accede a documentos en Blob Storage

Microsoft Entra: identidad y acceso de los componentes
Azure Monitor: telemetría configurada de la solución
Cost Management: seguimiento del consumo

This is an educational outline, not a complete production design. Before implementing it, the team would need to address student authentication, application permissions, connectivity, recovery and availability objectives.

For example, I would ask: which documents can each student download? What happens if the database does not respond? How can an accidental deletion be recovered? How much downtime can the training provider accept?

The Azure Well-Architected Framework organizes these decisions around reliability, security, cost optimization, operational excellence and performance efficiency.

10. Lab: store and retrieve a file in Azure

We will create a storage account and a container with anonymous access disabled. We will upload a file using Microsoft Entra ID, verify its contents and delete the resources.

The process follows the approach in the official Blob Storage quickstart with Azure CLI, adapted for this article.

Before you start

You need an active subscription and permission to create a resource group and storage account. You must also be able to assign the data-access role at the account scope. This requires role-assignment permissions, for example through Owner or an appropriate combination of roles; Contributor alone is insufficient for that step.

Use a learning subscription or authorized environment. Storage and its operations can incur consumption charges. Review the estimate and perform final cleanup.

Open Azure Cloud Shell and select Bash. You can choose an ephemeral session without a storage account for file persistence. Local files in that session are lost when it ends, but resources deployed in Azure continue to exist. Microsoft explains this mode and its requirements in Cloud Shell ephemeral sessions.

Run the blocks in order, keeping the same session. If a command fails, resolve the error before continuing. If using local Bash with Azure CLI installed, first sign in with az login.

Step 1. Check the subscription

az account list --output table

az account set --subscription "REEMPLAZA_CON_EL_ID_DE_TU_SUSCRIPCION"

az account show \
  --query '{Suscripcion:name,Id:id,Tenant:tenantId}' \
  --output table

Replace the identifier before running az account set. Confirm that the selection matches the practice environment.

Step 2. Define names and create the group

LAB_ID="$(date -u +%s)${RANDOM}"
RG_NAME="rg-larruatech-intro-${LAB_ID}"
STORAGE_NAME="sfintro${LAB_ID}"
LOCATION="westeurope"
CONTAINER_NAME="documentos"

printf 'Grupo: %s\nCuenta: %s\n' "$RG_NAME" "$STORAGE_NAME"

az group create \
  --name "$RG_NAME" \
  --location "$LOCATION" \
  --tags proyecto=larruatech entorno=lab \
  --output table

The suffix reduces the risk of a storage-account name collision. We use westeurope as an example region; change it if your subscription requires another compatible region.

Write down the group name so you can find it later even if Cloud Shell closes. The command reference is in az group.

Step 3. Create the storage account

az storage account create \
  --name "$STORAGE_NAME" \
  --resource-group "$RG_NAME" \
  --location "$LOCATION" \
  --kind StorageV2 \
  --sku Standard_LRS \
  --https-only true \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --allow-shared-key-access false \
  --tags proyecto=larruatech entorno=lab \
  --output table

We have made several options explicit: HTTPS, TLS 1.2 minimum, disabling anonymous blob access and disabling Shared Key authorization. You can check the parameters in az storage account create.

Standard_LRS uses local redundancy within a data center in the primary region. It does not distribute copies across zones or regions. This is a choice for this exercise; review alternatives before designing a real workload in Azure Storage redundancy.

Step 4. Assign data access

USER_OBJECT_ID="$(az ad signed-in-user show --query id --output tsv)"

STORAGE_ID="$(az storage account show \
  --name "$STORAGE_NAME" \
  --resource-group "$RG_NAME" \
  --query id \
  --output tsv)"

az role assignment create \
  --assignee-object-id "$USER_OBJECT_ID" \
  --assignee-principal-type User \
  --role "Storage Blob Data Contributor" \
  --scope "$STORAGE_ID" \
  --output table

This block is intended for an interactive session signed in as a user. It grants the role on the account created for this exercise. The syntax is documented in az role assignment create.

The assignment can take a few minutes to propagate. If the next step returns an authorization error immediately afterward, review the assignment and wait before retrying.

Step 5. Create the container and upload a file

az storage container create \
  --account-name "$STORAGE_NAME" \
  --name "$CONTAINER_NAME" \
  --public-access off \
  --auth-mode login

printf '%s\n' 'Hola, comunidad LarrúaTech. Mi primer archivo en Azure.' \
  > bienvenida.txt

az storage blob upload \
  --account-name "$STORAGE_NAME" \
  --container-name "$CONTAINER_NAME" \
  --name bienvenida.txt \
  --file bienvenida.txt \
  --overwrite true \
  --auth-mode login \
  --output table

--auth-mode login uses the authenticated Microsoft Entra identity for data operations. It prevents the command from trying to retrieve an account key. The recommendation is in authorizing Blob Storage operations with Azure CLI.

The container has anonymous access disabled, as described in az storage container create. We have not configured a private endpoint: for simplicity, this exercise uses public connectivity with authentication.

Step 6. Check and download the file

az storage blob list \
  --account-name "$STORAGE_NAME" \
  --container-name "$CONTAINER_NAME" \
  --auth-mode login \
  --query '[].{Nombre:name,Bytes:properties.contentLength}' \
  --output table

az storage blob download \
  --account-name "$STORAGE_NAME" \
  --container-name "$CONTAINER_NAME" \
  --name bienvenida.txt \
  --file bienvenida-descargada.txt \
  --overwrite true \
  --auth-mode login \
  --output table

cat bienvenida-descargada.txt

The expected result is a list containing bienvenida.txt and, when you read the downloaded file, the same message you wrote. These are exercise verification criteria, not output captured from your subscription. The operations are documented in az storage blob.

Step 7. Delete the lab resources

First check what the group you just created contains:

az resource list \
  --resource-group "$RG_NAME" \
  --query '[].{Nombre:name,Tipo:type}' \
  --output table

Once you have confirmed it is the group dedicated to this exercise, delete it. The command deletes the group and its resources, including the storage account and uploaded file. It retains Azure CLI’s interactive confirmation:

az group delete --name "$RG_NAME"

az group exists --name "$RG_NAME"

After deletion completes, the last command should return false. Then review Cost Management to check the lab’s consumption.

If an error occurs

These checks guide diagnosis; the error code and full message determine the next step. In a corporate environment, adapt the lab to existing controls.

11. What you learned through practice

You have connected an identity to a subscription, created resources in a region and applied a data permission at a specific scope. You have also distinguished object storage, anonymous access and network connectivity.

To turn the exercise into learning, try answering without looking at the commands:

1. What is the difference between the resource group, account and container?
2. Why did we assign a role after creating the account?
3. Which identity authorizes the file upload?
4. What changes if you close Cloud Shell before deleting the group?
5. Which redundancy option did you use, and which failure does it not cover?

If an answer is unclear, revisit that decision and document your own example.

12. How to continue and prepare for AZ-900

The official AZ-900 guide reviewed includes objectives effective from July 20, 2026 and organizes the exam as follows:

Use the official AZ-900 study guide to check the current scope. This article provides a foundation and an exercise; exam preparation should cover all its objectives.

As a learning path, I suggest:

1. Complete the cloud concepts and explain the service models using your own examples.
2. Repeat the lab and justify every identity, region and storage decision.
3. Then practice a web application, observing its dependencies and consumption.
4. Review governance, monitoring and costs before expanding the architecture.
5. Record results and resolved problems in a small portfolio.

The official cloud fundamentals learning path is a good starting point for Microsoft Learn training.

Frequently asked questions

Do I need to code to get started with Azure?

You can start by studying concepts and managing resources in the portal. To develop applications or automate deployments, you will need to learn the relevant tools and languages. Start with a specific task and add complexity as needed.

Is Azure only for Windows?

Azure supports Linux, open technologies and different languages. The platform overview in the Cloud Adoption Framework describes that flexibility.

Are Azure and Microsoft 365 the same thing?

They are different offerings. Azure provides a platform to build and operate solutions; Microsoft 365 offers productivity applications and services. They can share identity through Microsoft Entra, but you must review each service’s terms and consumption.

Which tool should I use: portal, CLI or infrastructure as code?

The portal helps with exploration. The CLI makes operations repeatable and easier to automate. ARM templates and Bicep let you describe infrastructure declaratively. Microsoft explains these options in Azure Resource Manager. To start, alternate between the portal and CLI and check that you recognize the same resources.

When is a solution ready for production?

When you have validated its requirements, behavior and operation: access, configuration, recovery, observability, performance and costs. A successful deployment is a necessary check, but you still need to evaluate how it will behave and who will operate it.

Build your first example with informed choices

Start with a small goal: store a document, publish a page or run a task. Decide which resource it needs, who can use it, how you will verify it works and when you will delete it.

Document those decisions alongside commands and results. This habit turns a first exercise into a useful foundation for learning Azure, sharing knowledge with the community and clearly explaining the solutions you build.