Top 47 Microsoft Azure Interview Questions & Answers (2026)

Microsoft Azure is a cloud computing platform and service created by Microsoft. It provides a vast collection of cloud services including computing, storage, databases, networking, AI, analytics, DevOps, and more, accessible over the internet on a pay-as-you-go basis. Azure operates from Microsoft's global network of data centers in over 60 regions worldwide. Launched in 2010, it is the second-largest cloud provider after AWS. Azure enables businesses to build, test, deploy, and manage applications through Microsoft-managed data centers, eliminating the need to own and maintain physical hardware.

These are three cloud service models with different levels of management. IaaS (Infrastructure as a Service): you manage the OS, runtime, middleware, and application; Azure manages the virtualization, hardware, networking, and storage. Example: Azure Virtual Machines. PaaS (Platform as a Service): Azure manages the infrastructure, OS, and runtime; you manage the application code and data. Example: Azure App Service, Azure SQL Database. SaaS (Software as a Service): Azure manages everything; you simply use the software. Example: Microsoft 365, Azure DevOps. As you move from IaaS to SaaS, you give up control but gain convenience and reduced operational overhead.

An Azure Resource Group is a logical container that holds related Azure resources for a solution or application. All resources in a group share the same lifecycle — you deploy, update, and delete them together. A resource group has a specific Azure region but can contain resources from any region. Key properties: every resource must belong to exactly one resource group; resource groups cannot be nested; you can apply RBAC permissions, tags, and policies at the resource group level, which inherit down to resources. Resource groups help organize resources by project, environment (dev/prod), or team, making cost management and access control simpler.

An Azure Virtual Machine is an on-demand, scalable computing resource that provides the flexibility of virtualization without buying and maintaining physical hardware. It is an IaaS offering that gives you full control over the operating system (Windows or Linux), software installation, and configuration. VMs are billed per second when running. Key concepts: VM Size (CPU, RAM, storage configuration — e.g., B-series for burstable, D-series for general purpose, F-series for compute-optimized). VM Scale Sets automatically scale the number of VMs based on demand. VMs require you to manage patching, scaling, and availability manually compared to PaaS alternatives like App Service.

Azure App Service is a fully managed PaaS for building, deploying, and scaling web applications and APIs. It supports multiple languages: .NET, Java, Node.js, Python, PHP, and containers. You deploy your code; Azure handles the OS, runtime patching, load balancing, and auto-scaling. Key features: Deployment slots (staging, production) for zero-downtime deployments and A/B testing. Auto-scaling based on CPU or schedule. Built-in CI/CD with GitHub, Azure DevOps. Custom domains and SSL. App Service Plans define the compute tier (Free, Shared, Basic, Standard, Premium). Multiple apps can share an App Service Plan, sharing the underlying compute resources.

Azure Blob Storage is Microsoft's object storage solution for the cloud, optimized for storing massive amounts of unstructured data like text and binary data. "Blob" stands for Binary Large OBject. Three types: Block Blobs: store text and binary data (images, documents, videos). Append Blobs: optimized for append operations — ideal for logging. Page Blobs: used for Azure VM disks (VHDs). Storage is organized in containers (like folders). Access tiers: Hot (frequently accessed data), Cool (infrequently accessed, lower storage cost), Cold, and Archive (rarely accessed, very low cost). Blobs are accessible via REST API, SDKs, and the Azure portal.

Azure Active Directory (now rebranded as Microsoft Entra ID) is Microsoft's cloud-based identity and access management service. It provides authentication and authorization for Azure resources, Microsoft 365, and thousands of third-party SaaS apps. Key features: Single Sign-On (SSO) across apps. Multi-Factor Authentication (MFA). Conditional Access policies. B2B collaboration for external users. B2C for customer-facing identity. Azure AD differs from traditional Windows Active Directory — it is designed for web/cloud protocols (OAuth 2.0, OpenID Connect, SAML) rather than on-premises Kerberos/LDAP. Most Azure services and Microsoft applications use Azure AD for authentication.

Azure SQL Database is a fully managed, intelligent relational database service based on the Microsoft SQL Server engine. As a PaaS offering, Azure handles hardware, OS, software patching, high availability, backups, and performance tuning automatically. Key features: Built-in high availability (99.99% SLA) with no extra configuration. Automatic backups with point-in-time restore. Serverless tier: auto-pauses when inactive, ideal for intermittent workloads. Elastic pools: share compute across multiple databases, optimal for SaaS multi-tenant scenarios. Geo-replication and failover groups for disaster recovery. Azure SQL Database supports most T-SQL features and is compatible with SQL Server tooling.

Azure Kubernetes Service (AKS) is a managed Kubernetes service that simplifies deploying, managing, and scaling containerized applications using Kubernetes on Azure. AKS manages the Kubernetes control plane (master nodes) for free — you only pay for the worker nodes (VMs running your containers). It integrates with Azure services: Azure Container Registry (private image storage), Azure Active Directory (RBAC), Azure Monitor (logging and metrics), Azure CNI networking, and Azure Load Balancer. AKS supports auto-scaling (Cluster Autoscaler for nodes, Horizontal Pod Autoscaler for pods), rolling deployments, and multiple node pools with different VM sizes for specialized workloads.

Azure Functions is a serverless compute service that allows you to run small pieces of code ("functions") without provisioning or managing infrastructure. You pay only for the time your code runs. Functions are triggered by events: HTTP trigger (REST API), Timer trigger (scheduled jobs), Blob Storage trigger (process new files), Queue trigger (process messages), Event Hub/Event Grid trigger, and more. They support multiple languages: C#, JavaScript/TypeScript, Python, Java, PowerShell. Scaling is automatic. Use cases: event-driven processing, lightweight APIs, scheduled tasks, and connecting Azure services. Azure Functions is ideal when you have intermittent workloads and want to avoid paying for idle compute time.

Azure DevOps is a suite of cloud services for software development teams providing end-to-end DevOps tooling. It includes five main services: Azure Boards: agile project management, work items, sprints. Azure Repos: Git or TFVC source code repositories. Azure Pipelines: CI/CD pipelines for building, testing, and deploying applications to any platform (including non-Azure targets). Azure Artifacts: package management (NuGet, npm, Maven, PyPI). Azure Test Plans: manual and exploratory testing. Azure DevOps integrates with GitHub, Jenkins, Terraform, and most major tools. It supports all cloud platforms and on-premises deployments, making it a complete DevOps platform for any team.

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It enables Azure resources like VMs to securely communicate with each other, the internet, and on-premises networks. Key concepts: Subnets: divide the VNet address space into smaller ranges; resources deploy into subnets. Network Security Groups (NSG): firewalls that control inbound and outbound traffic with allow/deny rules. VNet Peering: connect two VNets for low-latency private communication. VPN Gateway: encrypted connection to on-premises network. ExpressRoute: private, dedicated connection bypassing the public internet. All traffic within a VNet is private and encrypted by default — it never leaves the Microsoft network.

Azure Monitor is a comprehensive monitoring solution for collecting, analyzing, and acting on telemetry from Azure and on-premises environments. Core capabilities: Metrics: numerical data about resource performance (CPU %, request rate) stored for 93 days. Logs: event and log data stored in Log Analytics workspaces (queried with KQL — Kusto Query Language). Application Insights: APM for web applications tracking requests, dependencies, exceptions, and user behavior. Alerts: notify or automate actions when metrics/logs meet defined conditions. Workbooks: interactive visualizations. Dashboards: pin charts to shared views. Azure Monitor integrates with most Azure services and supports Prometheus metrics for AKS.

Azure uses a consumption-based pricing model — you pay for what you use, when you use it, with no upfront commitment (pay-as-you-go). Key savings options: Reserved Instances: commit to 1 or 3 years upfront for 40–72% savings on VMs and databases. Azure Hybrid Benefit: use existing on-premises Windows Server or SQL Server licenses to significantly reduce Azure costs. Spot VMs: use unused Azure capacity at 60–90% discount, but can be evicted with 30 seconds notice — suitable for fault-tolerant workloads. Dev/Test pricing: reduced rates for non-production environments. The Azure Pricing Calculator estimates costs. Azure Cost Management + Billing provides usage analysis, budgets, and cost allocation.

An Azure Load Balancer distributes inbound network traffic across multiple backend resources (VMs or VM Scale Set instances) to ensure high availability and reliability. It operates at Layer 4 (TCP/UDP) and provides sub-millisecond latency. Types: Public Load Balancer: distributes internet traffic to VMs. Internal (Private) Load Balancer: distributes traffic within a VNet. Key features: Health probes: detect unhealthy instances and remove them from rotation. Load balancing rules: define how traffic is distributed (5-tuple hash by default). Inbound NAT rules: map specific ports on the public IP to specific VMs. For HTTP/HTTPS load balancing with URL-based routing, SSL termination, and WAF, use Azure Application Gateway instead.

Azure Container Registry (ACR) is a managed, private Docker registry service for storing and managing container images and related artifacts. It is the Azure equivalent of Docker Hub but private to your organization. Key features: Geo-replication: replicate images across multiple regions for low-latency pulls. ACR Tasks: automatically build and push images when code is committed (cloud-native CI for containers). Security: integrates with Azure AD for RBAC, supports content trust (image signing), and scans images for vulnerabilities with Defender for Containers. Helm charts and OCI artifacts can also be stored. Integrates natively with AKS — AKS can pull images from ACR without managing credentials.

Azure Service Bus is a fully managed enterprise message broker with message queues and publish-subscribe topics. It provides reliable, asynchronous message delivery between decoupled applications and services. Queues: point-to-point messaging where one consumer processes each message. Supports dead-letter queues for failed messages. Topics and Subscriptions: publish-subscribe pattern where a message published to a topic is delivered to multiple subscriptions independently, each with configurable filter rules. Key features: At-least-once delivery, FIFO messaging, message sessions (related message ordering), scheduled messages, and transactions. Maximum message size is 100KB (256KB for Premium). It is preferred over Azure Storage Queue for enterprise messaging scenarios requiring ordered delivery, transactions, or pub-sub.

Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. Secrets: store connection strings, passwords, API keys, and other sensitive configuration values — retrieved by applications at runtime instead of hardcoding them. Keys: create and control cryptographic keys used for encryption; optionally backed by HSMs (Hardware Security Modules). Certificates: manage, provision, and deploy SSL/TLS certificates. Access is controlled via Azure AD and RBAC. Applications authenticate to Key Vault using Managed Identities (no credentials required in code). All access is logged in Azure Monitor. Key Vault is a fundamental security building block — every Azure application should store its secrets in Key Vault rather than configuration files or environment variables.

A Managed Identity is an automatically managed identity in Azure AD that allows Azure services (VMs, App Service, Functions, AKS pods) to authenticate to other Azure services without managing credentials. Two types: System-assigned: created and tied to a specific resource; automatically deleted when the resource is deleted. User-assigned: created as a standalone resource and can be assigned to multiple services. Usage: enable Managed Identity on a VM, grant it access to Key Vault secrets, and the VM can retrieve secrets using the Azure SDK without any credentials in code — Azure handles token acquisition transparently. Managed Identities eliminate the #1 security risk: hardcoded or improperly stored service credentials.

Azure Event Hubs is a big data streaming platform and event ingestion service capable of receiving and processing millions of events per second. It is designed for telemetry and log ingestion at massive scale — IoT sensor data, application logs, clickstreams. Key concepts: Partitions: events are distributed across partitions (up to 32 by default, 2000 in Dedicated tier) for parallel consumption. Consumer Groups: multiple independent consumers can read the same event stream simultaneously. Events are retained for 1–7 days (or 90 days in Premium/Dedicated). Event Hubs uses AMQP 1.0 and HTTPS protocols. It is compatible with the Apache Kafka protocol (no code changes needed for Kafka producers/consumers). Use Event Hubs for high-throughput event streaming; use Service Bus for enterprise messaging with guaranteed delivery and transactions.

Azure Cosmos DB is a globally distributed, multi-model NoSQL database service designed for low-latency, high-availability workloads. Key features: Global distribution: replicate data to any Azure region with a click; multi-region writes supported. Guaranteed low latency: single-digit millisecond reads and writes at any scale. Multiple APIs: Core SQL, MongoDB, Cassandra, Gremlin (graph), Table — migrate existing NoSQL workloads without code changes. Tunable consistency: five levels from strong to eventual. Automatic indexing: all properties are indexed by default. Serverless and provisioned throughput models. Cosmos DB is billed on Request Units (RU/s) — a currency that abstracts CPU, memory, and IO costs. Ideal for globally distributed applications, gaming leaderboards, retail catalogs, and IoT.

Azure API Management (APIM) is a hybrid, multi-cloud management platform for APIs. It sits in front of your backend APIs (hosted anywhere) and provides: Gateway: routes requests to backends, applies policies (authentication, rate limiting, caching, transformation). Developer Portal: auto-generated, customizable portal for API documentation and developer self-service. Policy engine: XML-based policies for JWT validation, IP filtering, response caching, request/response transformation, and throttling. Subscription keys: manage API consumer access. Analytics: monitor API usage, latency, and errors. APIM is essential for exposing internal services externally, monetizing APIs, enforcing governance, and versioning APIs without changing backend code.

Azure Logic Apps is a serverless workflow automation platform with a visual designer and 400+ built-in connectors. It enables integrating apps, data, services, and systems across enterprises without writing code. A Logic App is triggered by an event (new email, HTTP request, file upload, schedule) and executes a workflow of actions (send email, write to database, call an API, transform data). Built-in connectors include Office 365, Dynamics 365, Salesforce, SAP, Twitter, Slack, and more. Key use case: enterprise application integration (EAI) — connecting legacy systems, automating approval workflows, processing EDI transactions. Logic Apps Standard (v2) runs on Azure Functions runtime, enabling local development and inline code steps.

Azure Site Recovery (ASR) is a Disaster Recovery as a Service (DRaaS) solution that orchestrates replication, failover, and failback of Azure VMs, on-premises VMs, and physical servers. In a disaster, you fail over to Azure (or a secondary Azure region) to keep applications running. Key concepts: Recovery Time Objective (RTO): the maximum acceptable time to restore service — ASR typically achieves sub-hour RTO. Recovery Point Objective (RPO): maximum acceptable data loss — ASR typically achieves 30-second RPO for VMware VMs. Replication: continuous replication to the target region using crash-consistent and application-consistent recovery points. Test failover: validate your DR plan without impacting production by failing over to an isolated network.

The Azure Well-Architected Framework is a set of guiding principles to build high-quality cloud solutions. It has five pillars: Reliability: design for failure — use redundancy, availability zones, load balancing, circuit breakers, and health probes. Security: defense in depth — identity, network perimeter, data encryption, least privilege, and threat detection. Cost Optimization: eliminate waste — right-size resources, use Reserved Instances, implement auto-scaling, and monitor spending. Operational Excellence: DevOps practices — CI/CD, infrastructure as code, monitoring, and automated responses to events. Performance Efficiency: scale appropriately — horizontal scaling, caching, CDN, and choosing the right service tier. Use the Azure Advisor tool for personalized recommendations aligned with these pillars.

Azure Availability Zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. They protect applications and data from data center failures. Each region with Availability Zone support has a minimum of three zones. Zone-redundant services like Azure SQL Database and Premium Blob Storage automatically replicate across zones. Zone-pinned resources like VMs deploy to a specific zone. To achieve high availability, deploy across multiple zones — if one zone fails, resources in other zones continue serving traffic. The SLA for VMs using Availability Zones is 99.99% (vs. 99.95% for VMs in an Availability Set). Availability Zones differ from Availability Sets (which protect from rack-level failures within a data center).

Azure Resource Manager (ARM) is the deployment and management service for Azure — all Azure portal, CLI, and SDK operations go through ARM. It provides a consistent management layer: Declarative templates (ARM templates): JSON files that describe the desired Azure infrastructure. Deploy with az deployment group create. ARM ensures idempotent deployments — re-running the same template produces the same result. Resource groups: ARM manages resources as groups with shared lifecycle and policies. RBAC: access control is enforced by ARM for all resource operations. Tags: key-value metadata on resources for cost allocation and organization. Locks: prevent accidental deletion or modification. ARM templates are now being supplemented by Bicep — a domain-specific language (DSL) that compiles to ARM JSON with cleaner, more readable syntax.

Azure Policy is a service for creating, assigning, and enforcing governance rules across Azure resources. It evaluates resources for compliance with organizational standards and regulations. Policies can: Audit: identify non-compliant resources without blocking them. Deny: prevent creation of non-compliant resources (e.g., deny VM creation outside approved regions). Deploy if not exists: auto-remediate — add a monitoring agent to any VM that does not already have one. Modify: add or change resource properties (e.g., enforce required tags on creation). Policy Initiatives: group multiple related policies. Policies can be assigned at management group, subscription, or resource group scope. Azure provides built-in policies; you can also create custom ones in JSON. Policy is how enterprises enforce compliance at scale across thousands of resources.

While Azure has its own Bicep and ARM templates for Infrastructure as Code, Terraform (by HashiCorp) is widely used with Azure through the AzureRM provider. Terraform's advantage is multi-cloud support — the same workflow manages Azure, AWS, and GCP resources. Terraform state tracks the actual deployed infrastructure. Key Terraform resources for Azure: azurerm_resource_group, azurerm_virtual_machine, azurerm_app_service, azurerm_sql_server. Authenticate with a Service Principal or Managed Identity. Store Terraform state remotely in Azure Blob Storage with state locking via Azure Blob lease. The AzureRM provider supports the full breadth of Azure services and is maintained by HashiCorp with Microsoft collaboration.

A Service Principal is a security identity used by applications, services, and automation tools to access Azure resources. It is like a "service account" in Azure AD. Unlike a user account, a Service Principal has no interactive login — it authenticates with a client ID and either a secret or certificate. Create one with: az ad sp create-for-rbac --name my-app --role Contributor --scopes /subscriptions/{id}. The output includes the appId, password (secret), and tenant. Use these in CI/CD pipelines, scripts, and applications that need to manage Azure resources. Assign the minimum required RBAC role (least privilege). Rotate secrets regularly. Prefer Managed Identities when the workload runs inside Azure, as they eliminate credential management entirely.

Azure Front Door is a global, scalable entry point for fast delivery of web applications. It combines CDN, load balancing, WAF, and global HTTP routing in a single service. Key features: Global load balancing: routes traffic to the nearest healthy backend across regions using anycast networking and latency-based routing. SSL offload: terminates SSL at the edge, reducing backend load. Web Application Firewall (WAF): protects against OWASP Top 10 vulnerabilities at the edge. URL-based routing: route /api/* to a different backend than /static/*. Session affinity: sticky sessions. Caching: cache responses at edge nodes. DDoS protection: automatic at the network layer. Azure Front Door Standard/Premium replaced Classic Front Door and unified it with Azure CDN profiles.

Both are serverless compute options in Azure but serve different use cases. Azure Functions: code-first, developer-centric. Write code in C#, Python, JavaScript, etc. to process events, run background jobs, or build lightweight APIs. Best for custom logic, data transformation, and when you need full programming control. Azure Logic Apps: no/low-code, designer-centric. Build workflows by connecting pre-built connectors visually. Best for integration scenarios — connecting Office 365, Dynamics, SAP, Salesforce without writing code. Logic Apps has 400+ connectors; Functions does not have built-in connectors. You often use both together: a Logic App orchestrates the workflow (trigger, routing, connectors) and calls an Azure Function for custom business logic that connectors cannot handle. Logic Apps is better for business users and integration; Functions is better for developers with complex logic.

Azure Databricks is a fast, collaborative Apache Spark-based analytics platform optimized for Azure. It combines the power of Apache Spark for large-scale data processing with a collaborative notebook interface and deep Azure integration. Key features: Optimized Spark runtime: 10-100x faster than vanilla Spark via Delta Engine and Photon. Delta Lake: ACID transactions and versioning on data lakes. MLflow integration: track, deploy, and manage machine learning models. Unity Catalog: data governance and lineage. Auto-scaling clusters: start with zero workers, scale based on workload. Use cases: ETL pipelines, real-time analytics, ML training, and data exploration. Databricks integrates with Azure Data Lake Storage, Azure Synapse, and Azure ML.

Azure RBAC is the authorization system for controlling who has access to Azure resources, what they can do with those resources, and what areas they have access to. Key concepts: Security Principal: user, group, service principal, or managed identity requesting access. Role Definition: a collection of permissions. Built-in roles: Owner (full access including granting access), Contributor (full access except granting access), Reader (read only). Scope: the set of resources the access applies to — management group, subscription, resource group, or resource. Role Assignment: attaches a role definition to a security principal at a scope. Assignments are inherited — a Contributor at subscription level has Contributor access to all resource groups and resources within. Azure RBAC is deny-by-default — access must be explicitly granted.

Azure AI Services (formerly Cognitive Services) is a collection of pre-built AI and machine learning APIs that enable developers to add intelligent features to applications without AI expertise. Key services: Vision: Computer Vision (image analysis, OCR), Face API, Custom Vision. Language: Text Analytics (sentiment, key phrases, NER), Translator (100+ languages), Language Understanding (LUIS). Speech: Speech-to-Text, Text-to-Speech, Speaker Recognition, Real-time Translation. Decision: Anomaly Detector, Content Moderator, Personalizer. Azure OpenAI Service: GPT-4, DALL-E, Embeddings (hosted by Azure with enterprise security). These are REST APIs — send data, receive AI results. Azure AI Services are metered per API call with no ML infrastructure to manage.

An Azure landing zone is a pre-configured, standardized environment that follows best practices for security, governance, networking, and identity at scale. It is the foundation for a cloud adoption strategy. Built using Management Groups (organize subscriptions), Azure Policy (enforce standards), RBAC (access control), Network topology (Hub-and-Spoke with shared services VNet), and Logging (centralized Log Analytics). The Microsoft Cloud Adoption Framework provides a reference architecture with platform landing zones (identity, management, connectivity subscriptions) and application landing zones (per workload subscriptions). The ALZ Bicep/Terraform accelerators deploy the full landing zone as code. It ensures consistency across a large organization's Azure estate from day one.

Azure Service Mesh capabilities are provided through Open Service Mesh (OSM) and the Istio-based service mesh add-on for AKS. A service mesh handles cross-cutting concerns for microservices: mTLS (mutual TLS for encrypted, authenticated inter-service communication), traffic management (canary deployments, circuit breaking, retries), observability (distributed tracing, metrics per service-to-service call). The AKS Istio add-on is a managed Istio installation — Microsoft handles upgrades and security patches. Key Istio concepts: Envoy sidecar proxies intercept all pod traffic. VirtualService defines routing rules. DestinationRule defines traffic policies. PeerAuthentication enforces mTLS. Service meshes add operational complexity — evaluate if the benefits justify the overhead for your architecture.

Zero-trust in Azure is built on three principles: Verify explicitly, Use least privilege access, and Assume breach. Implementation across Azure services: Identity: Azure AD with Conditional Access policies (verify every access attempt based on user, device, location, risk). MFA enforced. Network: microsegmentation via NSGs and Azure Firewall; private endpoints for PaaS services; VPN/ExpressRoute for on-premises. Data: encrypt at rest (SSE with CMK) and in transit (TLS 1.2+); sensitivity labels via Microsoft Purview. Application: Defender for Cloud for vulnerability assessment; WAF on API Gateway and Front Door. Endpoints: Microsoft Intune device compliance before granting access. Infrastructure: RBAC with PIM (Privileged Identity Management) for just-in-time admin access. Azure Defender (Defender for Cloud) provides unified threat detection across all layers.

Azure Event Grid is a fully managed event routing service for reactive, event-driven architectures. It routes events from sources (Azure services, custom apps) to handlers (Functions, Logic Apps, webhooks) using a push model. It is designed for discrete events (resource created, file uploaded) at 10 million events/second with sub-second latency. Comparison: Event Grid: low-latency, reactive event distribution; events are small notifications; no ordering guarantee; best for triggering actions. Event Hubs: high-throughput telemetry streaming; data retained for replay; partitioned for parallel consumption; best for log/telemetry ingestion. Service Bus: enterprise messaging with guaranteed delivery, ordering, transactions, and dead-letter queues; best for business workflows requiring reliability. Use them together: Event Hubs ingests, Event Grid reacts, Service Bus coordinates business processes.

Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that protects Azure, hybrid, and multi-cloud environments. Two main capabilities: CSPM: continuously assesses your security posture with a Secure Score, provides recommendations aligned with industry standards (CIS, NIST, PCI-DSS), and detects misconfigurations like public storage blobs and open management ports. Workload Protection: advanced threat detection for VMs (detecting unusual processes), Containers (Kubernetes threat detection), Databases (SQL injection attempts), App Service, Storage, and Key Vault. It integrates with Microsoft Sentinel for SIEM. The Enhanced Security features cost per resource per hour; the CSPM basic tier is free. It supports non-Azure resources via Azure Arc.

Azure Arc extends Azure management and services to on-premises, multi-cloud, and edge environments. It solves the problem of managing heterogeneous infrastructure consistently. Arc-enabled servers: connect on-premises Linux/Windows VMs to Azure — they appear in the Azure portal, can be governed with Azure Policy, monitored with Azure Monitor, and secured with Defender for Cloud. Arc-enabled Kubernetes: manage on-premises or other-cloud Kubernetes clusters using the same Azure tools as AKS. Arc-enabled SQL: apply Azure SQL management features to on-premises SQL instances. Arc-enabled data services: run Azure SQL Managed Instance and PostgreSQL on any infrastructure. Azure Arc enables a single control plane — the Azure portal — for resources regardless of where they run.

Azure Private Endpoint is a network interface in your VNet that connects privately to an Azure PaaS service (Storage, SQL, Key Vault, Cosmos DB, etc.) using Azure Private Link. Traffic between your VNet and the service travels over the Microsoft backbone network, never over the public internet. The PaaS service gets a private IP address in your VNet. You can then disable public internet access to the service entirely. Benefits: Data exfiltration prevention (no traffic leaves the Microsoft network), compliance (satisfy regulations requiring private connectivity), no NAT or gateway overhead. Private Endpoints work across VNet peering and ExpressRoute. They are different from Service Endpoints, which keep traffic on the Microsoft backbone but use the service's public endpoint and cannot be used to disable public access entirely.

Azure disaster recovery at the regional level uses region pairs — each Azure region is paired with another region in the same geography (e.g., East US ↔ West US, North Europe ↔ West Europe). Benefits: Sequential updates (Microsoft never updates paired regions simultaneously, reducing update-related outage risk). Data residency (replication within the same geography for compliance). Key services: Azure Site Recovery: VM replication and failover orchestration across regions. Geo-redundant storage (GRS): Blob Storage replicates asynchronously to paired region. Active Geo-Replication (Azure SQL): readable secondary databases in other regions. Cosmos DB multi-region writes. Failover groups for Azure SQL with automatic failover. Design for both RTO (recovery time) and RPO (data loss tolerance) — different services offer different guarantees.

Log Analytics workspaces are the central data store for Azure Monitor logs — all diagnostic logs, activity logs, VM agent logs, and application logs are collected here. KQL (Kusto Query Language) is the query language used to analyze this data. KQL is a read-only, declarative query language with a pipe (|) syntax: AzureActivity | where OperationName == "Delete" | summarize count() by Caller | order by count_ desc. Key operators: where (filter), project (select columns), summarize (aggregate), extend (add calculated columns), join (merge tables), parse (extract fields from strings), render (visualize as chart). KQL powers Azure Monitor alerts, workbooks, Application Insights analytics, and Microsoft Sentinel security queries. Proficiency in KQL is a key skill for Azure operations engineers.