Short, honest write-ups of the ideas that come up in interviews and on the job. Each one teaches the concept properly, cites the Microsoft documentation, and points back to the class that drills it until it sticks.
A connection string in a config file is a breach waiting for a git push. Key Vault is the central, access-controlled store those secrets go instead — so your code holds a reference, never the secret itself.
You pick one in every create dialog and never think about it again. But the subscription is three boundaries wearing one name — management, billing, and scale — and where you draw it shapes everything inside.
Both are layer-7, both route by URL, both bolt on a WAF — so people pick wrong. The difference is one word: where. One lives inside a single region; the other lives at Microsoft's global edge.
Trust, not secrets: the workflow trades a short-lived token for an Azure token at run time. The concept, the full four-step wiring with the CLI and the YAML, the subject-claim rules that trip everyone, and the three failures you will hit.
Most overspend is not clever waste — it is idle VMs, over-sized everything, and pay-as-you-go prices on workloads that run all year. The levers that move the bill, in order of effort to payoff.
The prepared runway: what a landing zone is, the eight design areas, the six CAF phases around it, and the Corp vs Online fork — which splits workloads by connectivity intent, not importance. Includes the honest case for small shops not building the full tree.
Kusto Query Language looks intimidating until you see the trick: start with a table and push it through a pipe, one small operator at a time. Learn five of them and you can answer real questions about your environment today.
One is Azure's own language, stateless and native. The other is the multi-cloud standard that keeps a ledger of everything it built. An honest comparison — and why the choice is rarely a religion.
A network security group is a free packet filter that reasons about IP addresses and ports. Azure Firewall is a managed service that reasons about names and threats. They work at different altitudes — mature networks run both.
Azure keeps multiple copies of everything in a storage account — the only question is where. One letter of the redundancy setting is the difference between surviving a dead drive and surviving a dead region.
Both are the same object underneath — the difference is who holds the password. Plus the keyless options ranked: managed identity inside Azure, workload identity federation outside it, a certificate only when neither fits, and how to migrate off a secret with no downtime.
A private endpoint drops a real network card, with a private IP from your own subnet, in front of a public Azure service. Here is what that actually means, how it differs from a service endpoint, and the one DNS gotcha that trips everyone.
Not a folder, not a billing bucket, not a security boundary — although it touches all three. A resource group is a lifecycle boundary, and once that clicks, half of Azure's organizational rules stop feeling arbitrary.
One short, honest Azure note at a time — plus the occasional hiring signal. No spam, no card, unsubscribe in one click.