Azure Book

UPDATE D 2020 E DITION
E-book Series
E-book Series
The Developer’s
Guide to Azure
NEW CONTENT ON:
Web, Databases, AI & Machine Learning,
Security, and DevOps
The Developer’s 2
Guide to Azure
03 / 43 / 90 /
Introduction Chapter 3: Securing you Chapter 6: Deploying your
We’re here to help application services and reducing costs
How can Azure help to secure your How can Azure deploy your services
application? and reduce costs?
05 / Encryption
Azure Security Center
Infrastructure as Code
Azure Blueprints
Logging and monitoring Containers in Azure
Chapter 1: Getting started
Tracking your Azure usage
with Azure Creating a billing alert
What can Azure do for you?
Where to host your application? 55 / How to use your billing APIs?
Where to deploy, and when?
Azure App Service features
Azure Functions
Chapter 4: Adding
intelligence to your
Azure Logic Apps
Azure Batch application 102 /
Containers How can Azure integrate AI into
What to use, and when?
Chapter 7: Share your code,
your application?
Making your application more track work, and ship software
performant Cognitive Services How can Azure help you plan smarter,
Azure Front Door Azure Cognitive Search collaborate better, and ship your
Azure Content Delivery Network Azure Bot Service applications faster?
Azure Cache for Redis Azure Machine Learning Studio Azure Boards
Azure Security Developer tooling for AI Azure Repos
DevOps AI and mixed reality Azure Pipelines
Developer tools Using events and messages in your Azure Test Plans
application Azure Artifacts
GitHub
29 /
75 /
Chapter 2: Connecting your
application with data
111 /
Chapter 5: Connecting
What can Azure do for your data? your business with IoT Chapter 8: Microsoft Azure
Where to store your data? and gaining insights in action
Azure SQL Database How can Azure connect, secure, Navigating the Azure portal
Azure Cosmos DB manage, monitor, and control Developing your first web application
Azure Database for MySQL, your IoT devices in the cloud? and database on Azure
PostgreSQL, and MariaDB Azure IoT Hub Extending applications with Logic
Azure Storage Azure IoT Central Apps and Cognitive Services
Azure data analytics solutions Azure IoT Edge Ready for production
Azure Digital Twins
Azure Sphere
Azure Maps
Windows for IoT
124 /
Azure RTOS
Chapter 9: Summary and
Learn more about Azure IoT
resources
Keep learning with Azure
About the authors
February Lorem ipsum dolor sit
Theamet,
Developer’s
consectetur 3
2018 adipiscing elit Guide to Azure
The
This guide is designed for developers and architects
who are starting their journey into Microsoft Azure.
In this guide, you’ll learn how to get started and
which services you can use for your scenarios.
Developer’s From creating websites, databases, and

desktop and mobile applications to integrating
the latest technologies into your application,
Guide to Azure does the heavy lifting for you. Azure

services are designed to work together so you
can build complete solutions that last for the
Azure
lifetime of your application.
The Developer’s 4
Guide to Azure
We’re here You can also get help through other channels,
such as:
to help Documentation and guides that give you an

overview of everything in Azure and provide
deep insights through the documentation of each
feature.
We can assist you in a variety of ways to suit
your needs. Service License Agreements (SLAs), which can
inform you about our uptime guarantees and
With our support plans, you’ll get access to Azure downtime credit policies.
technical support teams, guidance for cloud design,
and assistance with migration planning. You can @Azure on Twitter, which is the account to follow
even acquire a support plan that guarantees a for news and updates from the Azure team and
response from the technical support teams within community.
15 minutes.
@AzureSupport on Twitter, which is operated by
skillful Azure engineers who respond quickly to
issues that you tweet to them.
Azure Community Support, which provides a

place for discussion with the Azure community and
contains answers to community questions.
Azure Advisor, which automatically makes

personalized recommendations for your Azure
resources, including what you need to do to be
more secure, have higher availability, increase
performance, and reduce costs.
Azure Service Health, which gives you a

personalized view of the health of your Azure
services.
Stack Overflow, which provides answers to Azure

questions and includes many active posts by
members of the Azure engineering teams.
Theamet,
Developer’s
consectetur 5
01 /
Mus ma dolor Duntiaspel is vel estotatem qui qui sitatio
nsedit, ea sere volor molupta dolut officto
duciuscit, odit blaut omnimenem fugitas et omnihil

lestibea veliquia conem estiae quidi aut
volupis as volo facearchilit quidelia peri conserrum, qui

utaquiasit utaquiae reperum re et fugitibus
eos et libusci re porepedit faciminciae lant et dolorpos et

volum se doloreh endigenis pratibus quis
duntem commo in natem.
es nit etur sit Sedicil labores citatem natem sedit autet

volorit, quos ut lameniatur? Um enimagnis
Getting
You’ve made the decision to build applications
dolum earum minctur simillab is arum quatinverro
on the cloud, and now you want to get started.
te destibus, tem adis eum rehenia si
You don’t need to do much—just sign up for
omnimusam
an Azure free veni nossita.
account. This includes 12 months
started
of free services, including $200 in credits for
30 days, enabling you to explore paid Azure
services, and over 25 services that you can use
with
for free ad infinitum.
Simply choose which programming languages,

tools, platforms, and frameworks you want to
Azure
use, and then start running your applications
on Azure.
The Developer’s 6
Guide to Azure
What can Azure

do for you?
Whether you’re just starting out, writing code
for fun, or a professional developer, developing
with Azure puts the latest cloud technology and
best-in-class developer tools at your fingertips
and makes it easy to build for the cloud in your
preferred language.
With Azure, you can get your work done faster, take
your skills to the next level, and imagine and build
tomorrow’s applications today.
Let’s dive in and see what you can do.

The Developer’s 7
Guide to Azure
Where to host
Azure App Service comprises the following:
your application?
Web Apps: As one of the most widely used
Azure services, Web Apps can host your web
applications or APIs. A web application is basically
an abstraction of a web server, such as Internet
Information Services (IIS) or Tomcat, that is used to
Azure offers services designed to provide what you host HTTP-driven applications. Web Apps can host
need to deliver and scale every application. When applications written in .NET, Node.js, Python, Java,
you use Azure services to run your application, you or Go, and you can use the available extensions to
get scalability, high availability, a fully managed run even more languages.
platform, and database services. Azure also offers
the following options for running your application.
QUICK
START
Create an ASP.NET Core web app
Azure App Service in Azure
You can host your applications in a fully managed

application platform loved by all developers: Azure Mobile Apps: Provide a back end for your mobile
App Service. Azure App Service is a collection applications with Mobile Apps. When you host
of hosting and orchestrating services that share an API in Mobile Apps, your mobile applications
features and capabilities. All services in App Service connect with it through the cross-platform client
have the capability, for example, to secure an software development kit (SDK). This is available for
application using Azure Active Directory and can iOS, Android, and Windows. Mobile Apps provides
use custom domains. features such as offline sync and push notifications
to help you create a modern, performant, and
secure mobile experience.
The Developer’s 8
Guide to Azure
Azure App Deployment slots
Service features
After deploying a new version of your application to
a deployment slot, you can test whether it works as
expected and then move it into your production slot.
By setting up staging environments in Azure App

Azure App Service is one of the key services in Service, you can route a percentage of traffic from
Azure that you can use to host your applications your production application to a deployment slot. For
created with popular frameworks—.NET, .NET Core, example, if you shunt 10 percent of your users to the
Node.js, Java, PHP, Ruby, or Python—in containers, new version of your application in the deployment slot,
or running on any operating system (OS). Azure you can see whether the new features are functioning
App Service also adds the power of Azure to your as expected and whether users are using them.
applications, including security, load balancing,
autoscaling, and automated management. When you’re satisfied with how the new version of
your application is performing in the deployment
Each of these services brings unique capabilities to slot, you can carry out a “swap,” which exchanges
the table, but they all share some common features: the application in the deployment slot with that in
your production slot. You can also swap from the
Scaling development slot to a staging slot, and then to the
production slot. Before doing this, the swap operation
Azure App Service runs on App Service plans, verifies that the new version of your website is warmed
which are abstractions from virtual machines (VMs). up and ready to go. When this has been confirmed,
One or more VMs run your Azure App Service, but the swap operation switches the slots, and your users
since Azure takes care of them, it’s not necessary for now see the new version of the application—with
you to know which ones. You can, however, scale no downtime. You can also swap back and revert the
the resources that run your Azure App Service. deployment of the new version.
You can either choose a higher pricing tier (ranging You use deployment slots within environments such
from free to premium) or increase the number of as development, test, or production. You don’t use
application instances that are running. It’s even deployment slots as environments because they all
possible to have Azure App Service automatically reside in the same App Service plan.
scale the number of instances for you, based on a
schedule or metric, such as CPU, memory, or HTTP
queue length.
The Developer’s 9
Guide to Azure
Those should be separated for security, scaling, Connect to on-premises resources

billing, and performance. You can swap
deployment slots manually through the Azure You can connect external resources such as data
command-line interface (CLI) and the Azure stores to your App Services. These resources don’t
Management API. This allows DevOps tools to need to be located in Azure; they can be anywhere,
perform swap operations during a release. such as on-premises or in your own datacenter.
Depending on your requirements, you can connect
Continuous Deployment to services on-premises through many mechanisms,
such as Azure Hybrid Connections, Azure Virtual
To publish your application to App Service, you can Networks, and Azure ExpressRoute.
use services such as Jenkins and Octopus Deploy.
You also can use the continuous deployment (CD) Custom domains and Azure App
feature in App Service. This makes it possible for Service certificates
you to create a build-test-release pipeline right in
App Service. When you spin up an application in Azure
App Service, it exposes a URL—for example,
The process does the following: https://<your custom name>.azurewebsites.net.
Most likely, you will want to use your own custom
1. Retrieves the latest source code from the domain, which you can do by mapping that domain
repository that you indicate name to App Services. Here’s how to do that.
2. Builds the code according to a template that Additionally, you can ensure that your application is
you pick (ASP.NET, Node.js, Java, and so on) served over HTTPS by using an SSL/TLS certificate.
Just bring your own certificate, buy one directly
3. Deploys the application in a staging from the Azure portal, or create a free App
environment and load-tests it Service Managed Certificate. When you buy an SSL
certificate from the Azure portal, you buy an Azure
4. Deploys the application to production after App Service certificate. You can configure this to be
approval (you can indicate whether you want to used by your custom domain bindings.
use a deployment slot)
App Service Managed Certificates are free, are
issued by DigiCert, and offer the option to secure
your web applications hosted using a custom
The Developer’s 10
Guide to Azure
sub-domain. They are also managed by App Service end. For this scenario, you can use an Azure App
and are renewed automatically. Service Environment. This affords you a very high
scale and gives you control over isolation and
STEP BY network access.
STEP
Purchase and configure an SSL
certificate in this walk-through Snapshot Debugger for .NET
Debugging applications can be difficult, especially

App Service Environment if the application is running in production. With the
Application Insights Snapshot Debugger feature
In a multitier web application, you often have a of Azure Monitor, you can take a snapshot of your
database or services used by your application in in-production applications when code that you’re
Web Apps. Ideally, you want these services to be interested in executes.
exposed only to the application and not to the
internet. Given that it provides the entry point for The Snapshot Debugger lets you see exactly what
your users, however, the application itself is often went wrong without impacting the traffic of your
internet-facing. production application. The Snapshot Debugger
can help you to dramatically reduce the time it
To isolate these support services from the internet, takes to resolve issues that occur in production
you can use Azure Virtual Network. This service environments. Additionally, you can use Visual
wraps your support services and connects them to Studio to set snap points to debug step by step.
your application in Web Apps so that the support You can view the results in the Azure portal or
services are exposed only to the application, and within Visual Studio.
not to the internet.
Automatic OS and .NET
This article describes this service in more detail and Framework patching
shows you how to use it.
Because you’re using a fully managed platform,
Sometimes, you want even more control. Maybe you don’t manage your own infrastructure at all,
you want your application to be wrapped in a but you do benefit from automatic OS and
virtual network in order to control access to it. framework patching.
Perhaps you want it to be called by another

application in Web Apps and be part of your back
Guide to Azure
Virtual machines
Hosting your application in a VM in Azure Virtual

Machines provides you with a lot of control over
how you host your application. However, you’re
responsible for maintaining the environment,
including patching the OS and keeping antivirus
programs up to date.
You can use a VM to test the latest preview version

of Visual Studio without getting your development
machine “dirty.”
Azure DevTest Labs and Azure Lab Services

provide the ability to set up lab environments in
Azure. These services enable developer teams to
more easily manage developer VM resources and
costs in the cloud.
Azure DevTest Labs allows you to set up an

environment for your team. Users connect to VMs
in the lab, and use them for their day-to-day work
and short-term projects. This enables the lab admin
to analyze costs and usage, as well as set policies to
optimize the team’s costs.
Azure Lab Services lets you create managed lab

types. The service handles all the infrastructure
management for the lab, from spinning up VMs to
handling errors and scaling the infrastructure.
Guide to Azure
Azure
Input and output bindings connect your function
code to other services, including Azure Storage,
Functions
Azure Cosmos DB, Azure Service Bus, and even
third-party services such as Twilio and SendGrid.
Using Azure Functions, you can build small pieces
of functionality quickly and host them in an elastic
environment that automatically manages scaling.
With Azure Functions, you can write the code you
need for a solution without worrying about building With Azure Functions, it’s possible to pay only
a full application or the infrastructure to run it. for functions that run, rather than having to keep
A function is a unit of code logic that’s triggered compute instances running all month. This is also
by an HTTP request or an event in another Azure called serverless because it only requires you to
service, or is based on a schedule. create your application—you don’t have to deal with
any servers or even the scaling of servers.
Some of the key features of Azure
Functions include: You can write Azure Functions in .NET, JavaScript,
Java, and a growing list of languages.
• Automated and flexible scaling – Keep the
focus on adding value instead of managing
An application that uses Azure Functions activates
infrastructure.
a function every time a new image file is uploaded
to Azure Blob storage. The function then resizes the
• Choice of language – Write functions using
image and writes it to another Blob storage account.
your choice of C#, Java, JavaScript, Python, and
PowerShell.
Data from the blob that triggered the function is
passed into the function as the myBlob parameter,
• End-to-end development experience – From
which includes the Blob URL. Use the outputBlob
building and debugging to deploying and
output binding parameter to specify which Blob
monitoring with integrated tools and built-in
to write the result to. There’s no need to write the
DevOps capabilities.
plumbing for connecting to Blob storage; you just
• Simplified integration – Easily integrate with configure it.
Azure services and software-as-a-service (SaaS)
offerings.
EXERCISE
Create your first Azure function
• Pay-per-use pricing – Pay only for the time using the Azure portal
spent running your code, with a Consumption
hosting plan.
Guide to Azure
Cold start/warm start
When Azure Functions has been sitting idle,

hasn’t been used for a while, and is scaled to zero
instances, when new events come in, a new instance
needs to be specialized with your application
running on it. Specializing new instances may take
some time (latency) before the first event can be
handled. This occurs automatically behind the
scenes and applies to both Consumption and App
Service Plan pricing.
With the Azure Functions Premium plan, you can

configure the number of pre-warmed instances to
eliminate cold start latency. The Azure Functions
application will maintain the specified number of
pre-warmed instances to more readily scale up to
handle new events.
Guide to Azure
Azure
2. Using the data in the email, the logic app
checks on the availability of the ordered item in
Logic Apps
SQL Server.
3. Using Twilio, the logic app sends a text message

to the customer’s phone indicating that the
order was received and that the item has
You can orchestrate business logic with Logic Apps been shipped.
by automating a business process or integrating
with SaaS applications. Just like in Azure Functions,
QUICK
Logic Apps can be activated by an outside source, START
Get started with Azure
for instance, a new message. Weaving together Logic Apps
API calls to connectors, you can create a (possibly
complex) workflow that can involve resources both
in the cloud and on-premises. Power Automate
Logic Apps has many available connectors to APIs Microsoft Power Automate is a SaaS offering for
that can connect to Azure SQL Database, Salesforce, automating workflows across the growing number
SAP, and so on. of applications and SaaS services that business users
rely on. While Logic Apps is aimed more toward a
You can also expose your own APIs or Azure
developer audience, Microsoft Power Automate is
Functions as connectors to use in a logic app,
targeted toward business users, administrators, and
making it possible for you to easily perform actions
office workers.
against external systems in your workflow or have
your logic app be activated by one of them. Microsoft Power Automate offers an easier path
toward simple integration workflows. Logic Apps
Just like Azure Functions, Logic Apps is serverless
offers the ability to extend Power Automate with
and scaled automatically, and you pay for them only
more advanced workflow capabilities. An example
when they’re running.
of additional capabilities that Logic Apps offers is
the ability to run inline code within the workflow.
The following is an example of a workflow in
Logic Apps: Logic Apps versus Power Automate
1. The logic app is activated when an email Both Microsoft Power Automate and Logic Apps
containing a shipping order arrives in offer designer-first integration services that can
Office 365. create workflows. Both services can integrate with
various SaaS and enterprise applications; however,
they are both targeted at different users.
Guide to Azure
Here’s a side-by-side comparison to help

determine when to use Power Automate or
Logic Apps for a particular integration scenario:
Table 1-1: What to use when

Choosing between Power Automate and Logic Apps
Power Automate
Business Logic Apps
needs
Pro integrators and developers,

SharePoint admins
Users IT pros
Self-service Scenarios Advanced integration
In-browser and mobile In-browser and Visual Studio Code

application, UI only
Design tool view available
Design and test in non-production Application life DevOps: source control, testing,
environments; promote to cycle management support, automation, and manageability
production when ready ((ALM)
(A LM) in Azure Resource Manager
Manage Power Automate

Manage resource groups, connections,
environments and data loss prevention
(DLP) policies, track licensing: Power
Admin experience access management, and logging:
Azure portal
Automate Admin Center
Security assurance for Azure: Azure

SharePoint admins
Security security, Azure Security Center,
audit logs
Guide to Azure
Azure Batch
If you need to run large-scale batch or high-
performance computing (HPC) applications on
VMs, you can use Azure Batch. Batch creates and
manages a collection of thousands of VMs, installs
the applications you want to run, and schedules
jobs on the VMs. You don’t need to deploy and
manage individual VMs or server clusters; Batch
schedules, manages, and autoscales your jobs so
you only use the VMs you need.
Batch is a free service, so you only pay for the

underlying resources consumed, such as VMs,
storage, and networking.
Batch is well suited to running parallel workloads

at scale, such as financial risk models, media
transcoding, VFX, 3D image rendering, engineering
simulations, and many other compute-intensive
applications. Use Batch to scale out an application
or script that you already run on workstations or an
on-premises cluster, or develop SaaS solutions that
use Batch as a compute platform.
TUTORIAL
Get started on Azure Batch with
these step by step tutorials
Guide to Azure
Containers
In addition, you pay only for the agent nodes within
your clusters, not for the masters. As a managed
Kubernetes service, AKS provides automated
Kubernetes version upgrades and patching, easy
cluster scaling, a self-healing hosted control plane
While much more lightweight, containers are
(masters), and cost savings, since you only pay for
similar to VMs, and you can start and stop them in
running agent pool nodes.
a few seconds. Containers also offer tremendous
portability, which makes them ideal for developing With Azure handling the management of the nodes
an application locally on your machine and in your AKS cluster, there are many tasks that you
then hosting it in the cloud, in test, and later in don’t have to perform manually, such as cluster
production. upgrades. Because Azure handles these critical
maintenance tasks for you, AKS does not provide
You can even run containers on-premises or in
direct access (such as with SSH) to the cluster.
other clouds—the environment that you use on
your development machine travels with your
container, so your application always runs in the QUICK
START
same ecosystem. Get started with Azure
Kubernetes Service
Scale and orchestrate containers with
Azure Kubernetes Service Host containers with Azure
Container Instances
Azure Kubernetes Service (AKS) makes it simple to
create, configure, and manage a cluster of VMs that You can host your container using Azure Container
are preconfigured to run containers with support Instances. Container Instances provides fast,
for both Linux and Windows containers. This means isolated compute to meet traffic that comes in
that you can use your existing skills to manage and spikes, without the need to manage servers. For
deploy applications that run in containers on Azure. example, AKS can use Virtual Kubelet to provision
pods inside Container Instances that start in
AKS reduces the complexity and operational
seconds. This enables AKS to run with just enough
overhead of managing a Kubernetes cluster by
capacity for an average workload. As you run out
offloading much of that responsibility to Azure. As
of capacity in your AKS cluster, you can scale out
a hosted Kubernetes service, Azure handles critical
additional pods in Container Instances without
tasks such as health monitoring and maintenance.
any additional servers to manage. The Container
Guide to Azure
Instances service is billed per second, per virtual You can also use Container Registry for your
CPU, per gigabyte, or by memory usage. existing container development and deployment
pipelines. Use ACR Build to build container images
QUICK in Azure. You can either build on demand or fully

START automate builds with source code commit and base
Container Instances image update build triggers.
Azure Service Fabric

Host containers in Azure App Service Web
App for Containers Another way to run applications in Azure is with
Azure Service Fabric. This is actually the service
Web App for Containers helps you to easily deploy
that runs many of the Azure services inside
and run containerized web applications at scale.
Microsoft, such as Azure SQL Database and Azure
Just pull container images from Docker Hub or a
App Service. Run your applications in Service Fabric
private Azure Container Registry, and Web App for
to achieve high availability, run at massive scale, and
Containers will deploy the containerized application
perform rolling upgrades.
with your preferred dependencies to production
in seconds. The platform automatically takes care
You can use Service Fabric to run .NET microservice-
of OS patching, capacity provisioning, and load
based applications—solutions that consist of
balancing. You can run Docker containers on Linux
many small services that talk to each other and are
and Windows using Web App for Containers.
employed by user interfaces and other components.
Service Fabric is ideal for solutions such as these
With Web App for Containers, your applications are
because it orchestrates application components
hosted using a pre-defined application stack based
together and runs them in a highly available and
on a Docker container. The Docker containers,
performant manner.
both Windows and Linux, can be deployed from
any Docker registry, such as Docker Hub, Azure
Service Fabric is unique in that you can run it
Container Registry, and GitHub.
anywhere. Install it on your local development
computer, on-premises, or in any cloud—including
Azure Container Registry
Azure. You can also use Azure Service Fabric Mesh
to run containers on a Service Fabric cluster that
Once you’ve created a container image to run your
Microsoft manages for you as a service. This opens
application in, you can store that container in Azure
up a lot of possibilities.
Container Registry, which is a highly available and
secure storage service, specifically built to store It’s easy to deploy applications to Service Fabric
container images. This is great for storing your and manage them with your favorite tools, such
private Docker images. as Visual Studio and Azure DevOps. In addition,
Service Fabric recently became open-source.
Guide to Azure
What to use,
Some of the services that run your application in
Azure can work together in a solution, while others
and when?
are more suited to different purposes.
While this can make it difficult to pick the right

services, Table 1-2 will help you to identify which
services in Azure are right for your situation:
Table 1-2: Deciding the right service

A quick summary on choosing an Azure service in various scenarios
Run your
Business
Monolithic Mobile application Microservice
Compute- process
and N-tier application anywhere architecture
intensive jobs orchestration
applications back end (including applications
on-premises)
Web Apps*
Web App for

Containers*
Mobile
Apps*
Functions
Logic Apps
Virtual † †
Machines*
Kubernetes
Service*
Service
Fabric*
Container
Instances*
Batch*
* Services with an asterisk have a free tier that you can use to get started at no cost.
† For lifting and shifting existing applications to Azure.
Guide to Azure
Making your Azure Traffic Manager
application more
Many modern applications have users all over
the world. Providing a performant experience for
everyone is challenging, to say the least. The most
performant obvious problem you need to deal with is latency,

the time it takes for a signal or a request to travel
to a user. The farther away users are from your
application, the more latency they experience.
After your application is up and running in Azure,
you want it to be as performant as possible. Azure Azure Traffic Manager scales across regions,
provides a range of services that can help you helping to reduce latency and provide users with
with that. a performant experience, regardless of where they
are. Azure Traffic Manager is an intelligent routing
mechanism that you put in front of your Web Apps
applications. Web Apps acts as an endpoint, which
Azure Traffic Manager monitors for health and
performance.
When users access your application, Azure Traffic

Manager routes them to the Web Apps application
that is most performant in their proximity.
Including Azure Traffic Manager in your

architecture is a great way to improve the
performance of your application.
Guide to Azure
Azure
Azure Front Door can help. This service can
route traffic from users to the most performant
Front Door
application endpoint for them to improve
performance. Azure Front Door can route to
available endpoints, while avoiding endpoints that
are down.
Your users may be spread across the globe and, Azure Traffic Manager does this as well, but in a
at times, they may be traveling. This can make it different manner to Azure Front Door. Azure Front
difficult to ensure that they have a performant Door works at OSI layer 7 or the HTTP/HTTPS
experience and that your application is available layer, while Azure Traffic Manager works with
and secure, regardless of location. DNS. In other words, Azure Front Door works on
the application level, and Azure Traffic Manager
works on the network level. This is a fundamental
difference that determines the capabilities of
the services.
Because of this difference, Azure Front Door

does a lot more than route users to available
and performant endpoints.
Azure Front Door allows you to author custom

web application firewall (WAF) rules for access
control to protect your HTTP/HTTPS workload from
exploitation based on client IP addresses, country
codes, and HTTP parameters.
Additionally, Front Door enables you to create rate-

limiting rules to battle malicious bot traffic. These
are just some of the unique capabilities of Azure
Front Door.
Guide to Azure
Other capabilities of Front Door include:
• URL-based routing • SSL termination

This allows you to route requests for different With this, you can secure your traffic end to
URLs to different back-end pools (applications end, from the browser to the application in the
that receive traffic, such as Web Apps). For back-end pool.
instance, http://www.contoso.com/users/*
goes to one pool, and http://www.contoso. • Session affinity
com/products/* goes to another. When you want users to be sent to the same
endpoint every time, session affinity is useful.
• URL rewrite This is important in cases where the session
This enables you to customize the URL that you state is saved locally on the back end for a user
pass on to the back-end pool. session.
If you need help choosing between Azure Front

Door and Traffic Manager, consider this guidance:
Table 1-3: Selecting the best option

Choosing between Front Door and Traffic Manager
You only need routing (performance-

or geography-based) and high
availability Manager
Manager
You need SSL termination (also called

Y
Azure Front
Front
Door
You need application layer features such
Y
as
a URL rewriting and WAF
Guide to Azure
Azure Content
Not only is this easy to do, but it also improves
the performance of your application in the
Delivery Network
following ways:
• It offloads serving content from your

application. Since it is now served by Content
Delivery Network, it frees up processing cycles
One of the Azure services that can help you to make for your application.
your application faster is Azure Content Delivery
Network. You upload your static files—videos, • It brings static content physically closer to your
images, JavaScript, CSS, and even static HTML users by distributing it to PoPs all over the
files—to a data store, such as Azure Blob storage, world.
and then couple Azure Content Delivery Network
to that.
You can benefit from Content Delivery Network in
Content Delivery Network will then take those static web applications as well as in mobile and desktop
files and replicate them to hundreds of points of applications. One way to use Content Delivery
presence (PoP) all over the world. All you need to Network is to serve videos for a mobile application.
do in your application is change the reference to Since videos can be large, you don’t want to store
the static files to a different URL. them on the mobile device—and neither do your
users. Using Content Delivery Network, the videos
For example, the previous reference might have are served from the PoP. Since it is close to the user,
been ~/images/image.png, and it would now be this also improves performance.
https://example.azureedge.com/image.png.
QUICK
START
Get started with Azure Content
Delivery Network
Guide to Azure
Azure Cache
This can improve the performance of your
application dramatically. Here’s how this
for Redis
workflow operates:
1. The application needs some data and attempts

to retrieve it from the cache.
Every modern application works with data. When 2. If the data is not there, the application gets
you retrieve data from a data store such as a it from the database and stores the data in
database, this typically involves scanning multiple the cache.
tables or documents in some distant server,
weaving the results together, and then sending the 3. The next time the application searches for that
result to the requesting device. This, of course, takes piece of data, it will find it in the cache, saving a
time and can frustrate and annoy your users. trip to the database.
To eliminate some of these “roundtrips,” you can Azure provides Cache-as-a-Service with Azure
cache data that doesn’t change often. This way, Cache for Redis. This is based on the open-
instead of querying the database every time, you source Redis project and is now backed by
can retrieve some of the data from a cache, like industry-leading SLAs. It is highly performant
Azure Cache for Redis. The benefit of the cache is and has advanced options, such as clustering
that it stores data in a simple format, such as key- and geo-replication.
value. You don’t need to run a complex query to get
this data—you just need to know the key to retrieve
EXERCISE
the value. Get started with Azure Cache
for Redis
Guide to Azure
Azure Security
Here are some of the Azure security services that
will help you to create secure solutions:
• Azure Active Directory – Synchronize on-

premises directories and enable single sign-on.
Security is always a concern for any application.
One of the best reasons to use Azure for your • Key Vault – Safeguard and maintain control of
applications and services is to take advantage of keys and other secrets.
its wide array of security tools and capabilities.
These tools and capabilities help to make it possible • Azure Sentinel – Put cloud-native SIEM and
to create secure solutions on the secure Azure intelligent security analytics to work to help
platform. Azure provides confidentiality, integrity, protect your enterprise.
and availability of customer data, while also
enabling transparent accountability. • Security Center – Unify security management
and enable advanced threat protection across
There are encryption features supported by many hybrid cloud workloads.
Azure services that enable the encryption of
data at rest and encryption in transit. Azure Disk • Application Gateway – Build secure, scalable,
Encryption, Azure Storage Service Encryption, and and highly available web front ends in Azure.
others ensure that data is kept secure when stored
In Chapter 3, Securing your application, we’ll dive a
on disk or within a storage account. Other features,
little deeper into securing your applications.
such as SSL/ TLS support, encrypt data that’s
transferred over HTTPS or Azure service REST
API endpoints.
Guide to Azure
DevOps
Azure includes a number of services that are used
by development teams to implement DevOps
within their teams and organizations. DevOps
teams implement a similar set of workflows
and processes:
There are a few different aspects that encompass
what DevOps is and what it means for every
• Share code, track work, and ship software.
development team and organization. The
word itself is a combination of “Dev” and “Ops”
• Plan, track, and discuss work across the team.
that refers to the removal of silos between
development and operations teams, encouraging • Implement continuous integration and
collaboration across different disciplines and continuous delivery (CI/CD) to deliver value in
the adoption of shared processes and tools. short increments.
Essential DevOps practices include agile planning,
continuous integration, continuous delivery, and
GitHub
the monitoring of applications.
GitHub offers a number of DevOps features, the
“DevOps is the union of people, process, and
most notable of which is the ability to create,
technology to enable continuous delivery of value to
manage, and use Git repositories. This includes
our end users.”
additional capabilities for teams to communicate
— SAM GUCKENHEIMER
on work being done through GitHub Issues, and
manage the process of merging code by using the
GitHub Pull Request functionality.
N
I O
N CO AT
LA N R
DE
P TI G GitHub includes several tools that support every

N TE
PL
U IN part of your workflow:

O
OY
U
S
FE
ED
US BA
• GitHub Actions – CI/CD workflow automation
BU
UO CK
ILD
TI
N TE to build, test, and deploy your code from
N E RA
CO OP GitHub.
Figure 1-1: Essential DevOps practices • GitHub Advanced Security – Use advanced
features to secure your code by discovering
Guide to Azure
vulnerabilities with Semmle’s semantic code and private sources, and integrate package
analysis engine, CodeQL. sharing into your CI/CD pipelines.
• GitHub Open Source Security – Report and • Azure Repos – Provide Git repositories for
disclose security vulnerabilities in open-source source control of your code.
code through security policies on projects to let
communities know the best way to responsibly DevOps integration
report vulnerabilities.
You can also use your favorite DevOps toolchain.
• GitHub Packages – Safely publish and consume Azure provides integration with popular open-
packages within your organization or across the source and third-party tools and services. The
entire world. various Azure DevOps services can also be used in
multiple combinations of configurations integrated
Azure DevOps with your favorite DevOps toolchain.
Azure offers several services to more easily You could use Azure Pipelines or deploy directly
implement DevOps practices within your team and to the Azure platform from your favorite CI/CD
organization. The Azure DevOps Services can be solution, such as Jenkins.
used individually or in combination with each other:
Azure services, third-party DevOps tools, and
• Azure Pipelines – Provide build and release related products all work together to help meet the
services to support continuous integration and most common business needs and scenarios.
the delivery of your applications.
• Azure Boards – Deliver a suite of Agile tools

to support the planning and tracking of work,
code defects, and issues using the Kanban and
Scrum methods.
• Azure Test Plans – Provide tools to

perform manual/exploratory testing of
your applications.
• Azure Artifacts – Allow teams to share Maven,

npm, PyPi, and NuGet packages from public
Guide to Azure
Developer tools Command-line tools are also available for

managing Azure services and applications using
scripts. The Azure CLI is a set of commands
used to create and manage Azure services that
is compatible with Windows, macOS, and Linux.
Azure supports a comprehensive set of
Azure PowerShell is a set of cmdlets that allows
development tools for any developer—using
for the managing of Azure resources from the
any platform or language—to deliver cloud
PowerShell command line.
applications. Code with the language of your choice
using a range of SDKs and take advantage of full-
GitHub
featured integrated development environments
(IDEs) and editors with advanced capabilities and GitHub, the world’s leading developer platform, can
built-in Azure support. be seamlessly integrated with Azure.
Your tool of choice GitHub Enterprise can be used to securely bring

open-source code and best practices to your
You can also use the development tools you already
enterprise projects. Flexibility, security, compliance,
know. This enables you to develop and deploy from
and deployment controls make it easy for your team
both Microsoft and open-source developer tools
to use GitHub Enterprise wherever you need it.
seamlessly integrated with Azure:
The features of GitHub can also be easily integrated
• Visual Studio
with several DevOps services within Azure DevOps.
• Visual Studio Code For example, you could use Azure Pipelines to build
• Azure Toolkit for Eclipse and deploy code that resides in a GitHub repository.
• Azure Toolkit for IntelliJ

Further reading
• Azure tools for Maven
If you want to learn more about using Azure
Developers have their tools, languages, and Kubernetes Service, Azure Container Instances,
frameworks of choice, and Azure supports a wide and other Azure services to create distributed
array of developer options. applications, download and read the following
free resources:
SDKs and command-line tools
RESOURCE
Azure includes a collection of SDKs for .NET, Node. HUB
js, Python, Java, and more. These are built on a Learn Azure in a Month of
Lunches
common core for easy use of Azure services,
with a focus on consistency, familiarity, and
Azure Fundamentals
language idiomaticity.
Theamet,
Developer’s
consectetur 29
02 /




Connecting
omnimusam veni nossita.
your
application
with data
Guide to Azure
What can Azure

do for your data?
Wherever your data is, Azure will help you to unlock
its potential. Support rapid growth and save more
time for innovation with a portfolio of secure,
enterprise-grade database services that support
open-source database engines.
Azure database services are fully managed, freeing

up valuable time so that you can focus on new ways
to delight your users and unlock opportunities,
rather than spending that time managing your
database. Enterprise-grade performance with built-
in high availability means you can scale quickly and
reach global distribution without worrying about
costly downtime.
Developers can take advantage of industry-leading

innovations, such as built-in security with automatic
monitoring and threat detection, automatic tuning
for improved performance, and turnkey global
distribution. On top of all of this, your investment
is protected by financially backed service-level
agreements (SLAs).
Whatever you build, we’ll help you to get it to

market quickly, distribute it widely, and manage it
easily and confidently.
Let’s dive in.

Guide to Azure
Where to store
All services have a free tier that you can use
to get started.
your data? NOTE

You can use almost all storage
options mentioned in this
section as activators and
Azure provides many types of data stores that bindings for Azure Functions.
can help you to maintain and retrieve data in any
scenario. Table 2-1 presents the storage options Let’s take a closer look at each storage option.
available in Azure.
Table 2-1: Which option to use when

A quick summary on storage options
Semi- High- Store Store Geographic Tunable
Relational Unstructured Queue Files
structured performance large small data data
data data messages on disk
data data data replication consistency
SQL
Database*
MySQL*
PostgreSQL*
MariaDB*
Azure
Cosmos DB*
Blob*
Table*
Queue*
File*
Disk*
Data Lake
Store*
SQL Data
Warehouse*
Guide to Azure
Azure SQL
• Transparent Data Encryption (TDE), which
adds a security layer to protect data at rest from
Database
unauthorized or offline access
• Always Encrypted, which protects sensitive

data by storing it encrypted within the database
engine, and encrypting/decrypting it within the
If you want to use tables with columns and rows to store client application to separate those who manage
data, Azure SQL Database is a great choice. A relational the data but should not have access to it
database system similar to on-premises Microsoft SQL
Server, SQL Database runs in the cloud, so it’s fully SQL Database offers several service tiers that are
managed, performant, scalable, automatically backed geared toward specific scenarios:
up, and includes many advanced features.
• General purpose/Standard: This tier offers

With SQL Database, you can do almost everything that
budget-oriented, balanced, and scalable
you can do with on-premises SQL Server. In fact, new
compute and storage options. Fully managed,
SQL Server features are incorporated first in Azure SQL
with performance comparable to Azure SQL
Database and later in on-premises SQL Server.
VMs, this tier is the best option for most
business workloads.
You can use SQL Database with your favorite tools,
including SQL Server Management Studio and Entity
• Business critical/Premium: This tier offers
Framework. Databases in SQL Database are extremely
the highest resilience to failures using several
reliable and robust and offer an SLA that guarantees
isolated replicas. With consistently high I/O, it
99.99 percent uptime.
includes a built-in availability group for high
availability. This is the best option for critical
Here are some of the more advanced features in SQL online transaction processing (OLTP) (normal
Database: CRUD operations) and business applications
with consistently high I/O requirements.
• Geo-replication, which replicates data to other
geographical regions in real time • Hyperscale: This tier offers very large database
(VLDB) support without the headaches. With
• Dynamic data masking, which masks sensitive a built-for-the-cloud architecture of highly
data for certain users at runtime scalable storage and a multilayer cache
optimized for very large and demanding
• Auditing, which provides a complete audit trail of
workloads, it provides low latency and high
all the actions that happen to the data
throughput regardless of the size of data
operations. This is the best tier for very large
• Automatic database tuning, which monitors
and demanding workloads with highly scalable
the performance of your database and tunes it
storage and read-scale requirements.
automatically
Guide to Azure
Azure Cosmos DB
• A free tier, which enables you to develop and
test applications, offering the first 400 RU/s and
5 GB of storage for free for the lifetime of the
account.
Azure Cosmos DB is a new kind of database made In addition to all these features, Azure Cosmos DB
for the cloud. Its key features include: offers different APIs with which you can store and
retrieve data, including SQL, JavaScript, Gremlin,
• A 99.99 percent SLA (up to 99.999 percent for MongoDB, Azure Table Storage, Apache Cassandra,
read and write operations) that includes low and Etcd. Different APIs handle data in different
latencies (less than 10 ms on reads and less than ways. You can use documents as data as well as
15 ms on writes). unstructured tables, graphs, and Blobs. You use the
API that fits your needs, and Azure Cosmos DB takes
• Geo-replication, which replicates data to other
care of the rest.
geographical regions in real time.
You benefit from cloud-grade performance,
• Tunable data consistency levels, so you
scalability, and reliability, while using the
can enable a truly globally distributed data
programming model you’re already accustomed to.
system. You can choose from a spectrum of
data consistency models, including strong
consistency, session consistency, and eventual
TUTORIAL
consistency. Get started with Azure
Cosmos DB
• Traffic Manager, which sends users to the
service endpoint to which they are closest.
• Limitless global scale, so you pay only for the

throughput and storage that you need.
• Multi-master, which allows an account to be

created with multiple write regions enabled.
• Automatic indexing of data, which removes

the need to maintain or tune the database.
Guide to Azure
Azure Database
• Secured protection of sensitive data at rest and
in motion
for MySQL, • Automatic backups and point-in-time restore

for up to 35 days
PostgreSQL, • Enterprise-grade security and compliance
and MariaDB Azure Database for MySQL
Azure Database for MySQL is a relational database

service powered by the MySQL Community Edition
Azure provides MySQL, PostgreSQL, and MariaDB database engine. It is a fully managed database-as-
databases as managed databases, which means a-service offering that can handle mission-critical
that you just spin them up and don’t have to worry workloads with predictable performance and
about any of the underlying infrastructure. Just like dynamic scalability.
Azure SQL Database and Azure Cosmos DB, these
databases are universally available, scalable, highly Azure Database for PostgreSQL
secure, and fully managed.
Azure Database for PostgreSQL is a relational
Each of these databases is suited for slightly database service in the Microsoft cloud built for
different use cases, but in general, their developers. It is based on the community version of
functionality overlaps a lot. You would use Azure the open-source PostgreSQL database engine.
databases for MySQL, PostgreSQL, and MariaDB
when you’ve already been using one of their
Azure Database for MariaDB
on-premises versions and want the advantage of
Azure Database for MariaDB is a relational
having it run fully managed in the cloud.
database service based on the open-source
MariaDB Server engine. It is a fully managed
All three of these offerings provide the following
database-as-a-service offering that can handle
features:
mission-critical workloads with predictable
performance and dynamic scalability.
• Built-in high availability with no additional cost
• Predictable performance
• Scaling as needed within seconds

Guide to Azure
Azure Storage Host static websites on Azure Storage
Another exciting feature of Azure Storage is static

website hosting. This static website feature only uses
Blob storage as its datastore, and you can use it to host
Azure Storage is one of the oldest, most reliable, a static website on Azure Storage. All you have to do in
and most performant services in Azure. Azure order for your website to run is upload the files of your
Storage offers five types of storage that all benefit static website to Blob storage and indicate which file is
from the following shared features: the default document (such as index.html) and which
one is the error document (such as 404. html). Your
• Geo-redundancy, which replicates data to website will run quickly for very little cost—in fact, you
different datacenters so that you can recover it if only pay for the storage you use, and the static website
a disaster causes an individual datacenter to fail feature doesn’t cost anything extra. Additionally, when
you use geo-redundancy (which is enabled by default),
• Encryption of data at runtime your website will be up and running even if your primary
datacenter fails.
• Custom domains
Blob storage
The five Azure Storage types are Blob, Table,
Queue, File, and Disk (Figure 2-1):
Azure Blob storage stores large, unstructured data—
literally, blobs of data. This data can be video, image,
audio, text, or even virtual hard drive (VHD) files for VMs.
There are three types of Blobs: Page, Block, and

Blob Table Queue Append Blobs. Page Blobs are optimized for random
Unstructured Semi-structured Queue
Large Flexible scheme Reliable read and write operations, and are perfect for storing
Page/Block Small messages MSMQ
a VHD.
Block Blobs are optimized for efficiently uploading

large amounts of data. These are perfect for storing
large video files that don’t change frequently.
File Disk
File share Premium High I/O Append Blobs are optimized for append operations,
SMB VM Disks
such as storing operation logs that can’t be updated or
Figure 2-1: Types of storage in Azure
deleted.
QUICK
START
Get started with Azure Blob
storage
Guide to Azure
Table storage with Windows and Linux and access it from either
the cloud or on-premises systems. Like the other
Azure Table storage is an inexpensive, extremely services in Azure Storage, File storage is scalable and
fast NoSQL key-value store that you can use to store inexpensive.
data in flexible tables. A table can contain one row
describing an order and another row describing
STEP BY
customer information. You don’t need to define a STEP
Get started with Azure File
data schema, making Table storage very flexible. storage
TUTORIAL
Disk storage
Get started with Azure Table
storage
Azure Disk storage is similar to File storage but is
specifically meant for high I/O performance. It is
Queue storage perfect for use as a drive in a VM that requires high
performance to run SQL Server, for instance. Disk
Azure Queue storage is an unusual type of storage. storage is available only in the premium pricing tier
While it’s used to store small messages of data, of Azure Storage.
its main purpose is to serve as a queue. You put
messages in the queue and other processes pick Azure Data Lake Storage
them up. This pattern decouples the message
The previous data stores were intended for regular
sender from the message processor, resulting in
application use or for use with VMs. Azure Data
performance and reliability benefits. Queue storage
Lake Storage, on the other hand, is storage for big
is found in previous versions of Windows.
data applications. It provides massively scalable,
secure data lake functionality built on Azure Blob
TUTORIAL storage. You can use it to store large amounts of
data in its native format—structured, unstructured,
Get started with Queue storage
or anything in between. The point of Data Lake
Storage is to hold your raw data so that you can
analyze it or transform and move it.
File storage
You can use Azure File storage as a drive from

which to share files. It uses the Server Message
Block (SMB) protocol, meaning you can use it
Guide to Azure
The following are the main characteristics of Azure Azure Synapse Analytics
Data Lake Storage:
Azure Synapse Analytics (formerly Azure SQL
• Unlimited storage capacity. A single file can be Data Warehouse) brings together enterprise data
larger than one petabyte in size—200 times warehousing and big data analytics. It gives you
larger than what other cloud providers offer. the freedom to query data on your terms, using
either serverless on-demand or provisioned
• Scalable performance to accommodate resources at scale.
massively parallel analytics.
When you need a traditional data warehousing
• Data can be stored in any format, without a solution that is completely managed, scalable in
schema. size, and performant and secure, Azure Synapse
Analytics can provide the solution. Store data
This is a very different approach from the traditional in predefined schemas and query it by using the
data warehouse, in which you define data schemas familiar SQL Server dialect.
upfront.
With Azure Synapse, enabling BI and machine
You can store all of the data that you get from learning is a breeze. It is deeply integrated with
Internet of Things (IoT) devices (collecting Power BI and Azure Machine Learning to greatly
temperature data, for example) in Data Lake expand the discovery of insights from all your data
Storage. You can leave the data in the store and and apply machine learning models to all your
then filter through it to create a view of the data intelligent applications.
per hour or per week. Storing the data in Data Lake
Storage is inexpensive, so you can keep years of Build end-to-end analytics solutions with a unified
data there at a very low cost. experience. The Azure Synapse studio provides a
unified workspace for data prep, data management,
data warehousing, big data, and AI tasks. Data
TUTORIAL engineers can use a code-free visual environment
Get started with Azure Data for managing data pipelines, and business analysts
Lake Storage using the Azure
Portal can securely access datasets and use Power BI to
build dashboards in minutes, all while using the
same analytics service.
STEP BY
STEP
Create an Azure Synapse
Analytics SQL pool
Guide to Azure
Azure data
well as lift and shift your SQL Server Integration
Services (SSIS) packages to the cloud.
analytics EXERCISE
solutions Create a data factory using

the Azure Portal
Azure Analysis Services

Almost as important as storing data is analyzing
it to get insights. Azure provides many services With Azure Analysis Services, you can create a
for data analytics scenarios, enabling you to get semantic model of your data that users can access
valuable and actionable insights from your data— directly with visualization tools such as Power BI.
no matter how large, small, or complex it is. Built on the SQL Server Analysis Services tools that
run on-premises with SQL Server, this service now
Data Factory runs managed in the cloud. This means that the
service is scalable and data is stored redundantly—
Moving and transforming data is not a trivial
and when you aren’t using it, you can pause the
task, but Data Factory can help you to do just
service to minimize costs.
that. Within Data Factory, you can create a
comprehensive pipeline that performs your
With Azure Analysis Services, you can provide
complete extraction, transformation, and loading
modeled data directly to users in a very performant
(ETL) process.
way. Users can query millions of records in seconds
because the model lives completely in-memory and
Data Factory can reliably move data from on-
is periodically refreshed.
premises to the cloud, within the cloud, or to
on-premises—it doesn’t matter where your data
You can get data into the semantic model from
sources are. Data Factory also provides many
anywhere, including from data sources in the cloud
connectors that you can use to easily connect
and on-premises. You can use Azure Blob storage,
to your data source, including SQL Server, Azure
Azure SQL Database, Azure SQL Data Warehouse,
Cosmos DB, Oracle, and many more.
and many other services as data sources for the
model. You can also use data sources, including on-
When you move data, you can also filter it before
premises Active Directory, Access databases, and
you send it to an end destination, clean it up, or
Oracle databases.
transform it with an activity in the pipeline, such as
the Apache Spark activity. In addition, Data Factory
allows you to schedule and monitor pipelines, as QUICK
START
Create an Azure Analysis
Services server using the
Azure portal
Guide to Azure
Azure Data Lake Analytics Stream Analytics can get its data from many
services, including Azure Blob storage, Azure Event
Another Azure service for performing data analytics Hubs, and Azure IoT Hub. You can analyze the data
tasks is Azure Data Lake Analytics. With this by using a simple SQL-like language or custom
service, you can analyze, process, and transform code. After querying and filtering the stream of
potentially massive amounts of data from Azure data, Stream Analytics can output the result to
Storage and Azure Data Lake Storage. many Azure services, including Azure SQL Database,
Azure Storage, and Azure Event Hubs.
Azure Data Lake Analytics allows you to create and
submit jobs that query data, analyze it, or transform
QUICK
it. You can write these jobs in U-SQL, which is START
an SQL-like language, and extend U-SQL with Create a Stream Analytics job
using the Azure portal
Microsoft R and Python.
You pay for the jobs that you submit and run, and
the service scales automatically depending on the Azure Time Series Insights
power that the jobs need. Azure Data Lake Analytics
You can use Azure Time Series Insights to get quick
is typically used for long-running analytics jobs
insights on large amounts of typically IoT-type data.
against massive amounts of data.
This service gets data from Azure Event Hubs, IoT
Hub, and your own reference inputs, and it retains
STEP BY
STEP that data for a specified amount of time.
Create your first U-SQL script
through the Azure portal With Azure Time Series Insights, users can query
and analyze data through a visualization tool as
soon as it comes in. Time Series Insights not only
Azure Stream Analytics analyzes data, but also ingests and holds it for a
while. This is like Azure Analysis Services, where
You can use the Azure Stream Analytics service data lives in-memory in a model for users to query.
to analyze, query, and filter real-time streaming The key differences are that Time Series Insights
data. For example, when you receive a stream of is optimized for IoT and time-based data, and it
temperature data from an IoT device, it tells you contains its own data visualization tool.
how warm it is outside. It might provide the same
temperature every second for an hour until the
temperature changes, but you are only interested in TUTORIAL
the changes. Azure Stream Analytics can query the Explore a Time Series Insights
demo environment from your
data in real time and store only the differential data browser
in an Azure SQL Database.
Guide to Azure
Azure Databricks HDInsight
Azure Databricks allows you to run a managed and HDInsight is a platform within Azure that you can use
scalable Databricks cluster in the cloud. Databricks to run open-source data analytics services. You can
provides a unified analytics platform with a host also use it to run specialized clusters of your favorite
of tools and capabilities. Within Databricks, you open-source data analytics tools. The advantage
can run optimized versions of Apache Spark to do of running these tools in HDInsight is that they’re
advanced data analytics. managed, which means you don’t have to maintain
VMs or patch operating systems. Plus, they can scale
In addition to Spark-based analytics, Databricks and easily connect to one another, other Azure
provides interactive notebooks and integrated services, and on-premises data sources and services.
workflows and workspaces that you can use to
collaborate with the entire data team, including Most of the specialized open-source data analytics
data scientists, data engineers, and business cluster types in HDInsight use Azure Blob storage or
analysts—all of whom have access to specialized Azure Data Lake Storage to access or store data, as
tools for their specific needs. these services work with the Hadoop File System.
Databricks is fully integrated with Azure Active You can run potentially massive specialized clusters
Directory, which gives you the ability to implement of different types, such as an Apache Hadoop
granular security. With Databricks, you can perform cluster. This enables you to process and analyze data
Spark-based data analytics on data that comes with Hadoop tools such as Hive, Pig, and Oozie.
from a variety of places, including Azure Storage
and Azure Data Lake Storage. Databricks also works You can also spin up an Apache HBase cluster,
with data from Azure SQL Data Warehouse, Azure which provides a very fast NoSQL database. The
SQL Database, and Azure Cosmos DB. Additionally, data actually lives within Azure Storage or an Azure
you can plug Databricks into Power BI to create and Data Lake, but HBase provides an abstraction layer
show powerful dashboards. on top, which has its own functionality and unique
performance.
QUICK
START You can create an Apache Storm cluster, which
Run a Spark job on Azure
Databricks using the Azure is geared toward analyzing data streams, just
Portal like Azure Stream Analytics. In addition, you can
have an Apache Spark cluster, which provides a
framework for processing and analyzing massive
amounts of data. HDInsight can also run a cluster
for Microsoft Machine Learning Server (previously
Microsoft R Server). This allows you to run R-based
jobs to analyze data.
Guide to Azure
Finally, you can create a cluster that runs Apache a combination of these clusters, and they all run
Kafka, which is a publish-subscribe messaging managed in the cloud. Table 2-2 can help you to
system used to build applications with queueing pick the right Azure services to analyze your data.
mechanisms.
There are more cluster types, as well as tools that TUTORIAL

Extract, transform, and load
you can use within clusters. You can perform
data using Apache Hive on
almost any data analytics and processing task with HDInsight
Table 2-2: Cluster options

A summary of Azure services for different data use cases
Provide an Allow users

Move data from in-memory to query data Analyze data
Transform data
store to store streaming data semantic model and create for later use
for users dashboards
Data
Factory*
Analysis
Services*
Data Lake
Analytics*
Stream
Analytics*
Time Series
Insights*
Azure
Databricks*
Azure
HDInsight*
Guide to Azure
Further reading
If you want to learn more about data and data

analytics in Azure, you can download and read the
following free resources:
RESOURCE
HUB
Cloud Analytics with Microsoft
Azure
Learning path: Store data in

Azure
The
The
amet,
Developer’s
Developer’s
consectetur 43
2018 adipiscing elit Guide
Guide to
to Azure
Azure
03 /




Securing
your
application
Guide to Azure
How can Azure

help to secure
your application?
Have you ever had a security incident with one of
your applications? You might have had one without
even knowing it. With Azure, you can protect data,
applications, and infrastructure with built-in security
services that include security intelligence to help
you rapidly identify evolving threats, enabling you
to respond promptly.
Azure can also help you implement a layered,

in-depth defense strategy across identity, data,
hosts, and networks. With services like Azure
Security Center, you can get an overview of your
security posture, protect against threats, and view
recommendations for how to improve security.
Most importantly, you’ll be notified as soon as there

might be a security incident—so you’ll always know
whether there is a threat. This way, you can take
immediate steps to secure your assets.
Let’s dive in.

Guide to Azure
Azure Active Directory and other secrets. Key Vault provides this capability.
With Key Vault, you can store the secrets that your
An important part of your application’s security is applications use in a single secured, central location
authenticating users before they can use it—but that leverages the FIPS 140-2 Level 2 validated
authentication is not an easy thing to implement. Hardware Security Module (HSM).
You need to store user identities and credentials
somewhere, implement password management,
DOCS
create a secure authentication handshake, and so on.
What is Key Vault?
Azure Active Directory (Azure AD) provides all of

these things and more out of the box. You store
your user identities in Azure AD and have users One example of using Key Vault with a web
authenticate against it, redirecting them to your application is to use it to securely store a connection
application only after they have been authenticated. string. Your application would get the connection
Azure AD takes care of password management, string from Key Vault instead of from the
including resolving common scenarios such as configuration system. This way, administrators can
forgotten passwords. control the secrets, and developers never need to
deal with them. Key Vault also stores SSL and other
Since Azure AD is used by millions of applications certificates used to secure the traffic to and from
every day—including the Azure portal, Outlook. your applications over HTTPS.
com, and Office 365—it’s able to more readily
detect and act on malicious behavior. For instance, Azure Sentinel
if a user were to sign in to an application from a
location in Europe and then, one minute later, To get a good overview of the security status of
sign in from Australia, Azure AD would flag this as your organization and all of its users, applications,
malicious behavior and ask the user for additional services, and data, you can use a security
credentials through multi-factor authentication. information and event manager (SIEM) and security
orchestration automated response (SOAR) platform.
The Azure AD enterprise identity service provides Azure now offers an AI-powered SIEM and SOAR
single sign-on (SSO) and multi-factor authentication solution in the form of Azure Sentinel.
to help protect your users from 99.9 percent of
cybersecurity attacks. Use Azure Sentinel to collect data from your
organization, including data about users,
Key Vault applications, servers, and infrastructure assets
like firewalls and devices running in the cloud and
As part of your security architecture, you need a on-premises. It’s easy to collect data from your
secure place to store and manage certificates, keys, organization with the built-in connectors. As data
Guide to Azure
is being collected, Azure Sentinel detects security Much more than security
threats and minimizes false positives with its smart
While security is critical, API Management offers
machine learning algorithms.
other capabilities that can help streamline your
When there is a threat, you’ll be alerted and development and testing workflow, such as test
can investigate it with AI, utilizing decades of data response mocking, publishing multiple API
cybersecurity work at Microsoft. You can respond versions, introducing non-breaking changes
to incidents with Azure Sentinel’s built-in workflow safely with revisions, and giving developers access
orchestration and task automation. to your API’s autogenerated documentation,
catalog, and code samples.
QUICK
START
Get started with On-board
TUTORIAL
Azure Sentinel API Management
Get started with API Management
APIs should be secure. This is true for APIs you

Azure AD Application Proxy
create yourself as well as those from third-party
vendors. To assist in making your APIs secure, Azure AD Application Proxy provides single
you can use API Management. This is basically a sign-on (SSO) and secure remote access for web
proxy you put in front of APIs that adds features applications hosted on-premises. Applications that
such as caching, throttling, and authentication or you would likely want to publish include SharePoint
authorization. sites, Outlook Web Access, or other line-of-business
(LOB) web applications. These on-premises web
With API Management, you secure an API by applications integrate with Azure AD, the same
requiring users to create a subscription to it. This identity and control platform used by Office 365.
way, applications need to authenticate before End users can access your on-premises applications
they can use your API. You can use various the same way they access Office 365 and other SaaS
authentication methods, including access tokens, applications integrated with Azure AD.
basic authentication, and certificates. Additionally,
you can track who’s calling your API and block Managed identities for Azure resources
unwanted callers.
How do you keep credentials out of your code
API Management supports multiple pricing completely? You can start by using Key Vault, but
tiers with an up to 99.95% SLA guarantee. The where do you store the credentials to connect
Consumption pricing tier offers the ability to have to Key Vault? The managed identities for Azure
the API Management service automatically scale to resources feature in Azure AD provides a solution.
handle load.
Guide to Azure
You can use managed identities for a lot of services

in Azure, including Azure App Service. You simply
enable a managed identity with a button to inject
credentials into your application at runtime and
then use those credentials to access other services,
including Key Vault, Azure SQL Database, and
Azure Storage. All authentication between services
is done on the infrastructure level, meaning your
application doesn’t have to deal with it and can just
use other services.
LEARN
MORE
How to use managed identities
for Azure resources in App
Service and Azure Functions
Guide to Azure
Encryption
files are encrypted using industry-standard
encryption algorithms. Pages in a database are
encrypted before they’re written to disk and
decrypted when they’re read.
Default encryption of data • Always Encrypted encrypts data within client

applications prior to storing it in Azure SQL
By default, your data is encrypted in Azure when
Database. It allows the delegation of on-
it’s stored in Azure SQL Database, Azure Synapse
premises database administration to third
Analytics (formerly Azure SQL Data Warehouse),
parties and maintains separation between
Azure Database for MySQL, Azure Database for
those who own and can view the data and
PostgreSQL, Azure Storage, Azure Cosmos DB, or
those who manage it but should not access it.
Azure Data Lake Store. All this encryption works
automatically, and you don’t need to configure • Azure Cosmos DB requires no action from
anything when you use it. you—user data stored in Azure Cosmos DB
in non-volatile storage (solid-state drives) is
To help meet your security and compliance
encrypted by default, and there are no controls
requirements, you can use the following features to
to turn it on or off.
encrypt data at rest:
You can use the following features to encrypt data

• Azure Disk Encryption encrypts Windows and
in transit:
Linux infrastructure-as-a-service (IaaS) virtual
machine (VM) boot and data volumes using
customer-managed keys. • VPN Gateway can be used to encrypt traffic
between your virtual network and your on-
• Azure Storage encryption automatically premises location across a public connection, or
encrypts data prior to persisting in Azure between Azure virtual networks.
Storage, and then automatically decrypts the
data when you retrieve it. • TLS/SSL Encryption protects data when
it’s traveling between cloud services and
• Azure client-side encryption supports customers. TLS (Transport Layer Security)
encrypting data within client applications provides strong authentication, message
before uploading it to Azure Storage or other privacy, and integrity.
endpoints and then decrypting data when
downloading it to the client. • SMB 3.0 Encryption in VMs running Windows
Server 2012 or later can be used to make
• Transparent Data Encryption (TDE) encrypts transfers secure by encrypting data in transit
SQL Server, Azure SQL Database, and Azure over Azure virtual networks.
Synapse Analytics data files. Data and log
Guide to Azure
Azure Security
You don’t have to do anything to enable the Basic
tier—it’s automatically enabled for every customer
Center
as part of the Azure platform. This service protects
your applications against the most common DDoS
attacks by performing real-time monitoring and
mitigation, and it provides the same defenses used
by Microsoft Online Services (MOS).
Azure Security Center provides unified security
management and advanced threat protection The Standard tier provides additional mitigation
across hybrid cloud workloads. It offers centralized capabilities that are tuned specifically to Azure
policy controls to limit exposure to threats and virtual network resources. It’s simple to enable,
rapidly find and fix vulnerabilities. and you don’t have to change your applications—
everything is done at the network level. Plus, with
In addition, Security Center supports integration the Standard tier, you can customize the Basic tier
with third-party solutions and can be customized protection with your own policies that focus on
with automation and programming capabilities. your specific use cases and applications.
You can use Security Center to analyze the security

state of your compute resources, virtual networks, DOCS
storage and data services, and applications. Azure DDoS Protection
Continuous assessment helps you discover potential

security issues, such as systems with missing Azure VPN Gateway
security updates or exposed network ports. A list
of prioritized findings and recommendations can One of the many options for connecting Azure to
trigger alerts or other guided remediation. your on-premises network is VPN Gateway. This
lets you set up an encrypted Site-to-Site (S2S) VPN
Azure DDoS Protection connection between an Azure virtual network and
your on-premises network.
You’ve heard about it on the news, and you
certainly don’t want it to happen to your enterprise: Because the traffic is encrypted, it’s secure—even
an application is targeted by a Distributed Denial when it travels over the public internet. VPN
of Service (DDoS) attack. These types of attacks Gateway can send encrypted traffic between Azure
are becoming more common and can overwhelm virtual networks over the Microsoft network.
your application to the point that no one can use it
anymore. DDoS Protection offers protection from You can also create encrypted Point-to-Site (P2S)
DDoS attacks through a free tier (Basic) and a paid connections from your computer to Azure. This way,
tier (Standard). you have your own private, secured connection to
Guide to Azure
Azure even when you’re on the road. Network Watcher
TRY IT Network Watcher is a regional service that enables

OUT you to monitor and diagnose conditions at the
Get started by creating
an Azure VPN Gateway with network level in, to, and from Azure.
PowerShell
Its many diagnostic and visualization tools can help

Application Gateway you understand and gain deeper insights into your
network in Azure.
Application Gateway is a dedicated virtual
appliance that provides an application delivery
Examples include:
controller (ADC) as a service. It offers various layer 7
load balancing capabilities for your application and
• Topology: Provides a network-level view of the
allows customers to optimize web farm productivity
resources in a virtual network, the resources
by offloading CPU-intensive SSL termination to
associated with resources in a virtual network,
Application Gateway. Application Gateway also
and the relationship between these resources.
provides other layer 7 routing capabilities, including
round-robin distribution of incoming traffic, cookie-
• Variable packet capture: Captures packet data
based session affinity, URL path-based routing, and
in and out of a VM. Advanced filtering options
the ability to host multiple websites behind a single
and fine-tuned controls, such as the ability to
application gateway.
set time and size limitations, provide versatility.
The packet data can be stored in a Blob store or
Web Application Firewall
on the local disk in .cap format.
You need to secure your application against
• IP flow verify: Checks whether a packet is
many threats, including SQL injection, cross-site
allowed or denied based on 5-tuple flow
scripting (XSS), and others defined in the Open
information and packet parameters (destination
Web Application Security Project (OWASP). A WAF
IP, source IP, destination port, source port, and
from Azure can assist with that. A feature of the
protocol). If the packet is denied by a security
Application Gateway service, a WAF provides
group, the rule and group that denied the
real-time protection for your application. It detects
packet are returned.
malicious attacks, as defined in the OWASP Core
Rule Set, and blocks those attacks from reaching
Network security groups
your application. It also reports on attempted or
ongoing attacks so that you can see active threats
A network security group (NSG) holds a list of
to your application, thereby providing an extra layer
security rules that allow or deny network traffic to
of security.
resources connected to Azure virtual networks.
Guide to Azure
NSGs can be associated with subnets, individual Cross-premises VPNs

VMs (classic-style VMs), or individual network
interface controllers (NICs) attached to VMs Azure supports two types of cross-premises VPN
(Resource Manager–style VMs). When an NSG connections: P2S VPN and S2S VPN. A P2S VPN
is associated with a subnet, the rules apply to all connection lets you create a secure connection
resources connected to the subnet. You can restrict to your virtual network from an individual client
traffic even further by also associating an NSG with computer. This type of connection is established
a VM or NIC. from the client computer, which is useful for
telecommuters who want to connect to Azure
Azure DNS private zones virtual networks from a remote location. A P2S
VPN is also useful when you have only a few
The DNS is responsible for translating (or resolving) clients that need to connect to a virtual network.
a service name to its IP address. Azure DNS is In contrast, an S2S VPN connection is used to
a hosting service for DNS domains, providing connect your on-premises network to an Azure
name resolution using the Azure infrastructure. virtual network over an IPsec/IKE (IKEv1 or IKEv2)
In addition to internet-facing DNS domains, VPN tunnel. This type of connection requires
Azure DNS now supports private DNS domains a VPN device located on-premises that has an
as a preview feature with Azure DNS private externally facing public IP address.
zones. Security benefits arising from private DNS
zones include the ability to create a split DNS
infrastructure. This enables you to create private DOCS
and public DNS zones with the same names without Read more about P2S VPNs
exposing internal names. In addition, the use of
DNS private zones removes the need to introduce Read more about S2S VPNs
custom DNS solutions that could increase the
overall attack surface with independent updating
and management requirements. Azure ExpressRoute
Azure ExpressRoute lets you extend your on-

DOCS premises networks into the Microsoft cloud
Read more about DNS private over a secure private connection facilitated by a
zones
connectivity provider without traversing the public
internet. With ExpressRoute, you can establish a
private connection to Microsoft cloud services, such
as Azure, Office 365, and Dynamics 365.
Guide to Azure
Azure Load Balancer
You can use load balancers to increase the

availability of applications. Azure supports both
external and internal load balancers, which can be
used in a public or internal configuration.
In addition, you can configure load balancers

to support high availability (HA) ports where an
HA ports rule is a variant of a load balancing rule
configured on the internal standard load balancer.
You can provide a single rule to load balance all TCP
and UDP flows arriving on all ports of an internal
load balancer.
LEARN
MORE
Read about Load Balancer and
HA ports rules
Guide to Azure
Logging and Azure NSG flow logs
monitoring
A feature of Network Watcher, Azure NSG flow
logs allow you to view information about ingress
and egress IP traffic through an NSG. Flow logs can
be analyzed to gain information and insights into
network traffic and security, as well as performance
Azure Monitor issues related to traffic.
Azure Monitor enables basic monitoring for Azure While flow logs target NSGs, they are not displayed
services by collecting metrics, activity logs, and in the same way as other logs and are stored only
diagnostic logs. The metrics collected provide within a storage account.
performance statistics for different resources,
including the operating system associated with a VM. Application Insights
The activity log will show you when new resources Application Insights is an extensible application
are created or modified. You can view this data with performance management (APM) service for
one of the explorers in the Azure portal and send it web developers on multiple platforms. It includes
to Log Analytics for trending and detailed analysis, powerful analytics tools to help you diagnose
or you can create alert rules that will proactively issues and understand what users do with your
notify you of critical issues. application. It works for applications on a variety
of platforms hosted on-premises or in the cloud,
Azure Monitor Logs including .NET, Node.js, and J2EE.
Azure Monitor Logs contain different kinds of Application Insights integrates with your DevOps
data organized into records with different sets of process and has connection points to a variety of
properties for each type. Logs in Azure Monitor are development tools. It can monitor and analyze
especially useful for performing complex analysis telemetry from mobile applications by integrating
across data from a variety of sources. with Visual Studio App Center.
Log Analytics within Azure Monitor allows you to Azure Security and Compliance Blueprints
write, execute, and manage Azure Monitor log
queries in the Azure portal. The Azure Security and Compliance Blueprints
- HIPAA/HITRUST Health Data and AI provides
tools and guidance to help deploy a platform-as-a-
service (PaaS) environment for compliance with the
Health Insurance Portability and Accountability Act
Guide to Azure
(HIPAA) and the Health Information Trust Alliance Further reading

(HITRUST).
Learn more about Azure security in the following
This PaaS offering supports ingesting, storing, free resource:
analyzing, and interacting with personal and non-
personal medical records in a secure, multi-tier RESOURCE
HUB
cloud environment deployed as an end-to-end Secure your cloud applications
solution. The blueprint showcases a common in Azure
reference architecture that could be applied to use
cases beyond healthcare and is designed to simplify
the adoption of Azure.
DOCS
Read more about the Azure
Security and Compliance
Blueprint
Azure security technical and architectural

documentation
Azure maintains a large library of security technical

documentation that supplements security
information with individual services. White papers,
best practices documents, and checklists are
included on the Azure Security Information page.
Also covered are core public cloud security topics

in diverse areas, including network security,
storage security, compute security, identity and
access management, logging and auditing, cloud
workload protection, PaaS security, and more.
RESOURCE
HUB
Read more about the Azure
Security Information page
Theamet,
Developer’s
consectetur 55
04 /




Adding
intelligence
to your
application
Guide to Azure
How can Azure

integrate AI into
your application?
AI can give your application an edge over the
competition. Just imagine what you can build—
applications that translate speech in real time as
you’re speaking, or an application that helps you
identify parts of a motor in mixed-reality training.
The possibilities are endless. However, building an
AI-powered application seems difficult. How do you
create an algorithm that can understand speech, for
instance?
Fortunately, you don’t have to do everything

yourself: Azure is here to help. It provides many AI
services that you can just plug into your application,
including the Speech Translation service (a service
in Azure Cognitive Services), which translates
speech in real time.
Using a service like this, you’re able to simply

consume AI, but you can also build your own
machine learning algorithms using services such as
Azure Machine Learning.
Guide to Azure
What to use,
and when?
Before diving into the options for AI in Azure, let’s
look at Table 4-1, which summarizes which services
are available and their capabilities:
Table 4-1: Picking up the right option

A summary of Azure services for AI
Provide an
Users can query
Move data from Transform in-memory Analyze data
data and create
store to store data streaming data semantic model for later use
dashboards
for users
Azure
Cognitive
Search*
Cognitive
Services*
Azure Bot
Service*
Azure
Machine
Learning*
Spatial
Anchors*
Remote
Rendering*
Guide to Azure
Cognitive
Each category in the table contains multiple services
that you can use by calling an API. Some categories
Services
contain custom services, including Custom
Vision, Language Understanding, and Bing
Custom Search. These custom services provide
preconfigured machine learning algorithms, just
like the other services, and they also enable you to
Cognitive Services provides machine learning use your own data to train the model.
algorithms, created by Microsoft, and data as
a service. For most services, Microsoft has also In addition to these services, Cognitive Research
provided the data to train those algorithms. Technologies provides additional services. This
contains innovative APIs and SDKs for researchers
For some services, you can use your own custom and developers with an early look at emerging
data to train the algorithms. cognitive capabilities. One such experimental
service is Project Gesture, which enables you to
Cognitive Services provides an exceptionally easy
detect gestures such as the waving of a hand and
way to incorporate machine learning and AI into
weave them into your user experience.
your application—by simply calling APIs.
Let’s take a closer look at some Cognitive Services.
Table 4-2 shows which APIs are currently available.
Note that this list keeps growing.
RESOURCE
HUB
All services have a free tier that you can use to get Hands on with AI
started.
Table 4-2: A quick glance at Cognitive Services APIs

Services and APIs in Cognitive Services and their categories
C
Custom Form Ink Video
Comp
Computer
puter Vision Vision
V
Face
Recognizer Recognizer Indexer
T to
Text Speech Speaker
Sp
Speech
peech to Text
T xt
Te SSpeech Translation Recognition
L
Language
Text Translator
Immersive Reader Understanding
U QnA Maker
Analytics Text
C
Content
Anomaly
y Detector Moderator
M
Personalizer
Guide to Azure
Language Understanding stratus. To create this model, you upload images

of different types of clouds to the Custom Vision
Use the Language Understanding (LUIS) service portal and give them tags, which tells the service
to understand what users are saying to you on how to train the model. In this example, you would
social media, in chatbots, or in speech-enabled tag an image with “cumulus” or “stratus.”
applications. For example, you can book flights or
schedule meetings using LUIS. Once you’ve uploaded enough images, you can
train your model. The more images you upload
To use the Language Understanding service, give it with tags and the more training you do, the more
examples of what you want it to understand, such as accurate your model will be.
“Book a flight to Seattle” or “Schedule a meeting at 1
PM with Bob,” and tell it which words you’re looking Once you have a model that performs well, you
for. In these examples, you might be looking for the can start using it by making calls to the Custom
destination of the flight (Seattle) and the time and Vision API and feeding it new images. When you
person for the meeting (1 PM and Bob). upload a new image, the service tells you whether it
recognizes it based on the images already uploaded.
After the Language Understanding service creates
a machine learning model based on the examples Figure 4-1 shows an example of what the API
that you put in, it can extract information from endpoint looks like:
natural language that users put in.
STEP BY
STEP
Create a new application
in the LUIS portal
Custom Vision
With the Custom Vision service, you can detect

information in images based on your own training
data. Custom Vision works in a similar manner to Figure 4-1: An example of API endpoint
other Cognitive Services in that it comes with a
predefined machine learning algorithm. All you Using the Custom Vision service to detect
have to do is feed the service with your data. information based on your own model is impressive
enough, but Custom Vision can do even more. The
Let’s say you want to create a model that can detect model you create when you train the Custom Vision
types of rain clouds in the sky, such as cumulus and service with your data can be deployed to the
Guide to Azure
“intelligent edge.” This means that the model and capability for audio, for which it recognizes
API can run somewhere other than the cloud, such who is speaking and when.
as on an on-premises server in a Docker container
or on another device, such as your phone. • It recognizes visual text in a video, such as text
on a slide, and makes that part of the transcript.
This offers great flexibility because you don’t need an
active internet connection to use the capabilities of • It performs sentiment analysis, which identifies
the Custom Vision service; you can also run it locally, when something positive, negative, or neutral
which provides great performance. In addition, the is said or displayed.
model you run on the edge isn’t very large—only
approximately tens of megabytes—because you As the breadth of these functionalities
deploy only the model and API, not the training data. demonstrates, Video Indexer combines many
Cognitive Services, including Speech to Text and
Speaker Recognition. Cumulatively, these services
TRY IT provide powerful capabilities that make content
OUT
Create your own Custom more discoverable, accessible, and valuable.
Vision project
You can upload media files to Video Indexer using
the Video Indexer portal or the API. Figure 4-2
Video Indexer shows the results of a video that was uploaded to
the Video Indexer service:
The Video Indexer service analyzes the video and
audio files you upload to it. This Cognitive Service
is part of Azure Media Services. It provides a
predefined machine learning algorithm and you
provide the data.
In addition to many others, Video Indexer has the

following capabilities:
• It creates a transcript of the text in a video. You Figure 4-2: Demonstrating the results on the Video Indexer portal
can refine the transcript manually and train

As shown in the figure, Video Indexer created a
Video Indexer to recognize industry terms such
transcript of the audio in the video. The transcript
as “DevOps.”
can be edited and even translated into other
languages. You can also see that Video Indexer
• It tracks faces and identifies who is in a video
recognized text on the slide behind the speakers
and at what points. Video Indexer has the same
Guide to Azure
and marked it as “OCR.” You can skip to that text by You pay only for the hosting of QnA Maker, and
clicking it. Video Indexer provides this functionality not for how many times the resulting service gets
for individual applications by embedding the queried by users.
Cognitive Insights widget.
EXERCISE
TRY IT Create your QnA Maker
OUT knowledge-based service
Upload your first video to
Video Indexer
Personalizer
QnA Maker
Personalizer helps your application choose the best
QnA Maker offers an easy way to create a single content item to show each user. It selects the
conversational layer over existing data, such as the best item, from content items, based on collective
frequently asked questions (FAQs) pages, support real-time information you provide pertaining to
websites, and product manuals. QnA Maker helps content and context.
you analyze and extract information and convert
it into question-and-answer pairings that can be Content can be any unit of information, such as text,
easily managed. Simply put, QnA Maker allows you images, URLs, or emails that you want to select from
to build applications that can provide information to to show to your user. This helps boost usability and
your users in a conversational manner. user satisfaction with reinforcement learning–based
capabilities.
With QnA Maker, it’s possible to create and manage
knowledge bases using the easy-to-use QnA Maker Anomaly Detector
Portal or REST APIs. We have simplified the bot
Anomaly Detector allows you to easily
creation process by allowing you to easily create a
embed anomaly detection capabilities into
bot from your knowledge base—without the need
your applications so users can quickly identify
for any code or setting changes. Refer to this link for
problems. This enables you to monitor and detect
further details: Create a QnA bot. Of course, you
abnormalities in your time series data with machine
can also use QnA Maker to create a bot using the
learning.
Azure Bot Service and augment your QnA bot by
adding the Language Understanding service. To
Using Anomaly Detector doesn’t require any prior
add personality, you can add chit-chat to your bot,
experience in machine learning, and the RESTful API
and answer commonly asked small-talk scenarios
enables you to easily integrate the service into your
out of the box.
applications and processes.
Guide to Azure
Azure Cognitive
• Language analyzers from Apache Lucene, as
well as natural language processing (NLP)
Search
from Microsoft, available in 56 languages,
which intelligently handle linguistics, including
verb tense, gender, irregular plural nouns,
word decompounding, and word breaking for
languages with no spaces.
Azure Cognitive Search is the only cloud search
service with built-in AI capabilities that enrich all • Monitoring and reporting, which provide
types of information to easily identify and explore information on what was searched for and how
relevant content at scale. Formerly known as Azure fast and successful the search was.
Search, it uses the same integrated Microsoft
natural language stack that Bing and Office have • User experience features, such as sorting and
used for more than a decade, and AI services paging search results, intelligent filtering, and
across vision, language, and speech. You can spend providing search suggestions.
more time innovating and less time maintaining a
complex cloud search solution. AI enrichment is a capability of indexing that
is used to extract text from images, blobs, and
Azure Cognitive Search provides a lot of the other unstructured data sources. Enrichment and
plumbing to do searches. You just spin up an Azure extraction make your content more searchable.
Cognitive Search instance, create an index that
helps you search, and fill it with data. This means, For example, a team with a ton of PDFs with
for example, that you could easily implement Azure pictures, along with handwritten notes, can use
Cognitive Search to help users search your product Azure Cognitive Services to analyze the documents
catalog in an e-commerce application. and connect places, domain experts, and events
and then navigate all of this information to make
key decisions.
There are many options available for working with
Azure Cognitive Search and great features to make
Azure Cognitive Search uses Cognitive Services
searching easier for your users, including:
to analyze all this data, extract information,
and correlate it—all without the need to write
• Geo-search, which lets users explore data based complicated image recognition or optical
on the proximity of a search result to a physical character recognition (OCR) software.
location.
QUICK
START
Create your first Azure
Cognitive Search index in the
portal
Guide to Azure
Azure Bot
Azure Bot Service makes it easy to create a bot and
provides the following support:
Service • It provides a way to host and manage

bots you’ve built using the Microsoft Bot
Framework, with a comprehensive open-
source SDK and tools for bot development.
Creating a bot—an application that automatically
and autonomously interacts with users—is no • It integrates natively with Cognitive Services.
simple task. You need to keep track of the context
of your interaction with each user and be ready • It helps you connect your bot to where your
to respond to a multitude of possible interaction customers are, with connectors to channels
parameters. including Facebook, Slack, Microsoft Teams,
Line, Telegram, and more.
The Azure Bot Service enables you to build
intelligent, enterprise-grade bots and experiences • It offers all the benefits of a managed service
that can extend your brand and keep you in control in Azure, including massive scale and built-in
of your data. Begin with a simple Q&A bot or build continuous deployment, and you pay only for
a sophisticated virtual assistant. Use comprehensive what you use.
open-source SDK and tools to easily connect your
bot across popular channels and devices. Give your An example of a bot you can build with Azure
bot the ability to speak, listen, and understand your Bot Service is one that provides users with answers
users with native integration to Cognitive Services. to FAQs.
You can use this with QnA Maker. The interface

of the bot can be a chat box on your website. You
could also build your own branded virtual assistant.
EXERCISE
Create a bot with Azure
Bot Service
Guide to Azure
Azure Machine
So, what’s involved in machine learning? Figure 4-3
shows the basic workflow of machine learning:
Learning Studio
Azure Machine Learning empowers developers
and data scientists with a wide range of productive
Figure 4-3: Basic workflow of machine learning
experiences for building, training, and deploying
machine learning models faster. It also helps The machine learning process works as follows:
accelerate the time to market and foster team
collaboration with industry-leading MLOps • Data contains patterns. You probably know
(DevOps for machine learning). about some patterns, such as user ordering
habits. It’s also likely that there are many
First, let’s talk about what machine learning is.
patterns in data with which you’re unfamiliar.
What is machine learning? • The machine learning algorithm is an intelligent

piece of software that can find patterns in data.
Machine learning is often thought to mean the
This algorithm can be one you create using
same thing as AI, but they aren’t actually the
techniques such as deep learning or supervised
same. AI involves machines that can perform tasks
learning.
characteristic of human intelligence. AI can also
be implemented by using machine learning, in
• Finding patterns in data using a machine
addition to other techniques.
learning algorithm is called “training a machine
learning model.” The training results in a
Machine learning is itself a field of computer science
machine learning model. This contains the
that gives computers the ability to learn without
learnings of the machine learning algorithm.
being explicitly programmed. Machine learning
can be achieved by using one or more algorithm
• Applications use the model by feeding it new
technologies, such as neural networks, deep
data and working with the results. New data is
learning, and Bayesian networks.
analyzed according to the patterns found in the
data. For example, when you train a machine
learning model to recognize dogs in images,
it should identify a dog in an image that it has
never seen before.
Guide to Azure
The crucial part of this process is that it is iterative.

The machine learning model is constantly improved QUICK
START
by training it with new data and adjusting the Get started with Azure Machine
algorithm or helping it to distinguish correct results Learning by using the Azure
portal
from wrong ones.
Azure Machine Learning designer

Azure Machine Learning
You can use Azure Machine Learning designer to
You can use Azure Machine Learning to create
prep data and train, test, deploy, manage, and
data analytics algorithms with open-source tools
track machine learning models without writing
such as Python, R, and the Azure CLI. Just like
any code. There is no programming required; you
with Azure Machine Learning Studio and Azure
visually connect datasets and modules to construct
Machine Learning designer, you can create whatever
your model.
algorithm you want, providing flexibility for a variety
of scenarios, including predictive analytics, data To get started using Azure Machine Learning
recommendations, and data classification. designer, you first need to create an Azure
Machine Learning workspace. This workspace
With Azure Machine Learning, you create custom
provides a centralized place to work with all the
machine learning algorithms from scratch. This is
artifacts you create in Azure Machine Learning.
different to Machine Learning Studio and Machine
Learning designer, where you visually create an In the designer, you start by creating a pipeline
algorithm by connecting predefined pieces of a from scratch or with one of the many prebuilt
machine learning algorithm. Azure Machine Learning samples, including one for predicting flight
fully supports open-source technologies such as delays and another for customer relationship
TensorFlow, PyTorch, and scikit-learn. management (CRM) prediction:
Azure Machine Learning is a complete service that

offers start-to-finish capabilities. You can create your
algorithm, prepare your data, train the algorithm
on it, test and deploy the algorithm, and track and
manage it when it’s running.
Azure Machine Learning works with many Azure

services that can help create, train, and run your
algorithm. You can, for instance, create your
algorithm in Jupyter Notebook, train it using Azure
Databricks, and deploy it on a Kubernetes container
cluster in Azure Kubernetes Service. Figure 4-4: Using a custom R script for flight delay prediction
Guide to Azure
Figure 4-4 shows a pipeline in Machine Learning

designer that uses a customized R script to predict
whether a scheduled passenger flight will be
delayed by more than 15 minutes. This particular
pipeline was created using the “Sample 6: Use
Custom R Script—Flight Delay Prediction” sample
pipeline.
TUTORIAL
Predict automobile prices with
the designer
AutoML
Automated machine learning, also referred to as

AutoML, is the process of automating the time-
consuming, iterative tasks of machine learning
model development. Traditional machine learning
model development is resource-intensive, requiring
significant domain knowledge and time to produce
and compare dozens of models. With automated
machine learning, you’ll accelerate the time it takes
to get production-ready ML models with great ease
and efficiency.
During training, Azure Machine Learning creates

a number of pipelines in parallel to try different
algorithms and parameters for you. Each iteration
produces a model with a training score. The higher
the score, the better the model is considered to
“fit” your data. AutoML will stop once it hits the exit
criteria defined in the experiment.
AutoML can save time in choosing the correct

algorithm and parameters needed to produce a
good model that fits your data.
Guide to Azure
Developer AI Toolkit for Azure IoT Edge
tooling for AI
Using machine learning models locally on devices
(the intelligent edge) delivers a powerful advantage:
it enables you to use the local processing power
of the device without relying on an internet
connection or incurring the latency of a web service
ML.NET call to get your results.
ML.NET is an open-source and cross-platform Described earlier in the Cognitive Services section,
machine learning framework with support for Custom Vision already supports running on the
macOS, Windows, and Linux. ML.NET lets you reuse edge. You can expect more services to run on the
all the knowledge, skills, code, and libraries you edge in the future.
already have as a .NET developer so that you can
easily integrate machine learning into your web, To run machine learning models on the edge,
mobile, desktop, gaming, and Internet of Things you need tooling to help you deploy the models
(IoT) applications. and web services. The AI Toolkit for Azure IoT
Edge helps with this tooling by enabling you to
ML.NET Model Builder provides an easy-to- package machine learning models in Azure IoT
understand visual interface to build, train, and Edge–compatible Docker containers and to expose
deploy custom machine learning models. Prior those models as REST APIs. The Docker containers
machine learning expertise is not required. Model containing the machine learning models can then
Builder supports AutoML, which automatically be deployed as an IoT edge module to run on edge
explores different machine learning algorithms and devices using Azure IoT Edge.
settings to help you find the one that best suits your
scenario. The AI Toolkit for Azure IoT Edge contains examples
for getting started and is fully open source and
available on GitHub.
Guide to Azure
AI and
• Persisting virtual content in the real world can
enable a user to place an object (such as a
mixed reality
calendar) on a room wall that people can see
using a phone application or a HoloLens device.
For example, people entering a hospital often have

difficulty getting to where they need to go. With
Your applications are no longer limited to a 2D Azure Spatial Anchors, the hospital can create a mobile
environment. The world is now your application application that shows digital information in the
canvas, backed by spatial intelligence from things such physical hospital to guide people to various locations.
as IoT sensors, mixed reality, and computer vision. Within the application on their iOS device, people can
With Azure mixed-reality services, you can bring data use the directional arrows on the hospital’s physical
to life in 3D when and where your users need it. information boards to get to their destination.
Azure Spatial Anchors Another way in which Azure Spatial Anchors is

being used is in a training application for nurses.
In the world of mixed reality, you can integrate Pearson Education has enabled nursing students and
digital information within the context of your professors to practice diagnosing and treating patients
physical environment, such as a hologram of your in 3D before the pressure of a real case. Students
favorite game characters on your kitchen counter. and professors may use HoloLens devices or mobile
With Azure Spatial Anchors, you can place digital phones and tablets running iOS or Android.
content in a physical location and share that with
users using your choice of devices and platforms. Azure Spatial Anchors enables you to share digital
information and holograms that are positioned in
Here are some example use cases enabled by Spatial the physical world. It works with applications built
Anchors: on Unity, ARKit, ARCore, and Universal Windows
Platform (UWP), and can be used with a HoloLens
• Multi-user experiences make it easy for people device, iOS-based devices supporting ARKit, and
in the same place to participate in shared mixed- Android-based devices supporting ARCore.
reality experiences.
With Azure Spatial Anchors, you can easily secure
• Way-finding is a method of connecting two your spatial data and give users access through Azure
or more spatial anchors together, creating a Active Directory. You can also integrate storage, AI,
relationship between them. These connected analytics, and IoT services in your spatial application.
points of interest can be used to create an
experience where the user must interact with
them to complete a task. TUTORIAL
Get started by sharing Azure
Spatial Anchors across
sessions and devices
Guide to Azure
Remote Rendering Azure Kinect DK
When you use 3D models in scenarios such as Azure Kinect DK is a developer kit with advanced
design reviews and medical procedure plans, you AI sensors that provides sophisticated computer
need them to be as detailed as possible. Every vision and speech models. Kinect contains depth
detail matters. sensors, a spatial microphone array with a video
camera, and an orientation sensor as an all-in-one
Many businesses use complex 3D models small device with multiple modes, options, and
containing hundreds of millions of polygons, software development kits (SDKs).
and edge devices with low or medium graphics-
processing power are not capable of rendering The Azure Kinect DK development environment
them. Traditionally, developers have tried to address consists of multiple SDKs:
this problem using a technique called “decimation.”
This makes the model simpler by removing
• A Sensor SDK for low-level sensor and
polygons so that it can display on those devices.
device access
But this loss of detail sacrifices information needed

• A Body Tracking SDK for tracking bodies in 3D
to make the right decision in many situations. With
Remote Rendering, 3D models are rendered in the • A Speech Cognitive Services SDK for enabling
cloud and streamed to devices in real time—with microphone access and Azure cloud-based
no compromise of visual quality. speech services
This enables you to keep the original quality of Azure Kinect DK can be used to build new
the model and interact with the content on edge possibilities, such as in the retail industry to design
devices such as headsets and mobile phones with a shopping experience that manages inventory and
every detail intact. tracks products faster and more accurately, and to
create interactive signage that’s both helpful and
delightful.
Guide to Azure
Using events Service Bus queues
and messages in
Service Bus queues decouple systems from one
another. For example, a web application receives
orders from users and needs to invoke a web
your application service to process the orders. The web service will
take too long to process the orders, perhaps up to
five minutes.
Modern, globally distributed applications often One way to solve this problem is to use a queue to
have to deal with large amounts of messages decouple the web application from the web service.
coming in, so they need to be designed with The web application receives the order and writes it
decoupling and scaling in mind. Azure provides in a message on a Service Bus queue. Then, the web
several services to help with event ingestion and application informs the user that the order is being
analysis as well as messaging patterns. These processed. The web service takes messages from
services are also vital for creating intelligent the queue, one by one, and processes them. When
applications that leverage AI. the web service has processed an order, it sends
an email notification to the user that the item has
Service Bus been ordered.
The core of messaging in Azure is Service Bus. By decoupling the systems, the web application
Service Bus encompasses a collection of services can work at a different speed from the web
that you use for messaging patterns. The most service, and both can be scaled individually to the
important services are Azure Service Bus queues application’s needs.
and topics.
A Service Bus queue is a simple mechanism.
Multiple applications can put messages on the
DOCS queue, but a queue message can be processed by
Get started with Service only one application at a time. A number of clever
Bus queues
features are available for working with messages
on the queue, including duplicate detection and a
dead letter subqueue to which messages are moved
when they fail to be processed correctly.
Guide to Azure
Service Bus topics Table 4-3: Understanding the key differences

Service Bus queues versus Queue storage
Just like Service Bus queues, Service Bus topics are

Use Azure Service
a form of application decoupling. Use Azure Queue
Bus queues if
storage if you need
you need
Here are the differences between them: Message lifetime Message lifetime
> 7 days < 7 days
• With a queue, multiple applications write Guaranteed message Queue size

messages to the queue, but only one > 80 GB
application at a time can process a message.

Duplicate detection Transaction logs
• With a topic, multiple applications write

Message size Message size
messages to the topic, and multiple applications
can process a message at the same time.
Applications can create a subscription on the

Event Hubs
topic that indicates what type of messages they’re
Event Hubs can help enterprises capture massive
interested in. Just like queues, topics have features,
amounts of data to analyze it or transform and
including duplicate detection and a dead letter
move it for later use.
subqueue, to which messages are moved when they
fail to be processed correctly.
Event Hubs is designed for massive data ingestion.
It effortlessly handles millions of messages per
Comparing Service Bus queues and
second. It retains messages for up to seven days
Azure Queue storage
or indefinitely by writing messages to a data store
using the Event Hubs Capture feature.
Service Bus queues and Azure Queue storage
basically do the same thing, but there are a number
You can use Event Hubs to filter data with queries
of differences, as shown in Table 4-3:
as it comes in and output it to a data store such as
Azure Cosmos DB. You can even replay messages.
QUICK
START
Get started sending messages
to Event Hubs
Guide to Azure
Azure IoT Hub Event Grid
Just like Event Hubs, Azure IoT Hub is built for Event Grid offers a different type of messaging—a
massive data ingestion. It’s specifically geared fully managed publish and subscribe service that
toward handling the enormous volume of data hooks into almost every service in Azure as well as
messages from devices on the IoT, such as smart into custom publishers and subscribers.
thermostats and sensors in cars.
This is different to working with Service Bus queues
It possesses many of the same properties as Event and topics, for which you’d need to poll the queue
Hubs, including the ability to retain messages for up or topic for new messages. Event Grid automatically
to seven days and replay them. pushes messages to subscribers, making it a real-
time, reactive event service.
What makes IoT Hub unique is that it can send
messages to devices. It has the ability to manage Services inside and outside of Azure publish events
your complete IoT infrastructure—you can use when a new blob is added, for example, or when a
it to register devices, report their state, manage new user is added to an Azure subscription. Event
them by securing and restarting them, and send Grid detects these events and makes them available
data to them. to event handlers and services that subscribe to the
events, as shown in Figure 4-5:
QUICK
START
Connect your device to
your IoT Hub
Event Publishers Topics Event Subscriptions Event Handlers
Blob Storage
Azure Functions
Resource Groups
Logic Apps
Azure
Subscriptions
Azure Automation
Event Hubs
WebHooks
Custom Topics
Figure 4-5: Flow of events from event publishers to event handlers

Guide to Azure
Event handlers can be Azure functions or Azure Azure SignalR Service

Logic Apps, which can then act on the data in
the event. You can use Azure SignalR Service to simplify the
process of adding real-time web functionality to
Another important aspect of Event Grid is that applications over HTTP that enables services to
it is serverless. This means that, like Azure Logic push content updates to connected clients. The
Apps and Azure Functions, Event Grid scales service is based on ASP.NET Core SignalR and is
automatically and doesn’t need an instance of it to offered as a standalone, fully managed service in
be deployed. You just configure it and use it, and Azure.
you pay only when it’s used.
SignalR can update connected applications in
You can use Event Grid if you want an email real time over HTTP without the need for the
notification every time a user is added to, or applications to poll for updates or submit new
removed from, your mailing list in Mailchimp. Event HTTP requests. This enables you to create seamless
Grid is used to activate an application in Azure web experiences that update information on the
Logic Apps and configured to listen to changes to fly. For example, an auction application might
the Mailchimp mailing list. Event Grid then signals use SignalR to refresh the latest bid as soon as it
to Logic Apps to send an email containing the name happens, without completely refreshing the page or
of a user who has been added or deleted and the constantly polling for information.
action that was performed.
Hosting a SignalR server yourself is not a simple
task, and it can be difficult to scale and secure
TUTORIAL properly. When you use the fully managed
Monitor virtual machine changes Azure SignalR Service, setup is easy, and security,
with Event Grid and Logic Apps
availability, performance, and scalability are all
managed for you.
QUICK
START
Create a chat room with
SignalR
Guide to Azure
What to use, and when Further reading
Azure provides a myriad of options to perform You can learn more about using Azure AI services in
messaging and to decouple applications. Which one your application by clicking on the following links:
should you use, and when? Table 4-4 summarizes
the differences to help you choose.
RESOURCE
HUB
Developer's Guide to Building
AI Applications
Guide to Azure
AI School

A summary of Azure services for events and messages
Use for Max

Event Device Multiple Multiple Use for
Messaging publish/ message
ingestion management consumers senders decoupling
subscribe size
SignalR
64 KB
Service*
Event
64 KB
Grid*
Event
256 KB
Hubs*
IoT
256 KB
Hub*
Service
1M
Bus topics*
Service Bus
1M
queues*
Azure
Queue 64 KB
storage
Theamet,
Developer’s
consectetur 75
05 /




Connecting
your business
with IoT
and gaining
insights
Guide to Azure
How can Azure

connect, secure,
manage, monitor,
and control your
IoT devices in the
cloud?
One of the most exciting things that you get to
do as a developer is impact the real world. You
can do that with devices like robots, sensors, and
microcontrollers. When you create applications with
these devices, you can do things like predict when
a machine needs maintenance before it actually
requires repairs or even create a self-driving car.
Working with devices to impact the real world can

be difficult if you develop all the software yourself.
Fortunately, Azure provides solutions that can help
make this a lot easier. You can, for instance, use
Azure IoT Hub to securely ingest messages from
and send commands back to devices. When you’re
building anything with a microcontroller (single-
chip computers) in it, consider using Azure Sphere,
which is a combination of hardware, OS, and cloud
services with security built into the silicon.
Let’s go through the services in Azure that can

help you build amazing Internet of Things (IoT)
applications.
Guide to Azure
Azure IoT Hub

each connected device and revoke privileges if you
no longer want a particular device to be connected.
When devices send messages to Azure IoT Hub,

you can either store the messages or route them to
At the core of Azure IoT is Azure IoT Hub, a flexible
another service for analysis or action. It’s possible,
cloud PaaS that connects, monitors, and manages
for instance, to route incoming messages using
IoT devices in a secure and scalable manner.
IoT Hub message routing that offers simplicity,
reliability, and scalability without the complexity of
You already know that you can use IoT Hub to
building custom routing solutions.
ingest massive amounts of messages that typically
come from IoT devices, like messages that contain
Another option for integrating IoT events into Azure
data from temperature sensors. What’s more, IoT
services or business applications is to use Azure
Hub is unique because it not only receives messages
Event Grid, a fully managed event routing solution
but also sends commands back to devices. It
that uses a publish-subscribe model. IoT Hub and
establishes two-way communication with devices
Event Grid work together to integrate IoT Hub
and even lets you execute code on devices.
events into Azure and non-Azure services in near-
real time.
IoT Hub is powerful because it allows you to
manage devices in various ways, like sending them a
You can also create bi-directional communication
message to reboot themselves or running a startup
tunnels using device streams. Azure IoT Hub
script. This makes IoT Hub the central service that
Device Streams facilitate the creation of secure
enables a robust IoT application in Azure.
bidirectional TCP tunnels for a variety of cloud-to-
device communication scenarios.
IoT Hub can also connect, monitor, and manage
devices that can run workloads developed in the
Example: Azure IoT Hub
cloud, including those that run the Azure IoT Edge
runtime and modules. Once a device is connected
to IoT Hub, the hub has a record of its identity. This A company that provides insights into the
enables IoT Hub to send messages and monitor the movement and usage of trucks is scaling out its
device; it also allows IoT Hub to secure the device business. Previously, the company tracked its
and the communications between them. Devices assets by using custom code on a native phone
are required to authenticate to IoT Hub using app, which called a custom web service, and by
several industry best-practice security protocols, polling GPS dongles attached to the trucks. This
like X.509 certificates and SAS token-based solution was challenging to maintain because
authentication. You can manage the security of it was difficult to provision new assets with new
Guide to Azure
devices, and the company needed to enroll

a new customer that had more than 2,000
assets.
Now the company uses Azure IoT Hub for

device management and communication.
It can use the IoT Hub Device Provisioning
Service to onboard the 2,000 new devices and
hook them up to a specific IoT hub for that
customer. The phone app now uses Node.js
and the Azure IoT Device SDK to interact with
IoT Hub. Importantly, the company now has
control over the security of its devices and can
detect their status and reset them as needed.
In addition, the company routes the data
from its GPS dongles through Azure Stream
Analytics, so only the data of GPS changes is
kept. This reduces the data burden because
the dongles send their location every second.
Using Azure IoT Hub enabled this company

to scale and mature its business by providing
first-class security and device management.
It also opened new opportunities to do more
with devices than the company ever thought
possible.
Guide to Azure
Azure IoT Hub Device To provision devices through DPS, an enrollment

for the device(s) is added to the DPS service using
Provisioning Service one of three attestation mechanisms:
The Azure IoT Hub Device Provisioning Service • X.509 Certificate based on the standard X.509
(DPS) provides a rich set of integrated public cloud certificate authentication flow (similar to how
services for all your IoT solution needs. It’s a helper TLS / SSL works)
service for Azure IoT Hub that enables zero-touch,
just-in-time provisioning to the appropriate IoT • Trusted Platform Module (TPM) based on
hub without intervention, allowing you to provision a nonce challenge, using the TPM standard
devices in a secure and scalable manner. for keys to present a signed Shared Access
Signature (SAS) token.
The service can help you with many device

• Symmetric Key based on Shared Access
provisioning scenarios for getting devices
Signature (SAS) security token
connected and configured to Azure IoT Hub:
The device(s) will use the configured attestation

• Zero-touch provisioning – Provision devices mechanism to connect to the DPS service.
to a single IoT solution without hardcoding the From there, the DPS service will determine the
Azure IoT Hub connection information at the appropriate Azure IoT Hub for the device and
factory (during initial setup) provision the device with that particular IoT hub.
Then the device will connect to and communicate
• Geo-sharding – Connect devices to the Azure
with that Azure IoT Hub. This provides a complete
IoT Hub with the lowest latency
zero-touch, just-in-time provisioning mechanism
for connecting devices secure and scalable manner.
• Rolling Key Updates – Update device
keys (when not using X.509 certificate
authentication) used by the device to connect
to Azure IoT Hub
Guide to Azure
Azure Security Center for IoT

Billions of new IoT devices are being connected to
the Internet and integrated into your daily lives and
businesses. A difficult job of security operations
teams is to ensure their security strategies evolve
quickly enough to cover each new attack surface.
Azure Security Center for IoT provides threat

prevention and analysis for every device, IoT Edge
and IoT Hub, across your IoT solution. It simplifies
hybrid workload protection by delivering unified
visibility and control, adaptive threat prevention,
and intelligent threat detection and response across
workloads running on edge, on-premises, in Azure,
and in other clouds.
There are a few different components that Azure

Security Center for IoT is composed of:
• IoT Hub integration
• Device agents (optional)
• Send security message SDK
• Analytics pipeline
Guide to Azure
Azure IoT
Azure IoT Central gives you a jump-start to creating
new IoT solutions by choosing from a number of
Central
industry-specific app templates for retail, energy,
healthcare, and government to help you get up and
running. Alternatively, you can also choose a blank,
custom app template to build a fully customized
solution with Azure IoT Central.
Azure IoT Central is a Software as a Service
(SaaS) offering that enables you to create rich IoT The Azure IoT Central app templates consist of:
applications just by navigating through wizards.
• Sample operator dashboards

There’s no need to perform any coding or in-depth
configuration—IoT Central does all that for you,
• Sample device templates
provisioning and configuring everything you need.
• Simulated device producing real-time data

There are several benefits to using Azure IoT
Central: • Pre-configured rules and jobs
• Lower barrier to entry into building and • Rich documentation tutorials and how-tos
managing IoT solutions that can adapt to your

You get the same capabilities as if you had created
needs and processes
the solution from scratch, but without the need for
• Push the limits of existing boundaries by years of programming experience. If you do want
utilizing a SaaS solution to more easily create more control over certain areas, you can always go
new revenue opportunities and accelerate deeper and tweak the solution to your needs.
through the use of smart, connected products

Solutions built using Azure IoT Central still utilize
• Utilize industry leading technology and Azure IoT Hub and Device Provisioning Service (DPS).
enterprise-grade security features to enable you In addition to the ability to hook into these services
to stay in control of your IoT devices and data and customize your solution, you also benefit from
many other capabilities these services offer.
• Enterprise-grade security features are built-in;
offering you instant security benefits without
building it yourself
Guide to Azure
Azure IoT Edge

These three components work together on devices
and in the cloud to run your workloads at the
intelligent edge.
It’s possible to run many Azure services at the

In modern IoT applications, data processing can edge to help with certain scenarios—and the list of
occur in the cloud or on the device side. Device-side available services keeps growing. Table 5-1 lists just
processing is referred to as “edge computing.” some of them.
You would use edge computing when you don’t want Table 5-1: Making a scenario based decision
to or can’t rely on your connection to the cloud, when Services available on Azure IoT Edge
you want to improve your application performance by Use this on
If you want to
eliminating roundtrips to the cloud, or when you can’t Azure IoT Edge
communicate with the cloud from the device because Build
Buil
uiild and
an d d
deploy
eploy
Build and deploy Machine
of security, privacy, or regulatory reasons. AI models
AI models llearning
Customize computer vision

For scenarios such as these, use Azure IoT Edge. Customize computer vision C
Custom Vision
models for
models your use
for your use case
case Service
S
Azure IoT Edge is managed from IoT Hub, enabling
you to move parts of your workload to the edge. This Process real-time
Process real-time S
Stream
reduces time spent by devices sending messages to streaming data
streaming data Analytics
A
the cloud and allows offline scenarios as well as faster Process events using
Process events using
reactions to status changes. serverless code
code Functions
serverless
Deploy
y a SQL Server
Deploy a SQL Server S
SQL Server
Azure IoT Edge is composed of the following database to
to the
the edge
edge
database databases
d
components:
Comply with Industry 4.0
Comply with Industry 4.0
interoperability standards
interoperability standards Architecture
A
• IoT Edge modules are containers that run
Build custom logic
Azure services, third-party services, or your own C
Custom
Build custom logic
module
m
code. They’re deployed to IoT Edge devices and
execute locally on those devices.
Once you start using Azure IoT Edge, you’ll be able

• The IoT Edge runtime runs on each IoT Edge
to create fast applications that run machine learning
device and manages the modules deployed to
algorithms locally and provide instant feedback on
each device.
their findings.
• IoT Hub exposes specific interfaces to remotely

monitor and manage IoT Edge devices available
through the Azure portal, the Azure CLI, or
the SDKs.
Guide to Azure
Azure solutions, customers can track the past, control the

present and predict the future.
Digital Twins Azure Digital Twins applied to all types of

environments, such as, warehouses, offices,
schools, hospitals, banks, stadiums, factories,
and more. There are many scenarios where Azure
In the world of IoT, you might work with many IoT
Digital Twins can be helpful:
devices and sensors that function in connection
to environments and business systems. To really
• Predict maintenance needs for a factory
understand the data that IoT devices capture, you
need to understand the physical environment in • Analyze real-time energy requirements for an
which the devices operate. electrical grid
For instance, if you have a temperature sensor, the • Optimize the use of available space for an office
temperature data by itself doesn’t tell you that
much. However, when you know which room the • Track daily temperature across several states
sensor is in, how large the room is, which other
devices are in the room and what data they capture, • Monitor busy drone paths
and how many people are in the room and how
they’re moving, you get a much better picture of • Identify autonomous vehicles
what the temperature data means. You can model
• Analyze occupancy levels for a building
the physical environment in which your IoT devices
reside with Azure Digital Twins. This service enables
• Find the busiest cash register in your store
you to create a graph of data that includes places,
people, and things—for instance, an office building
Whatever the real-world business scenario, it’s likely
that contains a room with people and sensors.
a corresponding digital instance can be provisioned
through Azure Digital Twins.
Azure Digital Twins is an IoT platform that enables
enterprises to create a digital representation of
Azure Digital Twins also lets you to manage
any assets, environments and business systems.
permissions to data and devices in the context of
Leveraging their domain expertise on top of
the physical world. You can use Azure AD to specify
Azure Digital Twins’ flexible modeling, enterprises
that certain users are able to access data only from
can build contextually aware solutions to
a certain physical location.
address scenarios such as workflow modeling in
manufacturing, energy efficiency in smart spaces,
QUICK
digital twin simulation in oil and gas and many START
Get started by finding
more. With Azure Digital Twins next generation IoT available rooms using
Azure Digital Twins.
Guide to Azure
Azure Sphere QUICK

START
Build the Hello World
application with Visual
Studio Code
More and more devices contain microcontrollers

(single-chip computers) to make them smarter. This You can use the Visual Studio family to develop
enables scenarios such as a washing machine sending applications that run on Azure Sphere. This opens
a routine maintenance notification to the owner. up the world of microcontroller development to
a much larger group of developers across both
However, it’s complex and challenging to secure Windows and Linux.
devices with embedded microcontrollers, as
evidenced by the many security incidents with Azure Sphere Security
connected devices over the last years.
The Azure Sphere Security Service (AS3) is a
Azure Sphere provides a secured, high-level cloud service that provides remote attestation to
application platform with built-in communication authenticate devices and ensure they haven’t been
and security features for internet-connected tampered with. It also provides a secure mechanism
devices. The platform is comprised of hardware, to push down Azure Sphere OS and other
operating system (OS), and cloud components to application updates to Azure Sphere devices.
actively protect your devices, your business, and
your customers. Based on Microsoft’s decades of experience with
internet security, the Azure Sphere team has
These three components provide the basis for a identified seven properties of highly secured
connected, secure world using Azure Sphere: devices. The Azure Sphere platform is designed
around these seven properties to provide a more
• Azure Sphere MCU – Secured, connected, highly secured IoT platform.
crossover microcontroller unit (MCU)
Azure Sphere Development Kit
• Azure Sphere OS – Custom, high-level Linux-
based operating system (OS) Azure Sphere applications can be developed
using a Windows or Linux system using an Azure
• Azure Sphere Security Service (AS3) – Cloud-
Sphere Development Kit. The development kit is
based security service that provides continuous,
a hardware board that provides everything you
renewable security
need to start prototyping and developing Azure
Sphere applications. There are a few different
options of Azure Sphere Development Kits
available for purchase.
Guide to Azure
Azure Maps
• Spatial operations – Enhance your location
intelligence with a library of common
geospatial mathematical calculations, including
geofencing, closest point, great circle distance,
and buffers.
Azure Maps provides developers from all industries
with powerful geospatial capabilities. Those • Traffic – Develop mobility solutions that
geospatial capabilities are packed with the freshest improve travel time and avoid gridlock.
mapping data. Azure Maps is available for both web
and mobile applications. • Routing – Present the shortest and fastest
routes available or provide specialized routs
Azure Maps provides a collection of geospatial and facts for walkers, bicyclists, and commercial
services that use fresh mapping data to provide vehicles.
geographic context to web and mobile applications.
These services can be used to develop secure, • Mobility – Provide real-time location
scalable IoT and AI solutions with dynamic, location- intelligence and nearby public transit services,
based services. including stops, route information, and travel
time estimations.
Azure Maps services are available through SDKs.
These tools help you quickly develop and scale • Geolocation – Look up the country for an IP
solutions that integrate location information into Address.
Azure solutions.
• Data Service – Upload and store geospatial
data for use with spatial operations or image
• Search – Create apps that provide details about
composition.
nearby points of interest, render locations
on a map, and geocode (or reverse geocode) • Weather Service – Obtain current weather
addresses to get corresponding latitude / conditions, weather forecast, and weather
longitude coordinates. along a route to enable weather-based
decisions within your applications.
• Maps – Integrate clear, easy-to-read maps into
your solutions with JavaScript Map Control or
the Render API.
• Time zones – Make it easy for users to see what

time it is anywhere in the world.
Guide to Azure
Windows for IoT

Windows 10 IoT Core is optimized for smaller
devices with or without a display that run on both
ARM and x86/x64 devices. IoT Core is a UWP
(Universal Windows Platform) centric operating
system, and UWP apps are the primary app type.
Windows 10 IoT is a member of the Windows 10
family that brings enterprise-class power, security Universal Windows Platform (UWP) is a common
and manageability to the Internet of Things. app platform across all versions of Windows 10,
It leverages Windows’ embedded experience, including Windows 10 IoT Core. UWP apps are
ecosystem and cloud connectivity, allowing written using Visual Studio and is supported by a
organizations to create their Internet of Things with handful of languages; including C#, VB.NET, and
secure devices that can be quickly provisioned, JavaScript.
easily managed, and seamlessly connected to an
overall cloud strategy. Windows Server IoT 2019
Windows 10 IoT come in two editions: Windows Server IoT 2019 is a full version of
Windows Server 2019 that delivers enterprise
• Windows 10 IoT Core is the smallest member manageability and security to IoT solutions.
of the Windows 10 family. While only running Windows Server IoT 2019 shares all the benefits of
a single app, it still has the manageability and the world-wide Windows ecosystem. It is a binary
security expected form Windows 10. equivalent to Windows Server 2019, so you can use
the same familiar development and management
• Windows 10 IoT Enterprise is a full version of tools that you use on your general-purpose servers.
Windows 10 with specialized features to create
dedicated devices locked down to a specific set
of applications and peripherals.
Before attempting to manufacture a device, it’s best

to first prototype the device with Windows 10 IoT
Core. This way, you can understand what features
you’ll need and what configurations you’ll want
when it’s time to manufacture.
Guide to Azure
Azure RTOS
• Azure RTOS TraceX is a Windows-based
analysis tool that provides a view of real-time
system events.
• Azure RTOS NetX is a high-performance TCP/IP

Azure RTOS is a small, fast, reliable, and easy-to-use protocol implementation.
real-time operating system (RTOS) for connecting
deeply embedded sensors, devices, and gateways • Azure RTOS NetX Duo is an advanced,
from the edge to the Internet of Things (IoT). industrial-grade TCP/IP network stack designed
for embedded real-time and IoT applications.
Azure RTOS is best suited for building applications
on resource constrained devices. It provides • Azure RTOS USBX is a high-performance USB
developers a rich set of real-time multi-tasking, FAT host, device, and on-the-go (OTG) embedded
file system, GUI, USB and networking components stack.
to quickly build applications; including out-of-the-
box connectivity to Azure IoT. This advanced real-time operating system (RTOS)
is designed specifically for deeply embedded
Azure RTOS is comprised of a few different applications. Among the multiple benefits it
components: provides are advanced scheduling facilities,
message passing, interrupt management, and
• Azure RTOS ThreadX is an advanced real-time messaging services. Azure RTOS ThreadX has
operating system designed specifically for many advanced features, including picokernel
deeply embedded applications architecture, preemption threshold, event chaining,

and a rich set of system services.
• Azure RTOS FileX is a high-performance, file
allocation table (FAT)-compatible file system. The decision to use a real-time operating system
(RTOS) should be made when an application
• Azure RTOS GUIX Studio provides a complete, requires real-time capability. An RTOS should offer
embedded graphical user interface (GUI) consistently fast response times (in microseconds),
application design environment, facilitating a small memory footprint (less than 2MB), and a
the creation and maintenance of all graphical level of security that effectively protects users and
elements in the application’s GUI. connected systems.
Guide to Azure
Learn more
Azure IoT solutions are easy to use, and there are
many related resources, including:
about Azure IoT • Azure IoT Developer Specialty Certification:

Earn a certification that demonstrates you
understand how to implement Azure IoT
solutions.
• Azure IoT application page: This resource

provides an overview of Azure IoT and
examples of how it can be used.
• Azure IoT Hub: This resource provides an

overview of Azure IoT Hub and examples of
how it can be used.
• Azure IoT Edge: This resource provides an

overview of Azure IoT Edge and an example of
how it can be used.
• Azure IoT technical videos: Learn more about

IoT on Channel 9.
Guide to Azure
What to use, Further reading
and when?
Learn more about using Azure for your IoT solution
in the following free resource:
RESOURCE
HUB
Now that you’ve read about the available Azure IoT Securely connect IoT devices to
the cloud
services, how do you know which service to use for
your scenario? Table 5-2 shows when you should
use each IoT option in Azure.
Table 5-2: Making the right choice

Various scenarios for using Azure IoT options
Azure IoT Hub Azure IoT Central Azure IoT Edge
Create an IoT solution with a lot of

control and by doing custom coding
Run AI workloads locally on IoT devices*
All services have a free tier you can use to get started.
*Azure IoT Hub is required to manage Azure IoT Edge deployments and devices.
Theamet,
Developer’s
consectetur 90
06 /




Deploying
your services
and reducing
costs
Guide to Azure
How can Azure

deploy your
services and
reduce costs?
Azure has an option for every type of organization,
including those that need Azure in their own
datacenters. You can deploy your applications
either in the public Azure cloud or on-premises
in Azure Stack. You choose how portable your
applications should be.
It’s also possible to develop applications in

containers, deploy them in containers, on-premises,
or in the Azure cloud. You can also script your
complete infrastructure by means of infrastructure
as code (IaC) using tools such as Azure Resource
Manager templates and Terraform.
Let’s explore these options in more detail.

Guide to Azure
Infrastructure Azure Resource Manager templates
as Code
All Azure services introduced in this guide are based
on Azure Resource Manager, which you can use to
document your environment as IaC thanks to Azure
Resource Manager templates. These templates are
JSON files that describe what you want to deploy
IaC captures environment definitions as declarative and what the parameters are.
code, such as JSON documents, for automated
provisioning and configuration. This enables you to It’s easy to create Azure Resource Manager
use the same versioning used for source code with templates in Visual Studio and Visual Studio Code
infrastructure deployment templates. using Azure Resource Group project templates.
You can also generate Azure Resource Manager
There are many benefits of using IaC: templates from the Azure portal by clicking the
Automation Script button, which is available on the
• It lowers the potential for human error while menu bar of every resource in the Azure portal.
deploying and managing infrastructure. This creates the Azure Resource Manager template
for the given resource and even generates code
• It deploys the same template multiple times for building the resource using the Azure CLI,
to create identical dev, test, and production PowerShell, .NET, and others.
environments.
After you have an Azure Resource Manager
• It enables the cost of development and test template, you can deploy it to Azure by using
environments to be reduced by creating them PowerShell, the Azure CLI, Visual Studio, and the
on demand. Azure portal. Alternatively, you can automate its
deployment in a continuous deployment pipeline
using Azure DevOps.
A great example of deploying resources to the

cloud using Azure Resource Manager is the
Deploy to Azure button found in many GitHub
repositories.
Guide to Azure
Terraform with Azure
Hashicorp Terraform is an open-source tool for

provisioning and managing cloud infrastructure.
Terraform’s template-based configuration files
enable you to define, provision, and configure
Azure resources in a repeatable and predictable
manner.
Terraform is great for deploying infrastructure

across multiple cloud providers. This enables
consistent tooling for managing each infrastructure
definition within Azure, and across other cloud
providers.
Terraform’s template-based configuration files

enable you to define, provision, and configure
Azure resources in a repeatable and predictable
manner.
Terraform shares a lot of capabilities with Azure

Resource Manager templates. However, it also
includes the ability to create reusable modules for
deploying and configuring infrastructure. These
modules can be shared across multiple Terraform
projects, or even used multiple times within the
same project. This can be leveraged to save a lot of
time automating infrastructure deployments.
Additional IaC tools
There are additional IaC tools that can be used. You

can bring your existing skills and tools, including
Ansible and Chef, to provision and manage Azure
infrastructure directly.
Guide to Azure
Azure Blueprints
It’s easy to use Azure Resource Manager templates,
resource groups, user identities, and access rights
and policies to design and create a complete
infrastructure. But how do you keep all of these
things together? And how do you keep track of
which environments each piece of infrastructure has
been deployed to and which version of the artifact
is deployed now?
Organize all your infrastructure artifacts with

Azure Blueprints. Azure Blueprints provides a
mechanism that allows you to create and update
artifacts, assign them to environments, and define
versions. You can store and manage these artifacts
as well as manage their versions and relate them to
environments.
This will help you to organize your infrastructure

and create a context for Azure Resource Manager
templates, user identities, resource groups, and
policies.
Azure Blueprints enables you to simplify large-scale

Azure deployments by packaging key environment
artifacts into a single blueprint definition. Then, you
can easily apply the blueprint to new subscriptions
and environments, including fine-tune control and
management through versioning.
QUICK
START
Get started by defining and
assigning an Azure Blueprint in
the Azure portal.
Guide to Azure
Containers in uses the exact same container configuration, so

you know that the infrastructure is the same for
Azure
everybody as it is in production. With containers,
the age-old developer’s fallback statement—“it
works on my machine”—now means that it will also
work in production.
Containers are a standard for packaging up code Container instances are disposable and can be
and its dependencies for running quickly and quickly created or destroyed when scaling or
reliably across different compute environments. A running a workload on-demand. This provides
container is basically a lightweight VM that starts flexibility to run containers when needed, or even
and stops much faster than a traditional VM and is move them to a different node or cluster easily, too.
therefore more useful for development, testing, and
running applications in production. There are many technologies for running containers,
including Docker. Azure can run and manage
The major benefit of containers is that an individual containers with Azure Container Instances, Azure
container is always the same, or immutable. You Kubernetes Service, and Azure Red Hat OpenShift.
run a container locally when you develop your app, Table 6-1 shows which service you might choose for
and then use the same container configuration in various scenarios when using containers:
the cloud and everywhere else. Your entire team

A summary of Azure services for running and managing containers
Azure Kubernetes Container

Red Hat OpenShift)
Service (AKS) Instances
For production deployments of complex systems

(with a container orchestrator)
orchestrator)
For long-running workloads on containers
For short-running workloads on containers
For orchestrating a system based on containers
Orchestrating with an open-source Kubernetes

orchestrator
OpenShift clusters, jointly operated with Red Hat

Guide to Azure
Azure Kubernetes Service Azure Red Hat OpenShift
Azure Kubernetes Service (AKS) makes it simple to Azure Red Hat OpenShift provides a flexible, self-
deploy a managed Kubernetes cluster in Azure. AKS service deployment of fully managed OpenShift
reduces the complexity and operational overhead clusters. Maintain regulatory compliance and
of managing Kubernetes by offloading much of that focus on your application development while
responsibility to Azure. your master, infrastructure, and application nodes
are patched, updated, and monitored by both
As a hosted Kubernetes service, Azure handles critical Microsoft and Red Hat.
tasks, such as health monitoring and maintenance,
for you. When deploying an AKS cluster, the Azure Red Hat OpenShift extends Kubernetes. It is
Kubernetes master and all nodes are deployed and jointly engineered, operated, and supported by Red
configured for you. Hat and Microsoft to provide an integrated support
experience.
As a managed Kubernetes service, AKS is free—you
only pay for the agent nodes within your clusters,
TUTORIAL
and not for the masters.
Create an Azure Red Hat
OpenShift 4 cluster
TUTORIAL
Prepare an application for
Azure Kubernetes Service It’s important to choose the deployment and hosting
option for your applications. It’s also important to
keep track of the cost of hosting your applications,
Azure Container Instances and your overall spend on Azure services. Next, let’s
take a look at tracking your Azure usage.
Azure Container Instances provides a fast, isolated
compute environment to easily run containers on
Azure without managing servers. You can develop
applications quickly while running your application in
a container or in the cloud. It allows you to focus on
designing and building your applications instead of
managing the infrastructure that runs them.
Guide to Azure
Tracking your Azure Advisor
Azure usage
Azure Cost Management also works with
Azure Advisor to provide cost optimization
recommendations. Azure Advisor helps you
optimize and improve efficiency by identifying idle
and underutilized resources.
With Azure products and services, you only pay for
what you create and the Azure resources you use.
It’s important to keep track of what you are using
and the costs involved.
Azure Cost Management
Using Azure Cost Management, you can monitor

and control Azure spending and optimize your
Figure 6-1: Azure Advisor showing recommendations for
Azure resource use. Azure Cost Management gives under-utilized VMs
you the tools to plan for, analyze, and reduce your
spending to maximize your cloud investment. Azure Advisor, for example, monitors your VM
usage for seven days and then identifies under-
Reports in Azure Cost Management show the utilized VMs. VMs whose CPU utilization is five
usage-based costs consumed by Azure services and percent or less, and whose network usage is seven
third-party Azure Marketplace offerings. Costs are MB or less for four or more days, are considered
based on negotiated prices and factor in reservation low-utilization VMs.
and Azure Hybrid Benefit discounts. Collectively,
the reports show your internal and external costs for
usage and Azure Marketplace charges.
You can use the Azure portal or various APIs for

export automation to integrate cost data with
external systems and processes. Automated billing
data export and scheduled reports are also available.
TUTORIAL
Optimize costs from
recommendations
Guide to Azure
Creating a
Cost alerts can easily be viewed within the Azure
portal. All alerts will show the alert type. A budget
billing alert
alert shows the reason why it was generated and
the name of the budget it applies to. Each alert
shows the date it was generated, its status, and the
scope (subscription or management group) that the
alert applies to.
Azure Cost Management alerts can be used to
monitor your Azure usage and spending. Cost alerts
are automatically generated based on when Azure
resources are consumed. Alerts show all active cost
management and billing alerts together in one place.
When your consumption reaches a given

threshold, alerts are generated by Azure Cost
Management. There are three types of cost alerts:
Figure 6-2: Cost alerts displayed in Azure Cost Management
• Budget alerts notify you when spending,

based on usage or cost, reaches or exceeds the Possible status on alerts include ‘active’ and
amount defined in the alert condition of the ‘dismissed’. An active status indicates that the alert
budget. Azure Cost Management budgets are is still relevant. A dismissed status indicates that
created using the Azure portal or the Azure someone has marked the alert to set it as no
Consumption API. longer relevant.
• Credit alerts notify you when your Azure Select an alert from the list to view its details. Alert
credit monetary commitments are consumed. details show more information about the alert. If
Monetary commitments are for organizations a recommendation is available for a budget alert,
with enterprise agreements. Credit alerts are then a link to the recommendation is also shown.
generated automatically at 90% and at 100% of You can also navigate to Cost analysis where you
your Azure credit balance. Whenever an alert is can explore costs relating to the alert’s scope.
generated, it’s reflected in cost alerts and in the
email sent to the account owners.
• Department spending quota alerts notify you

when department spending reaches a fixed
threshold of the quota. Spending quotas are
configured in the EA portal.
Guide to Azure
How to use our

billing APIs?
Azure Billing APIs can be used to pull usage and
resource data into your preferred data analysis
tools. These APIs are implemented as a resource
provider and are part of the family of APIs exposed
by Azure Resource Manager.
There are three Billing APIs available:
• Usage API: Used to get consumption data for

an Azure subscription
• RateCard API: Used to get meter (AKA

resource) metadata information along with
prices
• Invoice API: Used to download invoices
Azure Billing APIs are exposed as REST APIs that can

be integrated into custom application scenarios.
They can be used for getting better insights into
your cloud spend during the month, your estimated
consumption, and a few other things.
Guide to Azure
Where to deploy,
• Large N-tier application: Azure Kubernetes
Service, Azure Red Hat OpenShift
and when? • Small N-tier application: Azure App Service
• Serverless and event-driven: Azure Functions
• Traditional monolithic application: Azure App

There are several service options for deploying and
Service
hosting applications in Azure. Each service option
includes its own capabilities and features that make
There is some capability overlap between the
it the best fit for a certain application.
different services that may be used to host a
particular application. This helps give flexibility
Let’s look at the reasons why you might choose
in choosing which Azure service is best suited for
platform as a service (PaaS) or infrastructure as a
hosting your application based on your custom
service (IaaS) for hosting different application types.
business needs and scenario.
Platform as a service
It may not be the best option to choose a container-
There are many benefits to hosting applications based hosting option, such as AKS, when deploying
with PaaS services. PaaS services offer managed an existing enterprise application to Azure. The
VMs, where you no longer need to perform updates Azure App Service, or even IaaS, may be viable
to the OS or the platform stack installed on the alternatives. However, some existing applications
machine. This enables you to spend more time on may fit nicely in a container, or could be redesigned
writing the application, managing your data, and as such with minimal work.
delivering business value.
For new application development, the first choices
There are several different types of applications, to look at are containers and serverless. These are
each with its own unique requirements. These both more modern application hosting and design
applications will fit best being hosted using options. When building new applications, it can be
different Azure PaaS services. easier to choose the hosting and design upfront,
and then build the application with the necessary
technologies.
Here are some example application types, and the
Azure services to consider for hosting:
• Microservices: Azure Kubernetes Service, Azure

Red Hat OpenShift, Azure Container Instances
Guide to Azure
Infrastructure as a service Further reading
IaaS offers greater flexibility since you can install Learn more about deploying your applications to
and configure various software components on the Azure and reducing costs in these free resources:
VMs as required. This can be especially useful for
existing applications that may require some custom
LEARNING
configuration or dependency to be set up on the PATH
Control Azure spending and
server that isn’t allowed on other PaaS services. manage bills with Azure Cost
Management + Billing
While choosing PaaS services is the best path to
start with, there are plenty of scenarios where Deploy a website to Azure with
Azure App Service
your application may require the full flexibility and
capabilities of using IaaS. This includes the ability to
install any software and/or database on the VM that
you require for your application.
Keep in mind that IaaS brings with it the need for

you to manage the VM, OS, and software updates
yourself.
DOCS
Choosing Azure compute
platforms for container-based
applications
Theamet,
Developer’s
consectetur 102
07 /




Share your
code, track
work, and ship
software
Guide to Azure
How can
• Azure Repos
Use Azure Repos to collaborate on code
Azure help you

development with Git public and private
repositories, pull requests, and code reviews.
plan smarter, • Azure Pipelines

Use Azure Pipelines to create build and
collaborate release pipelines that automate builds and

deployments.
better, and ship • Azure Test Plans

Use Azure Test Plans to improve your overall
your applications code quality with manual and exploratory

testing services for your applications.
faster? • Azure Artifacts

Use Azure Artifacts to share code packages
(such as the npm, NuGet, and Maven packages)
across your organization.
If you’ve spent weekends or nights deploying new
versions of your applications, you’ve likely also GitHub also offers Git repositories and GitHub
spent a lot of time trying to fix the bugs that keep Advanced Security, which can be used to help
users away from those new versions. There’s a secure your code.
better way.
Let’s explore the Azure DevOps and GitHub services
Azure DevOps is a set of solutions that can help in more detail.
automate your builds and deployments and
automatically test your code and applications
before launch.
To help you build, deploy, test, and track your code

and applications, Azure DevOps includes:
• Azure Boards
Use Azure Boards to plan, track, and discuss
work across teams.
Guide to Azure
Azure Boards
information you need. You can query work items
and progress, and then use this information to
customize your boards, charts, and lists. From there,
you can share them or pin them on your Azure
DevOps dashboard for everyone to see.
Planning your work and tracking your progress are
important tasks—and Azure Boards can help you
complete them: DOCS
Start using Azure Boards to track
issues, tasks, and epics
Figure 7-1: Viewing backlogs with Azure Boards
In Azure Boards, you can create a complete backlog

of work items (such as user stories) and plan them
in sprints so your team can work iteratively to finish
the tasks.
The whole planning system is optimized for

working in an agile way. It even includes Kanban
boards for managing your work (Figure 7-1).
Everything can be customized to work in the best

possible way for your teams, whether using scrum,
another agile method, or the Capability Maturity
Model Integration (CMMI) process. You can create
and manage tasks, features, user stories, bugs,
requirements, issues, change requests, and more.
Try customizing your boards and creating charts

(such as burndown charts or task lists) that show the
Guide to Azure
Azure Repos commit your code to create a pull request for that
branch and submit it to the server. Users can see,
review, test, and discuss this pull request. Once it’s
good enough to be pulled into the main branch, the
request is accepted, and your development branch
Version control is essential for working together
can be deleted.
and ensuring that your most important asset—
your code—is safely stored. Azure Repos is a set With Azure Repos, you have a rich toolset to
of version control tools for storing your code and support the Git workflow. You can link work items,
sharing it with your team. This is useful both for such as user stories or bugs, to pull requests so
teams and individual developers. Version control you know what each change is about. You can
keeps a history of your development so you can have discussions about committed code and even
review or even roll back to any version of your code. comment on changes within code. Azure Repos
also enables voting on changes in code, so a change
Git
only gets accepted once everyone on the team
agrees to it.
This is a widely used version control system among
developers and is also the basis for GitHub. Git
Azure Repos offers unlimited private Git
is a distributed version control system, meaning
repositories.
the complete source code (all versions of all files)
is on your machine—which makes it easy to work
offline. With Git, the source of truth is essentially LEARN
MORE
on everyone’s machine and is synchronized when
Get started by learning how to code
developers push their code to the Git server (in this with Git
case, Azure Repos).
Azure Repos uses standard Git. This means that you

can use it with any Git tool and IDE, including Visual
Studio and Visual Studio Code, as well as Git for
Windows, macOS, Linux, Eclipse, and IntelliJ.
When you follow the Git workflow, you usually

begin by creating your own branch of the code to,
for instance, add a feature. Once you finish this, you
Guide to Azure
Azure Pipelines
Once your code is in a repository such as Azure
Repos, you can start to automate your build and
release processes with Azure Pipelines.
Figure 7-2: Azure Pipelines: build pipeline
Azure Pipelines provides a lot of value in a small

Jenkins or Spinnaker, you can easily bring your
amount of time. It enables continuous integration
existing builds and pipelines to Azure and take
(CI) for compiling and testing code when changes
advantage of dynamic agent plug-ins to reduce
come in, as well as continuous deployment (CD)
infrastructure requirements and costs.
for deploying applications after changes are
compiled and tested successfully. We encourage
There are two ways of working with Azure Pipelines.
every organization to explore CI and CD, as these
You can create pipelines using the visual designer
processes improve code quality and reduce
in the Azure DevOps portal, or you can use the
deployment efforts.
more advanced YAML-based approach. In this
approach, you create a YAML code file, which
Azure Pipelines can help with CI and CD by offering
contains all the steps of the pipeline, and commit
build and deployment pipelines. Each contains
that to source control.
steps to compile and test your code and deploy it
to one or more environments. The beauty of Azure
Pipelines is that it works with any type of code, no The easiest way to get started is to use the visual
matter where you store it—from C# on Azure Repos designer. Let’s take a look at an example of a build
to Java on BitBucket, to Node.js on GitHub, or any and release pipeline:
other language or Git or SVN repository.
Build pipeline: The build pipeline (or CI pipeline) in
Azure Pipelines works very well with Azure services Figure 7-2 shows a list of tasks that will be executed
to deploy your application in an Azure web app, when this pipeline runs. The pipeline is configured
for instance. It also works with any service that runs to run as soon as new changes are committed to
in any other environment, such as Google Cloud Azure Repos. It will take the code in Azure Repos
Platform, AWS, or even on-premises in your own (which is a Node.js app), build a Docker container
datacenter. If you’re already using CI tools such as image from it, and push that to Azure Container
Guide to Azure
Registry. From there, Helm can use it to compile

the image into a package that can be deployed on
Azure Kubernetes Service.
Note that you can configure which hosts run your

pipelines for you. On the right side of the figure,
you can see that this particular pipeline will run on
Figure 7-3: Steps in the development stage of the release
a hosted pool of Ubuntu Linux machines. There are
pipeline
also Windows hosts available, and even a hosted
macOS that you can use to build your macOS This means you can automate everything and
and iOS applications. This is just one example of a leave the decision to release to production up to a
build pipeline. It’s possible to create one for every manager based on test results for previous steps in
imaginable application. You can also integrate tests, the pipeline.
including unit tests and static code tests, into the
build pipeline. Make your pipelines as simple or complex as you
want. Ideally, you want to automate as much as
Release pipeline: The release pipeline (or CD you can, from the creation and destruction of your
pipeline) executes as soon as the build pipeline infrastructure to the deployment and testing of
runs successfully, though you can also configure it your application. Pipeline tasks are available for
to be triggered manually. The release pipeline in almost everything, and you can access more tasks
Figure 7-3 contains nine tasks that first create an as extensions to Azure DevOps in the Visual Studio
Azure Kubernetes Service cluster and then deploy Marketplace.
the Helm package that was produced in the build
pipeline to the cluster.
STEP BY
STEP
Figure 7-3 shows the steps in the development Pipelines by creating your
stage. Stages are like environments. You can first pipeline
configure a stage for your development, test, and
production environments, and so on. You can also
configure things such as pre-deployment approvals,
which require someone to approve the release of an
application into a specific environment (such as the
production environment):
Guide to Azure
Azure Test Plans
To improve the quality of your applications, use

Azure Test Plans to define test plans and then
Figure 7-4: Creating a test
create and execute manual and exploratory tests.
Azure Test Plans provides the tooling to author
From the context of the test, the tester can also
tests, execute them, record feedback, and track the
create a bug that needs to be solved.
test results.
To ensure stakeholders’ expectations are in line
For automated testing as part of your CI/CD
with your plan, Azure Test Plans also enables you
workflow, consider leveraging Azure Pipelines.
to request feedback for work items, such as user
It provides mechanisms for continuous building,
stories. This enables stakeholders to take a look at
testing, and deployment to any platform and cloud.
what you propose and provide feedback in the form
of text, attachments, video, or voice.
In Azure Test Plans, start by creating a test plan.
This contains multiple test suites and test cases. A
Perhaps most importantly, Azure Test Plans
test case can be an exploratory test, in which the
provides dashboards and charts on the progress
application is explored to see whether it works as
and status of the tests in your project. You can use
expected; a guided manual test, in which test steps
these to see what the quality of your application is
and expected outcomes are described in detail; or
and how it progresses over time. This can help you
an automated test. You can even record test steps
identify features that aren’t ready to be deployed.
by recording clicks in an application and letting
Azure Test Plans automate those clicks into a test.
You can also incorporate stress and load tests into
DOCS
your build and release pipelines. Test cases are Get started with Azure Test Plans by
work items, just like user stories and tasks, and can creating manual test cases
therefore be scheduled within an iteration.
Once you’ve created a test (Figure 7-4), a tester

can run it. In a manual test, for example, the tester
uses the test tool to run through the test steps and
records findings, including the screen, the tester’s
voice, screenshots, and attachments. The tester
passes or fails each step of the test.
Guide to Azure
Azure Artifacts
Follow these simple steps to use Azure Artifacts:
1. Create an Azure Artifacts feed.
2. Publish your package to the feed.

Because packages offer functionality that you don’t
have to build yourself, you probably use a lot of 3. Consume the feed in your favorite IDE, such as
them in your applications. And you likely access Visual Studio.
them from just as many sources: NuGet, npm,
Maven, and others. But what if your team creates
packages that you want to only use internally? QUICK
START
Where do you host them securely, and how do Get started with Python
you share them? Azure Artifacts provides this packages in Azure Artifacts
capability. Azure Artifacts is a package feed that
allows you to host packages that you create and
secure them for your organization.
You can host all sorts of packages on Azure

Artifacts, including NuGet, npm, Maven, Python,
and Universal Packages. You can even use the
Azure Artifacts feed to store packages from public
sources, such as nuget.org and npmjs.com. When
you store packages from public sources on your
feed, you’ll be able to keep using them even if
they’re no longer available on the public feed. You’ll
also be able to leverage Azure Artifacts to review
and validate each package for security purposes
within your feed. This is especially useful for
mission-critical packages.
Guide to Azure
GitHub
source community to be used for improving the
safety of code in other codebases.
No single organization can find every vulnerability

or secure the open source supply chain behind
GitHub offers Git repositories along with additional everyone’s code. Semmle’s community-driven
capabilities centered around team collaboration approach helps more easily identify and prevent
and communication on projects. GitHub also offers security vulnerabilities in code.
features that can help secure your code.
GitHub Dependabot
Repositories on GitHub
GitHub Dependabot creates pull requests to
GitHub provides Git source code control with some keep your dependencies secure and up to date.
additional features that help to increase teams’ Dependabot creates pull requests that include
ability to collaborate. The features include the release notes, changelogs, commit links, and
option to create and track issues and pull requests vulnerability details whenever available.
within a GitHub repository. Issues are used to help
monitor the discussion around bugs and other Dependabot monitors security advisories for Ruby,
actionable items that need to be performed. Pull Python, JavaScript, Java, .NET, PHP, Elixir, and Rust.
requests enable contributors to collaborate on a Pull requests are created immediately in response
project by submitting code change proposals in to new advisories.
a way that allows discussion and approval before
changes are merged into the repository. Further reading
GitHub Advanced Security If you want to improve the quality of your software
and learn more about automating your build and
GitHub Advanced Security is used to secure your
release processes, download and read these free
code by providing a semantic code analysis engine
resources:
that allows developers to write queries that identify
code patterns in large codebases and search for
vulnerabilities and their variants. RESOURCE
HUB
Effective DevOps
Simple declarative queries can be used by security
researchers to quickly find vulnerabilities in code. Deploy applications with Azure
DevOps
These queries can then be shared with the open
Theamet,
Developer’s
consectetur 111
08 /




Microsoft
Azure in
action
Guide to Azure
Navigating the
Azure portal
The Azure portal is a web-based, unified console
that provides an alternative to command-line tools.
With the Azure portal, you can manage your Azure
subscription using a graphical user interface.
Figure 8-1: Azure Marketplace pane

Dashboards in the Azure portal
The Azure Marketplace pane is pre-populated with
Dashboards provide a focused view of the resources popular services grouped into categories. If this list
in your subscription that matter most to you. The doesn’t include what you’re looking for, then you
default dashboard is provided to get you started. can use the Search the Marketplace box to type in
You can customize this dashboard to bring the a search.
resources you use frequently into a single view.
When you find the service you want from the search
Any changes you make to the default view affect results, as shown in Figure 8-2, a wizard takes you
your experience only. However, you can create through its configuration and deployment:
additional dashboards for your own use or publish
customized dashboards and share them with other
users in your organization.
Adding services
You can find and add services in the Azure portal in

several ways.
To create new services, select + Create a resource

on the Azure home screen, or do the same within
the left-hand navigation menu, which can be
expanded by selecting the hamburger icon in the Figure 8-2: Searching for a service in Azure Marketplace
upper-left corner of the Azure portal. This opens
You can use the search box at the top of the portal
the search box for Azure Marketplace, where you’ll
to search through all your resources and go directly
find everything from web applications to Linux
to them (Figure 8-3).
servers, as shown in Figure 8-1:
Guide to Azure
Creating a new VM
Let’s use the Azure portal to create a new VM. Once
we’ve done so, we’ll shut it down and remove it so
that you don’t continue to pay for it.
A word about resource groups
Figure 8-3: Navigating to a resource using the search box

The VM will be deployed in a resource group, a
This search drop-down menu displays a list of Azure logical container that holds resources. All Azure
services that can be created, your existing resources resources reside inside resource groups. You can
and resource groups, Marketplace items, and manage the security of a resource group as well
documentation links that match your search. It’s as seeing what the resources in the group cost. It’s
there to help you discover what you’re looking for. common practice to bundle related services in a
resource group so that they’re easier to secure:
Understanding blades
1. In the Azure portal, go to the home screen and
Pages in Azure are also called blades, and you can select + Create a resource.
pin them to your dashboards. When you open a
web application, you first see the Overview blade, 2. Search for and select Windows Server, and then
as shown in Figure 8-4. choose the Windows Server 2019 Datacenter
option.
For example, the App Service blade provides the
ability to stop, start, and restart the web application 3. The Create a virtual machine wizard opens.
and display tiles showing its metrics, such as the
number of requests and errors: 4. Choose a resource group to add the virtual
machine to. Selecting Create new can be used
to create a new resource group at this time.
5. Choose a Virtual machine name.
6. Choose the Region of the VM.
7. Notice that the Size of the VM is already set to a

default pricing tier. You can select Change size
to select a different size if desired. There are
many sizing options for VMs. VM performance
determines the cost. Use the wizard to select
how many cores and how much memory you
Figure 8-4: The Overview blade
Guide to Azure
want, and choose options based on that. In attach to the VM, as well as the virtual network,
addition, there are other features that come IP address, and extensions on the machine.
with size options, such as: For now, leave everything as is and select
Review + create.
• The type of hard drive (SSD or normal HDD).
13. Review the summary, agree to the terms, and
• The number of max input/output then select Create.
operations per second (IOPS). This
determines the performance of the VM It usually takes just a few minutes for the VM to
in a significant way, especially if your be deployed. When you navigate to the VM in the
applications read and write extensively Azure portal, you can configure it further and log in
from and to the hard drive. using Remote Desktop Protocol (RDP):
• The amount of data drives that can be

installed in the VM.
• The ability to perform load balancing.
• The graphics card installed in the VM.

This is useful if you need to execute
Figure 8-5: Using RDP for VM configuration
substantial graphics rendering or a heavy
computational workload.
To log in to the VM using RDP, click Connect in the
VM’s Overview blade in the Azure portal (Figure
8. Type a Username for the administrator account 8-5). From there, you can download an RDP file
for the virtual machine. you can use to connect to the VM using Microsoft
Remote Desktop.
9. Type a Password and confirm.
Cleaning up the walkthrough resources

10. Notice that the Public inbound ports option
is set to Allow selected ports, and the Remote When you’re finished with the VM, shut it down
Desktop Protocol (RDP) port of 3389 is selected. and remove it by deleting the resource group
This will enable you to remote into the VM once that we created when we generated the VM. This
created. contains the VM and all other resources that are
automatically created. Once the resource group is
11. Select Next: Disks >
deleted, you no longer pay for any of the resources
that you’ve used in this walkthrough.
12. You can configure additional settings such as
the OS disk type, any additional data disks to
Guide to Azure
Developing
5. Leave the Publish selection as Code, and
then select the .NET Core 3.1 (LTS) value for
your first web

Runtime stack.
6. Leave the OS selection as Windows.
application and 7. Select or create an App Service Plan.
database on Azure 8. Select Review + create, and then select

Create.
Services such as Web Apps run on Azure App

In this walkthrough, we’ll deploy a simple .NET Core Service plans. App Service plans are an abstraction
application that connects with a SQL database. of resources and features, like CPU and memory,
Then, we’ll host using the Web Apps feature of and are represented in pricing tiers.
Azure App Service.
App Service plans are also bound to a specific
To follow along, you’ll need Git v2 or higher, .NET geographic region that you choose. You can, for
Core, and Visual Studio Code installed on your instance, run your Web Apps application in an App
device. We’ll also use a sample ASP.NET Core MVC Service plan of pricing tier S1, which has 1 core and
application to manage a to-do list. 1.75 GB RAM, as shown in Figure 8-6:
Creating a web application and database

using the Azure portal
To host the .NET Core application, we’ll create a new

web application in the Azure portal.
Figure 8-6: Choosing an App Service plan
1. In the Azure portal, select + Create a resource.

You can run as many application services on an App
2. Search for Web App. The Web App blade Service plan as you wish, but note that you need to
opens. Select Create. The Web App Create share resources among all the application services.
blade opens.
To host the database, we’ll create a SQL database.
3. Create a new Resource Group by giving it This works the same as a local SQL Server database
a name. and now runs fully managed in Azure:
4. Type a Name for the web app. 1. In the Azure portal, click + Create a resource.
Guide to Azure
2. Search for SQL Database and click it to open 9. Make a note of the connection string because
the SQL Database blade. Click Create. The you’ll need it later in this tutorial.
Create SQL Database blade opens.
Running the .NET Core application locally
3. Select the resource group that you created for
the web app. Let’s run the application locally before we run it in
Azure. The application can run locally because, by
4. Type a database name. default, it uses a SQLite database, which is a self-
contained SQL database engine:
5. Click Server to create a new SQL database server:
1. Open a Command Prompt or terminal window,
a. Type a name for the server. and then navigate to a directory you want to use
as your source code directory for this project.
b. Type the server admin login. This is the
username for the server. 2. Run the following commands to get the source
code and navigate to the project folder:
c. Type the password that you’ll use to log on
to the server.
git clone https://github.com/azure-samples/
dotnetcore-sqldb-tutorial
d. Confirm the password.
cd dotnetcore-sqldb-tutorial
e. Choose a location. Choose the same

3. The project uses Entity Framework Core
location that you selected for the App
to populate its database. To ensure that
Service plan.
the database is up to date and to run the
f. Click OK to submit the new server application locally, execute the following
configuration. commands:
6. On Compute + storage, select Configure dotnet restore
database, and then select a pricing tier. For dotnet ef database update
development and test purposes, the Basic tier is
dotnet run
sufficient.
7. Click Review + create, and then Create. The 4. The application should now be running, and
database will now be created. the URL to the application (such as http://
localhost:5000) should be in the output in the
8. Navigate to the SQL database and click Show Command Prompt window.
Database Connection String.
Guide to Azure
5. Navigate to that URL in a browser. This will load

the application, which will look like that shown if(Environment.
GetEnvironmentVariable(“ASPNETCORE_
in Figure 8-7. Now you can create new to-do ENVIRONMENT “) == “Production”) services.
AddDbContext<MyDatabaseContext>(options =>
items by selecting the Create New link.
options.UseSqlServer(Configuration.
GetConnectionString(“MyDbConnection”)));
6. Close the application by closing the Command
else
Prompt window or by pressing Ctrl+C:
services.
AddDbContext<MyDatabaseContext>(options =>
options.
UseSqlite(“DataSource=localdatabase.db”));
// Automatically perform database

migration services.BuildServiceProvider().
GetService<MyDatabaseContext>().Database.
Migrate();
This code looks at the environment in which it’s

running and changes its database connection
based on that information. When running in the
Figure 8-7: The application running locally in a browser production environment (Azure, in this case),
the code will get the connection string for the
Connecting the local web application to database from the MyDbConnection variable,
the database running in Azure which we’ll configure in Azure.
You now have a working application running The code also runs the Database.Migrate()
locally. Before we deploy it to Azure, we’ll change method, which executes the Entity Framework
the source code so that it can connect to the SQL Core migrations that we previously ran
database: manually.
1. In your local source code repository, find the 3. Save your changes and run the following
Startup.cs file and locate the following code: commands to commit the changes to your local
Git repository:
servicesAddDbContext<MyDatabaseContext>
(options => options.UseSqlite(“Data
Source=localdatabase.db”)); git add .
git commit -m “connect to SQLDB in Azure”
2. Replace the code with the following code,

Now, we’ll configure the connection string variable
which will connect to the Azure SQL database:
in Azure.
// Use SQL Database if in Azure, otherwise,

4. In the Azure portal, navigate to the web
use SQLite
application that we created earlier.
Guide to Azure
5. Navigate to Configuration under Settings. 3. Select Local Git, then App Service build service,
and then click Finish.
6. Create a new connection string named
MyDbConnection. The value should be 4. Copy the Git Clone Uri that has been created
the connection string to the SQL database for the web app. This will be used to push the
(including the username and password) you application code to the web application using Git:
saved earlier when you created the database
and set Type to SQLAzure.
7. Click Save. The application settings in the

Azure portal should look like those shown
in Figure 8-8:
Figure 8-9: Git Clone Uri being displayed
5. Select the Deployment Credentials button

to set the credentials that will be used to
authenticate Git when deploying the app.
6. On the Deployment Credentials pane, select

the User Credentials scope under the Local
Git tab.
Figure 8-8: Application settings in the Azure portal
7. Enter a Username and Password, and then
Deploying the web application to Azure click Save Credentials. This needs to be set up
the first time so that you have credentials to
We’ll use Git to push the application to Azure. To authenticate against the Git endpoint that will
connect the local Git repository to Azure, you must be used.
have a deployment user configured on the server
(Web Apps) to authenticate your deployment. The 8. Open the command prompt on your local
deployment user is account level and is different machine.
from your Azure subscription account. You need to
9. Add a remote to your local Git repository by
configure this deployment user only once:
using the remote Git URL:
1. In the Azure portal, navigate to the web app.
a. Replace <deploymentLocalGitUrl> with
2. On the web app in the Azure portal, select the Git Clone Uri from the Azure web app
Deployment Center. Deployment Center.
Guide to Azure
b. Use the URL to run the following command:
git remote add azure

<deploymentLocalGitUrl>
10. Once the remote target is added to the Git

repository, you can push your code to it by
running the following command. You’ll need
to enter credentials to be able to push code to
Azure. Use the username and password you
used to create the deployment user:
git push azure master
When prompted, enter the Username and

Password that were created previously using
Azure Cloud Shell.
Pushing the source code to Azure might take

a few minutes the first time. Once complete,
navigate to the URL of your Azure web app,
which will look like this: http://<app_ name>.
azurewebsites.net.
11. Add some to-do items in the application to test

its connection to the database.
Now you have a working application running

in Azure.
Guide to Azure
Extending
additional services that simply analyze the data
that’s already there.
applications with Creating LUIS
Logic Apps and First, you’ll create LUIS so that we can use it later in
our logic application.
Cognitive Services You can use the LUIS portal to build a language
model. First, you need to add some entities, which
are items in the text the service will recognize. Then,
you enter utterances, which are sample texts that
A powerful feature of our application could be the represent the intent you want to detect.
ability to analyze the content of to-do items and then
automatically create calendar appointments for tasks Here is an example of an utterance:
that include a specific date.
“family dinner next Friday at 7 PM”
For example, if a user creates a to-do item with the text

“family dinner next Friday at 7:00 PM,” the application
Creating the logic application
will create a calendar item for that specific Friday at 7:00
PM with the subject “family dinner.”
Next, to integrate LUIS into the application, create
an Azure logic app. Within the logic app, the LUIS
This can be set up using the Logic Apps feature connector can be used to add actions to integrate
of Microsoft Azure App Service and Language LUIS with your applications.
Understanding (LUIS), as follows:
When using LUIS actions, you enter the API key for
• The .NET Core application writes the to-do item in your LUIS service, so the logic app can connect to
the SQL database. and integrate with your Language Understanding
service. Then, you configure the logic app to pass
• The logic application is triggered by every new row the particular utterance text to send to LUIS to use
created in the database. for recognizing utterances.
• The logic application takes the to-do item text and For example, a “LUIS—Get prediction” action could
passes it to LUIS. be added to a logic application that connects to a SQL
database that’s triggered when a new row is created.
• LUIS analyzes the text and creates a calendar item in The logic app could pass in text retrieved from the
your Office 365 calendar if the text contains a date database row to LUIS so that it can perform utterance
and time. recognition. Then, the logic app could save the result
back to the database, or use it to execute additional
You don’t have to change your application to add this
actions to perform tasks based on those results.
functionality. Logic Apps and Cognitive Services are
Guide to Azure
Ready for
There are deployment slots for staging, load
testing, and production, which is always the
production
original app service—in our example, the .NET
Core web application. In fact, you can have as many
deployment slots as you wish without incurring
additional costs.
With your application running, you can now use The deployment slots all run in the same App
Azure to make it more robust and easier to update. Service plan, which is what you pay for. Keep in
mind that having additional deployment slots in an
Setting up continuous delivery with App Service plan will consume resources such as
GitHub CPU and memory, so be mindful of how additional
slots might impact production.
So far, we’ve been pushing code from our local Git
repository to Azure. This is fine if you work alone, You create new deployment slots from the
but if you work in a team, you’ll need another type Deployment Slots menu item in the web app. You
of source control, such as Azure Repos, one of the need to run the web application in the standard or
services in Azure DevOps, or GitHub. premium pricing tier because the free plan doesn’t
come with additional deployment slots.
You could use a GitHub repository to push your
code and then link that to your web application In each deployment slot you create, you can
so that changes are deployed automatically in a configure the deployment options as we did earlier
continuous delivery pipeline. to deploy code automatically. You can even work
on different source code branches for different
Continuous delivery can be configured using the
environments and automatically deploy specific
Deployment Center feature of Web Apps through
branches to specific deployment slots.
the Azure portal. This feature enables you to choose
the location of your code as well as options for Additionally, you can test your final version in a
building and deploying to the cloud. deployment slot and then swap it with the version in
the production slot. This warms up the application
Setting up staging environments before it swaps, resulting in a deployment with no
downtime.
Using Azure App Service Web Apps, you can set up a
staging slot to test new versions of your application
through deployment slots. Deployment slots are
application services with which you can test your
code before you promote it to the next slot.
Guide to Azure
Scaling the web app You’ll see logging when you use the application in
the web application to generate some traffic.
When you have many users, you need web apps to
scale up to accommodate increased traffic. When Setting up monitoring and alerts
they’re not busy, you need them to scale back to
reduce costs. You can do this with the Automatic Azure Monitor Application Insights provides
Scaling feature of App Service. You need to run the another powerful way to track applications. This
web apps in the Standard or Premium pricing tier to monitoring tool provides information about your
use this feature. application, such as how many visitors used it, how
many exceptions occurred, and where in the code
Alternatively, the Free tier could be used to run a they happened. Unlike diagnostic logs, Application
single instance of a web app. Insights requires a nominal fee.
Web Apps has a menu item called Scale Out, as Adding Secure Sockets Layer
shown in Figure 8-10. You can use this to scale out
manually or automatically. Scaling out means you When an application is ready for production,
add more instances of your application to handle you need to confirm that it’s secure. Besides
the load: authentication and authorization, serving the
web application over HTTPS is one of the most
important security measures you can take. This
is because, without HTTPS, intruders could see
the traffic among your resources and use this
information for malicious purposes, like signing
in to your application. Additionally, HTTPS is a
requirement for leading-edge features such as
service workers.
Figure 8-10: The Scale Out menu item
Serving traffic to your web application over Secure
Using diagnostic logs Sockets Layer (SSL) is possible by importing an SSL
certificate into Web Apps and binding it to one of
An efficient way to monitor an application is by your custom domain names. You can either import
using diagnostic logs to see live diagnostic logging your own SSL certificate or purchase one through
from the web app. You can even pipe the logs into Azure App Service Certificates. This service
the console window. To do this, run the following makes it easy to buy and validate certificates. After
command in Cloud Shell: importing the certificate, couple it to one of the
domain name bindings of your web app. You can do
az webapp log tail --name <app_name> --resource-
group <myResourceGroup>
all this from the TLS/SSL settings in the web app.
Guide to Azure
Notifying users about new versions Further reading
Your business will benefit from making users aware Learn more about architecting Azure solutions in
of new production releases. By extending the these free resources:
continuous integration/continuous delivery (CI/CD)
process in Azure builds, you can use a Logic Apps
RESOURCE
workflow to manage social media communication, HUB
such as sending out tweets or publishing posts with Azure for Architects
release notes.
Architect great solutions
An Azure pipeline could be instrumented to trigger in Azure learning Path on
Microsoft Learn
the logic app to execute after a release pipeline
has finished publishing new application changes.
Alternatively, the Events feature of the App Service
web application could be configured to trigger a
logic app based on events emitted from Azure App
Service, such as when the deployment slots are
swapped.
Theamet,
Developer’s
consectetur 124
09 /




Summary
In this guide, we introduced the power that Azure

can bring to your applications. Using Azure, you
can do incredible things with your applications,
omnimusam
including veni
hosting andnossita.
scaling your web
and
applications, taking advantage of containers, using
AI in your applications, and scaling as much as you
want—and you only pay for what you use.
resources You’ve learned that Azure has services for almost

every scenario, so it can help you no matter
which programming language you use or which
platform you write applications for. We hope you
continue to consult this e-book to become better
acquainted with the vast range of Azure services
and determine which ones best fit your needs.
Thanks to the wealth of prebuilt solutions in Azure,

the days of having to write complicated plumbing
are over. Free yourself up to work on the things
that matter to you by taking advantage of all that
Azure offers.
Guide to Azure
Keep learning
• Azure Tips and Tricks: Browse a collection
of useful ideas to help you become more
with Azure
productive with Azure.
• Azure Friday: Take a look at Azure services and

features with the Microsoft engineering team.
With your Azure free account, you get all of this— • Microsoft.Source: Receive a regular digest
and you won’t be charged until you choose to of relevant technical content, events, and
upgrade: training. Learn about new technologies and find
opportunities to connect with other developers
online and locally.
• 12 months of popular free services.
• Azure Certifications: Earn certifications that

• $200 credit to explore any Azure service for
show you are keeping pace with today’s
30 days.
technical roles and requirements.
• 25+ services, always free.
• Azure Communities and Meetups: Join our
• Get started with Azure: Watch these short community-led meetups, where you’ll learn
tutorials on how to use Azure and start building from your peers about solutions to common
projects right away. You can also join our problems, fun projects, and what’s new in
weekly webinar, which provides demos of Microsoft Azure!
Azure basics and provides ongoing access to
experts.
• Microsoft Learn: Learn new skills and discover

the power of Microsoft Azure products with
step by step guidance. Start your journey today
by exploring our Azure learning paths and
modules, including Learn TV, which features
the latest digital content so you can always
keep updated on the latest announcements,
features, and products.
Guide to Azure
Free resources extravaganza • Developers Guide to IoT: An e-book that provides

an overview of Azure IoT services and gets you
In addition to this guide, there are many other started.
free resources about Azure, including:
• Azure for Architects: A comprehensive guide for
• Learn Azure in a Month of Lunches: A practical Azure architects.
way to learn Azure from scratch over a month
of lunches. • Thoughtful Machine Learning with Python:
Explore machine learning fundamentals with
• Azure Serverless Computing Cookbook: Python, techniques for improving models, and
Find use cases, hands-on recipes, and tutorials developing viable frameworks.
for quickly configuring your own serverless
environment. • Cloud Analytics with Microsoft Azure: Maximize
your BI impact by bringing data together from all
• Designing Distributed Systems: An e-book your sources with Azure Synapse Analytics.
on building containerized applications, with
hands-on labs on Azure Kubernetes Service. • Introducing Microsoft SQL Server 2019: Find
out what’s new in Microsoft SQL Server 2019, a
• Containerize Your Apps with Docker and platform for secure and compliant modern data
Kubernetes: A practical guide for moving management.
applications to the cloud with Docker and
Kubernetes. • Azure Networking Cookbook: Configure,
manage, monitor, and troubleshoot networks
• Effective DevOps: A useful guide for improving more effectively with networking solutions from
collaboration across teams, promoting the Azure.
efficient use of tools, and using the concepts of
DevOps. • Hands-On Linux Administration on Azure: Find
everything you need to know about deploying
• Kubernetes Up & Running: Improve the agility, and managing Linux workloads on Azure.
reliability, and efficiency of your distributed
systems with Kubernetes. • Making the Most of the Cloud Everywhere:
Unified development and modernization practices
• Building Intelligent Cloud Applications: Build in hybrid environments.
and deploy scalable deep learning and machine
learning models using serverless architectures • Enterprise Cloud Strategy: What you need to
with Azure. know now about moving your enterprise to a
cloud computing strategy.
http://www.azure.com/free
By developers, Get technical articles, sample
code, and information on
● Keep up on the latest
technologies
for developers upcoming events in ● Connect with your peers
Microsoft.Source, the at community events Sign up

curated monthly developer ● Learn with
Microsoft.Source newsletter community newsletter. hands-on resources

Guide to Azure
About the
authors
Michael, Chris, and Vahe are passionate about

Azure and encourage you to reach out to them on
Twitter for questions regarding this book.
Michael Crump works at Microsoft on the Azure Chris Pietschmann is a Principal Cloud and
platform and is a coder, blogger, and international DevOps Solution Architect with Solliance, and a
speaker on various cloud development topics. He’s Microsoft MVP with Azure and IoT. He’s passionate
passionate about helping developers understand about helping individuals and teams be more
the benefits of the cloud in a no-nonsense way. productive in the cloud.
You can reach Michael on Twitter, @mbcrump, You can reach Chris on Twitter, @crpietschmann,
follow his live coding stream at https://www.twitch. and follow his blog at https://build5nines.com.
tv/mbcrump, or catch up on a recent post in the
Azure Tips and Tricks series.
Guide to Azure
Vahe Minasyan is a technical project manager on

the Microsoft Azure Product Marketing team. You
can reach Vahe on Twitter, @vaheminasyan2, and
find him on GitHub.
PUBLISHED BY Microsoft Press, A division of Microsoft Corporation
One Microsoft Way, Redmond, Washington 98052-6399
Copyright © 2020 by Microsoft Corporation. All rights reserved. No part of

the contents of this book may be or transmitted in any form or by any means
without the written permission of the publisher.
This book is provided “as-is” and expresses the author’s views and opinions. The
views, opinions and information expressed in this book, including URL and other
Internet website references, may change without notice. Some examples depicted
herein are provided for illustration only and are fictitious. No real association or
connection is intended or should be inferred.
Microsoft and the trademarks listed at www.microsoft.com on the “Trademarks”

webpage are trademarks of the Microsoft group of companies. All other marks are
property of their respective owners.
February Lorem
May ipsum dolor sit
Theamet,
Developer’s
consectetur 130
2018 adipiscing
2020 elit Guide to Azure







Azure Book

Uploaded by

Copyright:

Available Formats

Azure Book

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Azure Book

Uploaded by

Copyright:

Available Formats

UPDATE D 2020 E DITION

Developer’s From creating websites, databases, and

Guide to Azure does the heavy lifting for you. Azure

to help Documentation and guides that give you an

Azure Community Support, which provides a

Azure Advisor, which automatically makes

Azure Service Health, which gives you a

Stack Overflow, which provides answers to Azure

duciuscit, odit blaut omnimenem fugitas et omnihil

volupis as volo facearchilit quidelia peri conserrum, qui

eos et libusci re porepedit faciminciae lant et dolorpos et

duntem commo in natem.

es nit etur sit Sedicil labores citatem natem sedit autet

Simply choose which programming languages,

What can Azure

Let’s dive in and see what you can do.

You can host your applications in a fully managed

Azure App Deployment slots

By setting up staging environments in Azure App

Those should be separated for security, scaling, Connect to on-premises resources

Debugging applications can be difficult, especially

Perhaps you want it to be called by another

Hosting your application in a VM in Azure Virtual

You can use a VM to test the latest preview version

Azure DevTest Labs and Azure Lab Services

Azure DevTest Labs allows you to set up an

Azure Lab Services lets you create managed lab

Cold start/warm start

When Azure Functions has been sitting idle,

With the Azure Functions Premium plan, you can

3. Using Twilio, the logic app sends a text message

Here’s a side-by-side comparison to help

Table 1-1: What to use when

Pro integrators and developers,

Self-service Scenarios Advanced integration

In-browser and mobile In-browser and Visual Studio Code

Manage Power Automate

Security assurance for Azure: Azure

Batch is a free service, so you only pay for the

Batch is well suited to running parallel workloads

QUICK in Azure. You can either build on demand or fully

Azure Service Fabric

While this can make it difficult to pick the right

Table 1-2: Deciding the right service

Web App for

Making your Azure Traffic Manager

performant obvious problem you need to deal with is latency,

When users access your application, Azure Traffic

Including Azure Traffic Manager in your

Because of this difference, Azure Front Door

Azure Front Door allows you to author custom

Additionally, Front Door enables you to create rate-

Other capabilities of Front Door include:

• URL-based routing • SSL termination

If you need help choosing between Azure Front

Table 1-3: Selecting the best option

You only need routing (performance-

You need SSL termination (also called

• It offloads serving content from your