Microsoft Azure: Complete Cloud Learning Guide for .NET Full Stack Developers

Learn cloud fundamentals, Azure services, application architecture, security, databases, deployment, monitoring, and DevOps through practical C# and ASP.NET Core examples.

Introduction

Modern full-stack applications need more than a backend API, frontend interface, and database. They also need reliable hosting, secure configuration, identity management, file storage, networking, monitoring, deployment automation, and a plan for scaling.

Microsoft Azure is Microsoft's cloud computing platform. It provides services for hosting applications, storing data, managing identities, connecting systems, monitoring workloads, and building cloud-native solutions.

For a .NET full stack developer, Azure is especially useful because it integrates with ASP.NET Core, C#, Visual Studio, SQL Server, GitHub, and Azure DevOps. You can build an application locally and then deploy its frontend, API, database, and supporting services to Azure.

This guide starts with cloud fundamentals and gradually moves toward real application architecture. It explains what each Azure service does, when to use it, and how it fits into a .NET application.

Learning approach: We will use a generic Employee Management application as a running example: an Angular frontend, an ASP.NET Core Web API, and a SQL database. The same architecture concepts apply to many business applications.

What Is Cloud Computing?

Cloud computing is the delivery of computing resources over the internet. Instead of purchasing and maintaining physical servers in your own office or data center, you rent computing capabilities from a cloud provider.

These resources can include virtual machines, application hosting, databases, storage, networking, identity services, analytics, and managed platforms.

Traditional Hosting vs Cloud Computing

Traditional / On-Premises	Cloud Computing
Organization purchases physical servers.	Resources are provisioned from a cloud provider.
Hardware capacity must be planned in advance.	Capacity can often be increased or reduced on demand.
Organization maintains hardware and data-center facilities.	Provider manages the underlying facilities and, depending on the service, more of the platform.
Scaling may require purchasing and installing hardware.	Scaling can be configured through service settings and automation.
Large upfront capital expenditure may be required.	Usage-based or subscription pricing is common.

Important Benefits

Scalability: Increase or decrease resources as demand changes.
Availability: Use platform capabilities and architecture patterns to reduce downtime.
Global reach: Deploy workloads in regions closer to users.
Managed services: Reduce infrastructure maintenance work.
Cost flexibility: Pay for selected resources and usage, subject to each service's pricing model.
Security capabilities: Use identity, network, encryption, policy, and monitoring services.

Important: Cloud does not automatically mean cheaper, secure, or highly available. Those outcomes depend on service selection, configuration, architecture, operational practices, and cost monitoring.

What Is Microsoft Azure?

Microsoft Azure is a cloud platform that provides infrastructure, platform services, and software capabilities through Microsoft's global cloud infrastructure.

Developers can use Azure to host an ASP.NET Core Web API, publish an Angular frontend, connect to Azure SQL Database, store uploaded files, protect secrets, authenticate users, and monitor application performance.

What Can You Build with Azure?

ASP.NET Core MVC applications and Web APIs.
Angular, React, and other frontend applications.
Microservices and containerized applications.
Background jobs and event-driven systems.
Applications using SQL and NoSQL databases.
File-processing, messaging, and integration solutions.
AI-enabled and data-driven applications.

Azure Tools Commonly Used by .NET Developers

Tool	Purpose
Azure Portal	Browser-based interface to create and manage Azure resources.
Azure CLI	Command-line management and automation.
Azure PowerShell	Manage Azure resources using PowerShell modules.
Visual Studio	Develop, publish, and debug supported .NET applications.
VS Code	Code editing with Azure and language extensions.
Azure Cloud Shell	Browser-based shell with Azure CLI and PowerShell options.
Azure DevOps / GitHub	Source control, build pipelines, release automation, and collaboration.

Cloud Service Models: IaaS, PaaS and SaaS

Cloud services are commonly grouped into three service models. The main difference is how much of the technology stack the cloud provider manages and how much remains your responsibility.

1. Infrastructure as a Service (IaaS)

IaaS provides infrastructure such as virtual machines, disks, and networking. You manage the operating system, runtime, installed software, application, and much of the configuration.

Azure example: Azure Virtual Machines.

Physical infrastructure  - Managed by Azure
Virtual machine          - Azure provides the VM
Operating system         - Managed by you
.NET runtime / IIS       - Managed by you
Application              - Managed by you
Application data         - Managed by you

When to use: When you need operating-system control, custom software, legacy hosting, or a server environment that cannot easily move to a managed platform.

2. Platform as a Service (PaaS)

PaaS provides a managed platform where you deploy application code without managing the underlying virtual machines and operating system in the same way as IaaS.

Azure examples: Azure App Service and Azure SQL Database.

Physical infrastructure  - Managed by Azure
Operating system        - Managed by Azure
Platform / database     - Managed largely by Azure
Application code        - Managed by you
Application data        - Managed by you

When to use: When you want to focus on building and deploying applications instead of maintaining servers.

3. Software as a Service (SaaS)

SaaS provides a ready-to-use software application. The provider manages the application platform and infrastructure, while you configure and use the product.

Examples: Microsoft 365, Outlook on the web, and many hosted business applications.

Model	You primarily manage	Azure example
IaaS	OS, runtime, application, data and configuration.	Virtual Machines
PaaS	Application code, data, configuration and access.	App Service, Azure SQL Database
SaaS	Usage, users, settings and business data according to the product.	Microsoft 365

Developer perspective: For a typical new ASP.NET Core Web API, Azure App Service is often a simpler starting point than creating a virtual machine and manually configuring IIS, Windows Server, patching, and deployment.

Cloud Deployment Models

Public Cloud

Resources are hosted by a cloud provider and delivered to customers over the internet or private connectivity. Azure is a public cloud platform.

Private Cloud

Cloud infrastructure is dedicated to a single organization. It can be operated by the organization or a service provider.

Hybrid Cloud

A hybrid approach combines on-premises infrastructure or private cloud with public cloud services. For example, an organization might keep an existing SQL Server system on-premises while hosting a new ASP.NET Core API in Azure and connecting them securely.

Multi-Cloud

A multi-cloud approach uses services from more than one cloud provider. It can address specific business, regulatory, resilience, or vendor strategy requirements, but it also increases operational complexity.

Azure Global Infrastructure

Azure operates across a global infrastructure designed to provide geographic choice, capacity, and resilience options. Understanding the terminology helps when selecting where to deploy an application.

Geography

A geography is a defined market area that typically contains two or more regions and supports data residency and compliance boundaries.

Region

A region is a geographic area containing one or more Azure data centers connected through a dedicated regional network. You select a region when creating many Azure resources.

Availability Zones

Availability Zones are physically separate locations within a region, each with independent power, cooling, and networking. Supported services can distribute resources across zones to improve resilience against a zone-level failure.

Data Center

A data center is a physical facility containing servers, storage, networking, power, and cooling equipment. A region can contain multiple data centers.

Azure Global Infrastructure
        |
        +-- Geography
              |
              +-- Azure Region
                    |
                    +-- Availability Zone 1
                    |       +-- Data Center(s)
                    |
                    +-- Availability Zone 2
                    |       +-- Data Center(s)
                    |
                    +-- Availability Zone 3
                            +-- Data Center(s)

Remember: Not every Azure region or service supports Availability Zones. Verify regional and service availability before designing a zone-redundant architecture.

Azure Portal, Subscriptions and Resource Groups

Azure Portal

The Azure Portal is a web-based interface for creating, configuring, monitoring, and managing Azure resources.

Portal: https://portal.azure.com/

Azure Account and Tenant

A user signs in through Microsoft Entra ID. A Microsoft Entra tenant is the identity boundary for users, groups, applications, and related directory objects. An Azure subscription is a billing and management boundary associated with an Entra tenant.

Subscription

A subscription provides a boundary for resource management, access control, quotas, and billing. Organizations may use separate subscriptions for production, non-production, teams, or business units.

Resource Group

A resource group is a logical container for Azure resources that are managed together. For example, resources belonging to one application environment can be placed in a resource group.

Example Organization

Microsoft Entra Tenant
    |
    +-- Subscription: Development
    |      |
    |      +-- Resource Group: rg-employee-dev
    |             +-- App Service
    |             +-- Azure SQL Database
    |             +-- Storage Account
    |
    +-- Subscription: Production
           |
           +-- Resource Group: rg-employee-prod
                  +-- App Service
                  +-- Azure SQL Database
                  +-- Storage Account
                  +-- Application Insights

Resource groups are useful for lifecycle management, access control, tagging, and cost reporting. A resource can have dependencies outside its resource group, so resource-group deletion should never be treated as a harmless cleanup action.

Azure Resource Manager and Resource Organization

Azure Resource Manager (ARM) is the management layer used to create, update, organize, and delete Azure resources. The Azure Portal, Azure CLI, PowerShell, REST APIs, and infrastructure-as-code tools use ARM management capabilities.

Common Resource Organization Concepts

Management groups: Organize multiple subscriptions and apply governance across them.
Subscriptions: Separate billing, access, quotas, and resource environments.
Resource groups: Group resources that share a lifecycle or management boundary.
Resources: Individual Azure services such as App Service, SQL Database, and Storage Account.
Tags: Key-value metadata used for ownership, environment, cost allocation, and classification.
Azure Policy: Evaluate and enforce organizational rules for resource configuration and compliance.
Role-based access control (RBAC): Grant permissions to identities at defined scopes.

Example Tags

Environment = Production
Application = EmployeePortal
Owner       = ApplicationTeam
CostCenter  = IT-Operations
ManagedBy   = Terraform

Best practice: Agree on naming conventions, tags, resource ownership, and environment boundaries before creating many resources. Consistency makes operations and cost analysis easier.

Core Azure Services for Developers

Service	Purpose	Typical .NET use
Azure App Service	Managed web application hosting.	Host ASP.NET Core MVC and Web API.
Azure Static Web Apps	Hosting for static frontend applications with integrated workflows.	Host Angular or React frontend output.
Azure Functions	Event-driven serverless compute.	Run scheduled, queue-triggered, or event-triggered C# code.
Azure Container Apps	Managed hosting for containerized applications.	Run APIs, workers, and containerized services.
Azure Kubernetes Service	Managed Kubernetes orchestration.	Operate container platforms and microservices at scale.
Azure Virtual Machines	Virtual server infrastructure.	Host custom or legacy server workloads.
Azure SQL Database	Managed relational database.	Store application data with SQL Server compatibility.
Azure Storage	Cloud object, file, queue, and table storage services.	Store documents, images, exports, and integration data.
Azure Key Vault	Manage secrets, keys, and certificates.	Protect credentials and cryptographic material.
Microsoft Entra ID	Identity and access platform.	Authenticate users and workloads.
Azure Service Bus	Enterprise message broker.	Connect APIs and background workers asynchronously.
Azure Monitor	Monitoring and observability platform.	Collect logs, metrics, traces, and alerts.

Compute Services: VM, App Service, Functions and Containers

Compute services provide the environment where your application code runs. Azure offers different hosting options because applications have different runtime, scaling, control, and operational requirements.

Azure Virtual Machines

A Virtual Machine is an IaaS resource that provides a configurable Windows or Linux server. You are responsible for operating-system updates, installed runtime versions, web server configuration, hardening, and much of the operational maintenance.

Use VMs when you need OS-level control, custom server software, or compatibility with workloads that cannot use a managed application platform.

Azure App Service

App Service is a managed PaaS platform for hosting web applications, REST APIs, and supported web workloads. You deploy application code or a supported container image while Azure manages much of the hosting infrastructure.

Azure Functions

Functions run code in response to triggers such as HTTP requests, timers, queue messages, or events. They are useful for short-lived tasks, integrations, automation, and event-driven processing.

Azure Container Apps

Container Apps is a managed platform for running containerized applications and services without requiring your team to operate Kubernetes directly. It supports revisions, ingress, scaling rules, and background workloads.

Azure Kubernetes Service (AKS)

AKS is a managed Kubernetes service. It is appropriate when a team needs Kubernetes APIs, orchestration control, advanced networking, or an established Kubernetes operating model. It also requires more platform engineering and operational expertise.

Service	Best fit	Operational responsibility
Virtual Machines	Custom OS-level hosting and legacy workloads.	Higher
App Service	Web apps and APIs with managed hosting.	Lower
Functions	Event-driven and scheduled code execution.	Low, varies by hosting plan
Container Apps	Containerized APIs, workers, and services without managing Kubernetes directly.	Moderate to low
AKS	Workloads requiring Kubernetes orchestration and control.	Higher platform expertise

Architecture advice: Do not select AKS simply because an application has multiple APIs. Start with the simplest service that meets the requirements, then adopt container orchestration when its capabilities justify the added operational complexity.

Azure App Service for ASP.NET Core

Azure App Service is a common hosting option for ASP.NET Core applications because it provides managed web hosting, deployment integration, scaling options, TLS support, configuration settings, and deployment slots on supported plans.

Typical .NET Deployment Flow

ASP.NET Core Web API
        |
        v
Build and Publish
        |
        v
Deployment Package / Container
        |
        v
Azure App Service
        |
        v
Public HTTPS Endpoint

Create a Web API

dotnet new webapi -n EmployeeApi
cd EmployeeApi
dotnet run

Publish the Application

dotnet publish -c Release -o ./publish

The publish directory contains the deployment output. You can deploy using Visual Studio, Azure CLI, GitHub Actions, Azure DevOps, or other supported deployment methods.

App Service Plan

An App Service Plan defines the compute resources and pricing tier used by App Service apps. Apps in the same plan share the plan's allocated compute resources. The plan tier affects capabilities such as scaling, networking, deployment slots, and availability features.

Important App Service Settings

Runtime stack: Select a supported .NET runtime or deploy a supported custom container.
Operating system: Choose Windows or Linux based on runtime, dependencies, and hosting requirements.
Application settings: Supply environment-specific configuration without hardcoding it in source.
Connection strings: Configure database connectivity securely.
Health checks: Configure a health endpoint where appropriate.
Deployment slots: Validate a deployment in a staging slot before swapping to production, when supported by the plan.
Scale out: Add instances when workload demand requires more capacity.

Important: App Service is not simply a container that includes every .NET version. Check the supported runtime stack and hosting options for your chosen operating system and region. A custom container can be used when you need to control the runtime image.

Azure Static Web Apps and Frontend Hosting

Azure Static Web Apps is designed for static frontend applications and can integrate with supported build and deployment workflows. It is commonly used for Angular, React, Vue, and other frontend build outputs.

Angular Build

npm install
npm run build

The build produces static files such as HTML, CSS, JavaScript, and assets. The exact output directory depends on the Angular project configuration.

Frontend and API Hosting Choices

Frontend type	Possible Azure hosting	Notes
Angular SPA	Azure Static Web Apps or App Service	Static Web Apps is purpose-built for static frontend delivery.
React SPA	Azure Static Web Apps or App Service	Deploy the production build output.
ASP.NET Core MVC / Razor Pages	Azure App Service	Server-rendered application hosted as a web app.
Angular + ASP.NET Core API	Static Web Apps + App Service, or a combined hosting approach	Separate hosting can allow independent deployment and scaling.

When the frontend and API use different hostnames, configure the API's CORS policy for the exact trusted frontend origins. CORS is a browser security mechanism; it is not an authentication or authorization system.

Azure Functions and Serverless .NET

Azure Functions is an event-driven compute service. A function runs when a configured trigger occurs. You can use C# to respond to HTTP requests, timers, queue messages, storage events, and other supported triggers.

Common Triggers

HTTP trigger: Execute a function in response to an HTTP request.
Timer trigger: Run scheduled tasks.
Queue trigger: Process messages from a supported queue.
Blob trigger: React to supported blob changes.
Event-based triggers: Process events from supported Azure services.

Example: Timer-Triggered Function (Isolated Worker Style)

using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.Logging;

public class DailySummaryFunction
{
    private readonly ILogger<DailySummaryFunction> _logger;

    public DailySummaryFunction(
        ILogger<DailySummaryFunction> logger)
    {
        _logger = logger;
    }

    [Function("DailySummary")]
    public void Run(
        [TimerTrigger("0 0 8 * * *")] TimerInfo timer)
    {
        _logger.LogInformation(
            "Daily summary task executed at {Time}",
            DateTimeOffset.UtcNow);
    }
}

This is an illustrative isolated-worker function. The project also needs the appropriate worker packages, Functions SDK, host configuration, and supported runtime configuration.

In-Process vs Isolated Worker

The isolated worker model runs your .NET function code in a separate worker process and gives the application its own startup and dependency-injection setup. The in-process model runs inside the Functions host process.

Current migration guidance: Microsoft documents the end of support for the in-process model on November 10, 2026. For new .NET Functions work and supported migration paths, use the isolated worker model and verify the exact runtime, OS, and hosting-plan compatibility before deployment.

Functions runtime and .NET version compatibility can vary by hosting plan and operating system. Review the official support matrix rather than assuming every .NET version runs on every plan.

Containers, Container Apps and AKS

What Is a Container?

A container packages an application with its runtime dependencies and configuration requirements into an image. Containers help create consistent deployment environments across development, testing, and production.

Dockerfile for an ASP.NET Core API

# Example multi-stage Dockerfile
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

COPY . .
RUN dotnet restore
RUN dotnet publish -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS final
WORKDIR /app
COPY --from=build /app/publish .
EXPOSE 8080

ENTRYPOINT ["dotnet", "EmployeeApi.dll"]

Use a currently supported SDK and runtime image that matches your project target. Pin and update base images through a controlled patching process. The example illustrates the multi-stage build pattern; production images should also use an appropriate non-root user and health strategy where supported.

Azure Container Registry

Azure Container Registry (ACR) is a managed registry for storing and managing container images and related artifacts. Your build pipeline can push an image to ACR, and a container hosting service can pull that image for deployment.

Container Apps vs AKS

Choose Container Apps when you want managed container hosting, revisions, ingress, scaling rules, and less Kubernetes administration.
Choose AKS when you need Kubernetes APIs, custom cluster-level capabilities, ecosystem integrations, and the team can operate Kubernetes responsibly.

Azure SQL Database and Data Services

Azure SQL Database is a managed relational database service based on the SQL Server database engine. It is a PaaS option for applications that need relational tables, SQL queries, transactions, indexes, and familiar SQL Server tooling.

SQL Server vs Azure SQL Database

SQL Server on a VM / On-Premises	Azure SQL Database
You manage the operating system and SQL Server installation.	Microsoft manages the database platform and much of its maintenance.
You plan and operate backups and patching.	Built-in platform backup and maintenance capabilities are provided.
You control the server environment.	You configure a managed database service with supported options.
Useful for full instance-level control and compatibility needs.	Useful for application databases where a managed PaaS service fits.

Common Azure SQL Concepts

Logical server: A management and connectivity endpoint for Azure SQL databases.
Database: The relational database that stores application tables and data.
Compute tier: Determines the compute model and capacity.
Service tier: Determines performance, availability, and feature characteristics.
Firewall/network rules: Control which network sources can connect.
Microsoft Entra authentication: Supports identity-based access, including managed identities for workloads.
Backups and restore: Platform capabilities support recovery within configured retention and service limits.

Connect from ASP.NET Core

For local development, a connection string can be stored in user secrets or a local environment configuration. In production, prefer Microsoft Entra authentication with managed identity where supported, rather than storing a long-lived SQL password.

builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("DefaultConnection")));

The code above shows the EF Core registration pattern. The actual production authentication method depends on the connection configuration and identity permissions assigned to the application.

Other Azure Data Services

Service	Data model / purpose	Use case
Azure SQL Database	Relational SQL database.	Transactional business data.
Azure Cosmos DB	Globally distributed NoSQL database service with multiple APIs and data models.	Applications requiring supported NoSQL patterns and distribution capabilities.
Azure Database for PostgreSQL	Managed PostgreSQL database.	Applications built around PostgreSQL.
Azure Managed Instance	Managed SQL Server instance compatibility option.	Workloads needing more instance-level SQL Server features.

Azure Storage and Blob Storage

Azure Storage provides cloud storage capabilities. A Storage Account is the top-level resource through which you configure supported storage services, access, redundancy, and networking.

Storage Services

Service	Purpose	.NET application example
Blob Storage	Object storage for unstructured data.	Employee documents, images, exports, backups.
Azure Files	Managed file shares.	Shared file access for supported workloads.
Queue Storage	Simple message queue storage.	Basic asynchronous work queues.
Table Storage	NoSQL key-attribute storage.	Simple key-based data scenarios.

Blob Storage Example with .NET

Install the Azure Storage Blobs client library:

dotnet add package Azure.Storage.Blobs

Use Azure Identity for passwordless access where the environment and permissions support it:

using Azure.Identity;
using Azure.Storage.Blobs;

var serviceClient = new BlobServiceClient(
    new Uri("https://<storage-account>.blob.core.windows.net"),
    new DefaultAzureCredential());

var container = serviceClient.GetBlobContainerClient("documents");

await container.CreateIfNotExistsAsync();

var blob = container.GetBlobClient("employee-guide.pdf");

await using var stream = File.OpenRead("employee-guide.pdf");
await blob.UploadAsync(stream, overwrite: true);

Assign the application's managed identity an appropriate data-plane role, such as a suitable Blob Data role, at the narrowest practical scope. Creating a storage account does not automatically grant your application permission to read or write blobs.

Security: Avoid making a document container public just to simplify downloads. Prefer private containers and issue short-lived, narrowly scoped access through an authorized backend flow when appropriate.

Networking: VNet, Subnets, DNS and Private Endpoints

Azure networking connects application components and controls how they communicate with each other, the internet, on-premises systems, and private services.

Virtual Network (VNet)

An Azure Virtual Network is a logically isolated network in Azure. It enables private IP communication between supported resources and provides a foundation for network segmentation and connectivity.

Subnet

A subnet divides a VNet into smaller IP address ranges. Subnets can be used to organize resources and apply network controls.

Network Security Group (NSG)

An NSG contains inbound and outbound security rules that allow or deny network traffic based on supported properties such as source, destination, port, and protocol.

Private Endpoint

A private endpoint provides a network interface with a private IP address in your VNet for supported Azure services. It can help keep service traffic on private network paths, subject to DNS and network configuration.

DNS

DNS resolves hostnames to IP addresses. When using private endpoints, correct private DNS zone configuration is important so applications resolve the service name to the intended private IP address.

Internet Users
      |
      v
Public HTTPS Endpoint
      |
      v
ASP.NET Core App Service
      |
      | Private connectivity (where configured)
      v
Virtual Network
      |
      +---- Private Endpoint ---- Azure SQL
      |
      +---- Private Endpoint ---- Storage Account
      |
      +---- Private Endpoint ---- Key Vault

The exact network integration pattern depends on the App Service plan, service capabilities, DNS, and network design. Private endpoints do not automatically secure every other network path; review public network access settings and access controls too.

Identity and Access Management

Microsoft Entra ID is Microsoft's cloud identity and access management platform. It supports user sign-in, application identities, access tokens, and integration with many Microsoft and third-party applications.

Authentication vs Authorization

Authentication: Determines who or what is making a request.
Authorization: Determines what that identity is allowed to do.

Azure Role-Based Access Control (RBAC)

Azure RBAC controls access to Azure resources. A role assignment combines a security principal, a role definition, and a scope.

Common built-in roles include:

Owner: Broad resource management permissions, including the ability to assign roles.
Contributor: Can manage resources but cannot grant access to others through role assignments.
Reader: Can view resources but cannot make changes.
Service-specific roles: Provide narrower permissions for particular services or data operations.

Least privilege: Grant only the permissions required, at the narrowest scope that supports the task. Avoid assigning Owner or broad Contributor permissions by default.

Control Plane vs Data Plane

Control-plane permissions manage the Azure resource itself, such as creating or configuring a storage account. Data-plane permissions access the content inside the service, such as reading blobs. A role that permits resource management does not necessarily grant the required data access.

Managed Identity and Key Vault

What Is Managed Identity?

Managed identity provides an identity for an Azure resource so that supported workloads can authenticate to other services without storing a client secret or password in application code.

For example, an App Service can use its managed identity to access Azure Key Vault, Azure Storage, or Azure SQL when the target service supports that authentication method and the identity has been granted the required permissions.

System-Assigned vs User-Assigned Identity

System-assigned	User-assigned
Lifecycle is tied to one Azure resource.	Independent Azure resource that can be assigned to multiple supported resources.
Deleted when the associated resource is deleted.	Can remain available when an application resource is replaced.
Simple choice for a single workload identity.	Useful when identity lifecycle must be managed separately or reused.

What Is Azure Key Vault?

Key Vault securely stores and controls access to secrets, cryptographic keys, and certificates. It helps keep sensitive configuration out of source code and ordinary configuration files.

Access Key Vault from .NET

Install the Azure Identity and Key Vault Secrets packages:

dotnet add package Azure.Identity
dotnet add package Azure.Security.KeyVault.Secrets

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

var vaultUri = new Uri(
    "https://<your-vault-name>.vault.azure.net/");

var client = new SecretClient(
    vaultUri,
    new DefaultAzureCredential());

KeyVaultSecret secret =
    await client.GetSecretAsync("ApiServiceKey");

string secretValue = secret.Value;

In Azure, DefaultAzureCredential can use the configured managed identity when available. During local development, it can use supported developer credentials. Configure the appropriate identity and grant it the minimum required Key Vault data access.

Do not: Commit secrets, connection strings, certificates, or access keys to Git. Key Vault is not a replacement for authorization, secret rotation, or careful access policies.

Authentication and Authorization for Web Applications

In a full-stack application, the frontend, API, and Azure resources may each have different identity requirements. Keep user authentication separate from workload-to-workload authentication.

Typical User Sign-In Flow

Angular / React Frontend
        |
        | Sign-in request
        v
Microsoft Entra ID
        |
        | Access token
        v
Frontend calls ASP.NET Core API
        |
        | Token validation
        v
ASP.NET Core Authorization
        |
        v
Protected API endpoint

For workforce applications, Microsoft Entra ID can provide organizational sign-in and single sign-on. For customer-facing applications, evaluate the appropriate external identity solution and current Microsoft identity offerings for the scenario.

Protect an ASP.NET Core API

Use supported Microsoft identity libraries and configure the API to validate the expected issuer, audience, and token requirements. A simplified authorization example is:

[Authorize]
[ApiController]
[Route("api/[controller]")]
public class EmployeesController : ControllerBase
{
    [HttpGet]
    public IActionResult GetEmployees()
    {
        return Ok(new[]
        {
            new { Id = 1, Name = "Alex" }
        });
    }

    [Authorize(Roles = "HR")]
    [HttpGet("salary")]
    public IActionResult GetSalaryDetails()
    {
        return Ok("Restricted salary information");
    }
}

This example illustrates endpoint authorization attributes, not a complete Entra configuration. The application must also register authentication, validate tokens, map claims or roles correctly, and define the intended authorization policy.

Remember: A frontend route guard improves user experience, but it does not secure backend data. Enforce authorization on the API and, where relevant, at the data or service boundary.

Messaging and Background Processing

Not every operation should run inside the original HTTP request. Tasks such as sending notifications, generating reports, processing uploaded files, and synchronizing data can be moved to background workers.

Azure Service Bus

Azure Service Bus is a managed enterprise message broker that provides queues and publish-subscribe topics. It helps decouple producers and consumers so they do not need to execute at the same time.

Queue vs Topic

Queue	Topic and subscriptions
One message is typically processed by one competing consumer.	A published message can be delivered to multiple subscriptions.
Useful for work distribution.	Useful for publish-subscribe communication.
Example: process an uploaded document.	Example: notify billing, audit, and reporting services of an event.

Example Workflow

ASP.NET Core API
      |
      | Send message
      v
Azure Service Bus Queue
      |
      | Receive message
      v
.NET Worker / Azure Function
      |
      +---- Generate report
      +---- Store output in Blob Storage
      +---- Update database status

Design consumers to handle retries and duplicate delivery safely. Message brokers generally require careful settlement, idempotency, dead-letter handling, and observability; do not assume a message is processed exactly once by default.

Azure Monitor and Application Insights

After deployment, developers need to understand application health and behavior. Azure Monitor is the monitoring platform for collecting and analyzing metrics, logs, and traces from Azure resources and applications.

Application Insights

Application Insights provides application performance monitoring capabilities, including request rates, response times, failures, dependencies, distributed tracing, and application maps.

What Should You Monitor?

HTTP request count, duration, and failure rate.
Unhandled exceptions and dependency failures.
Database query performance and connection issues.
CPU, memory, and resource utilization where available.
Queue depth and message processing failures.
Availability tests and service health signals.
Deployment changes and application version information.

OpenTelemetry in ASP.NET Core

OpenTelemetry is an open standard for collecting traces, metrics, and logs. Azure Monitor supports OpenTelemetry-based instrumentation for supported application stacks.

dotnet add package Azure.Monitor.OpenTelemetry.AspNetCore

using Azure.Monitor.OpenTelemetry.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddOpenTelemetry()
    .UseAzureMonitor();

var app = builder.Build();

app.MapGet("/", () => "API is running");

app.Run();

Configure the Application Insights connection string through a secure application setting or environment variable in production. Follow the current Microsoft guidance for the OpenTelemetry package and migration path; do not initialize multiple competing instrumentation distributions in the same application.

CI/CD with GitHub Actions and Azure DevOps

CI/CD automates the process of building, testing, packaging, and deploying application changes. It reduces manual deployment steps and helps teams release consistently.

Continuous Integration (CI)

CI typically restores dependencies, builds the code, runs automated tests, and produces a deployable artifact whenever code is pushed or a pull request is updated.

Continuous Delivery / Deployment (CD)

CD promotes validated artifacts through environments such as development, staging, and production. Production deployment can require approvals and additional checks.

Typical .NET Pipeline

Developer Pushes Code
        |
        v
Source Repository
        |
        v
Restore Dependencies
        |
        v
Build Solution
        |
        v
Run Unit Tests
        |
        v
Publish Artifact
        |
        v
Deploy to Staging
        |
        v
Smoke Tests / Approval
        |
        v
Deploy to Production

Example GitHub Actions Workflow

This simplified example builds and tests a .NET solution. Deployment requires a separately configured Azure authentication method, environment, and deployment action.

name: Build and Test

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Test
        run: dotnet test --configuration Release --no-build

For production, prefer federated identity credentials / OpenID Connect where supported rather than storing long-lived Azure client secrets in repository variables. Pin third-party actions according to your organization's supply-chain policy and protect production environments with approvals.

Deploy an ASP.NET Core Web API

This section brings the concepts together. We will outline a standard deployment of an ASP.NET Core Web API to Azure App Service.

Prerequisites

A supported .NET SDK installed locally.
An ASP.NET Core Web API project.
An Azure subscription with permission to create the required resources.
An App Service plan and Web App configured for a supported runtime.
A deployment method such as Visual Studio, Azure CLI, GitHub Actions, or Azure DevOps.

Step 1: Create the API

dotnet new webapi -n EmployeeApi
cd EmployeeApi

Step 2: Run Locally

dotnet run

Test the API using its local HTTPS URL and the endpoints defined by the project.

Step 3: Publish

dotnet publish -c Release -o ./publish

Step 4: Create Azure Resources

In the Azure Portal, create an App Service Plan and a Web App. Select the region, operating system, runtime stack or container option, and pricing tier that match the application's requirements.

Step 5: Configure Application Settings

Set environment-specific values such as database connection configuration, external service endpoints, and telemetry settings. Keep secrets out of source control and use managed identity with Key Vault or supported target services when possible.

Step 6: Deploy

Deploy the published application using your chosen deployment workflow. After deployment, open the App Service URL and test the health endpoint and API operations.

Step 7: Verify

Confirm the application starts successfully.
Check application logs and Application Insights telemetry.
Verify database connectivity and permissions.
Test authentication, authorization, and CORS where applicable.
Check the deployed runtime and configuration.

Deploy an Angular and .NET Full Stack Application

A common full-stack architecture separates frontend hosting, API hosting, and database hosting. This allows each layer to be deployed and scaled according to its own requirements.

Reference Architecture

Users
  |
  v
Angular Frontend
Azure Static Web Apps
  |
  | HTTPS API calls
  v
ASP.NET Core Web API
Azure App Service
  |
  +------ Azure SQL Database
  |
  +------ Azure Blob Storage
  |
  +------ Azure Key Vault
  |
  +------ Microsoft Entra ID
  |
  +------ Application Insights
             |
             v
         Azure Monitor

Responsibilities of Each Layer

Layer	Azure service	Responsibility
Frontend	Static Web Apps	Serve Angular build files to users.
Backend	App Service	Run ASP.NET Core endpoints and business logic.
Database	Azure SQL Database	Store relational application data.
File storage	Blob Storage	Store uploaded documents and generated files.
Secrets	Key Vault	Protect secrets, keys, and certificates.
Identity	Microsoft Entra ID	Manage user and workload identity integration.
Monitoring	Azure Monitor / Application Insights	Observe application and platform health.

Important Deployment Considerations

Configure the production API base URL in the Angular build or runtime configuration strategy.
Configure CORS on the API for the exact frontend origin when cross-origin browser requests are used.
Use HTTPS and configure custom domains and certificates as required.
Protect API endpoints with authentication and authorization.
Use private networking for data services when the security requirements call for it.
Configure database backups, monitoring, and recovery objectives.
Use separate resources or clearly isolated configurations for development, testing, and production.

Environment Configuration and Deployment Slots

Development, Staging and Production

Applications usually need different configuration values for each environment. Keep configuration separate from code so the same tested build can be promoted through environments.

Environment	Purpose	Typical controls
Development	Daily development and integration.	Test data, limited access, lower-cost resources.
Staging / QA	Pre-production validation.	Production-like configuration and test approval.
Production	Live application traffic.	Restricted access, monitoring, backups, resilience and change controls.

ASP.NET Core Environment

ASP.NET Core uses environment settings such as Development, Staging, and Production. The environment name controls which environment-specific configuration and startup behavior is used.

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseExceptionHandler("/error");
    app.UseHsts();
}

Do not expose developer exception pages in production. Use secure configuration sources for secrets and review the exact configuration precedence used by the application.

Deployment Slots

Deployment slots are separate live app environments available on supported App Service plans. A typical workflow deploys a new version to a staging slot, validates it, and then swaps it with production. Slot-specific settings and warm-up behavior should be configured deliberately.

Scaling, Availability and Disaster Recovery

Vertical Scaling

Vertical scaling increases the capacity of an existing instance or plan, such as selecting a larger App Service plan tier.

Horizontal Scaling

Horizontal scaling increases the number of application instances. It can help distribute traffic and improve capacity, provided the application and its dependencies are designed for multiple instances.

High Availability

High availability aims to keep an application accessible despite component failures. Depending on the requirements, this can include multiple instances, zone redundancy, health checks, resilient dependencies, and regional architecture.

Backup vs Disaster Recovery

Backup: A recoverable copy of data or configuration.
Disaster recovery: A plan and architecture for restoring service after a major outage or regional failure.
RPO: Recovery Point Objective — the maximum acceptable data loss measured in time.
RTO: Recovery Time Objective — the target time to restore service.

Example Resilience Considerations

Component	Considerations
App Service	Multiple instances, health checks, deployment slots, supported zone redundancy.
Azure SQL	Backup retention, point-in-time restore, high availability, geo-recovery options.
Blob Storage	Redundancy choice, soft delete, versioning, lifecycle policies where appropriate.
Messaging	Retry policy, dead-letter queue, idempotent consumers, duplicate handling.
Regional recovery	Documented failover process, tested recovery plan, DNS and dependency readiness.

Important: A backup is not a complete disaster-recovery plan. Define business recovery objectives, understand service-specific recovery capabilities, and test restoration and failover procedures.

Azure Security Best Practices

Cloud security is a shared responsibility. Azure secures the underlying cloud infrastructure, while customers remain responsible for their identities, application code, data, configuration, and the security controls they choose.

Identity and Access

Use Microsoft Entra ID for supported identity scenarios.
Apply least-privilege RBAC.
Prefer managed identities for application-to-Azure authentication.
Use multifactor authentication and privileged access controls for administrative identities.
Review role assignments regularly and remove unused permissions.

Application and Data Security

Enforce HTTPS and modern TLS configurations.
Store secrets in Key Vault or another approved secret-management system.
Use parameterized SQL queries and safe data-access practices.
Validate input and enforce authorization on the server.
Encrypt data in transit and at rest using supported service capabilities.
Restrict public network access when private connectivity is required.
Keep dependencies, runtime images, and application frameworks patched.

Governance and Monitoring

Use Azure Policy to audit or enforce required configurations.
Enable relevant diagnostic settings and security monitoring.
Use resource locks carefully for critical resources.
Tag resources and identify owners.
Review security recommendations and test incident-response procedures.

Azure Pricing and Cost Management

Azure pricing depends on the service, region, selected tier, capacity, usage, storage, network transfer, and optional features. There is no single fixed monthly price for an application simply because it uses App Service or Azure SQL.

Common Cost Factors

Compute plan size and number of running instances.
Database compute tier, storage, backup retention, and redundancy.
Blob storage capacity, operations, and redundancy.
Outbound data transfer and network architecture.
Monitoring ingestion and retention.
Premium security, networking, or availability features.

Cost Management Practices

Use the Azure Pricing Calculator before deployment.
Set budgets and cost alerts for subscriptions.
Apply tags for application, environment, and cost center.
Stop or scale down non-production resources when they are not needed.
Review unused disks, IP addresses, snapshots, and other unattached resources.
Choose service tiers based on measured requirements, not assumptions.
Monitor actual usage after go-live and adjust capacity.

Pricing calculator: Azure Pricing Calculator

Cost reminder: Free tiers and trial credits have eligibility, usage, and time limits. Always review the current pricing page and service limits for your subscription and region before estimating production cost.

Infrastructure as Code

Infrastructure as Code (IaC) defines infrastructure using files that can be version-controlled, reviewed, tested, and deployed. It reduces manual portal configuration and makes environments more repeatable.

Azure IaC Options

Tool	Description
ARM templates	Azure Resource Manager deployment templates using JSON.
Bicep	Declarative language that simplifies authoring Azure resource deployments.
Terraform	Infrastructure provisioning tool that supports Azure and other providers.
Azure CLI / PowerShell	Useful for scripting resource operations and automation.

Example Bicep Resource

param location string = resourceGroup().location
param appName string

resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = {
  name: '${appName}-plan'
  location: location
  sku: {
    name: 'B1'
    tier: 'Basic'
  }
  properties: {
    reserved: true
  }
}

This snippet illustrates the declarative resource pattern. Before using an API version or SKU in production, verify that it is supported in the target region and meets the application's runtime, scaling, networking, and availability requirements.

IaC should be reviewed like application code. Use parameter files or secure pipeline variables for environment-specific values, and never put secrets directly into templates or source control.

Azure Architecture for .NET Developers

Choosing Azure services is an architecture decision, not just a deployment task. A good design starts with requirements such as expected traffic, data sensitivity, availability targets, team skills, integration needs, and budget.

Simple Three-Tier Architecture

Presentation Layer
Angular / React / MVC
        |
        v
Application Layer
ASP.NET Core Web API
        |
        v
Data Layer
Azure SQL Database

Expanded Production-Oriented Architecture

Users
  |
  v
Frontend Hosting
Azure Static Web Apps
  |
  v
ASP.NET Core API
Azure App Service
  |
  +---- Microsoft Entra ID (user identity)
  |
  +---- Managed Identity
  |         |
  |         +---- Azure Key Vault
  |         +---- Azure SQL Database
  |         +---- Azure Blob Storage
  |
  +---- Azure Service Bus
  |         |
  |         +---- .NET Worker / Azure Functions
  |
  +---- Azure Monitor / Application Insights

How to Choose the Right Service

Need to host a conventional ASP.NET Core API? Evaluate App Service first.
Need to host static Angular assets? Evaluate Static Web Apps or another static hosting option.
Need scheduled or event-triggered code? Evaluate Azure Functions.
Need a managed relational database? Evaluate Azure SQL Database.
Need object storage for documents? Evaluate Blob Storage.
Need secure workload access to Azure services? Evaluate managed identity.
Need to decouple processing? Evaluate Service Bus with a worker or Function.
Need to run containerized services without managing Kubernetes? Evaluate Container Apps.
Need Kubernetes APIs and cluster-level control? Evaluate AKS.
Need operating-system control? Evaluate Virtual Machines.

Well-Architected Thinking

Use the Azure Well-Architected Framework to review the design across five pillars:

Pillar	Developer / architect question
Reliability	Can the application recover from failures and meet its availability objectives?
Security	Are identities, data, network paths, and application endpoints protected?
Cost Optimization	Are resources sized and used efficiently?
Operational Excellence	Can the team deploy, monitor, diagnose, and operate the application effectively?
Performance Efficiency	Can the system handle workload changes without unnecessary waste?

Practical Projects and Learning Roadmap

The best way to learn Azure is to deploy real applications in small steps. Start with a simple service, understand its configuration, and then add security, data, monitoring, and automation.

Project 1: Deploy an ASP.NET Core Web API

Create a Web API locally.
Publish it to Azure App Service.
Configure application settings.
Enable HTTPS and test the endpoints.
Review logs and application health.

Project 2: Full-Stack Employee Management Application

Build an Angular frontend.
Create an ASP.NET Core Web API.
Use Azure SQL Database for relational data.
Host frontend and backend using suitable Azure services.
Configure CORS, authentication, and authorization.
Monitor requests and failures using Application Insights.

Project 3: Secure Document Upload

Build a file upload endpoint in ASP.NET Core.
Store documents in a private Blob Storage container.
Use managed identity for backend access.
Apply appropriate data-plane permissions.
Return authorized download links or stream files through a protected API.

Project 4: Background Processing

Accept a long-running task through an API.
Publish a message to Azure Service Bus.
Process it with a .NET worker or Azure Function.
Persist status in Azure SQL.
Handle retries and dead-letter messages.

Project 5: Automated Deployment

Store the source code in GitHub or Azure Repos.
Create a build and test pipeline.
Deploy to a staging environment.
Run smoke tests and require approval for production.
Use secure workload identity for Azure deployment authentication.

Suggested Learning Sequence

Cloud computing and Azure fundamentals.
Portal, subscriptions, resource groups, and regions.
IaaS, PaaS, SaaS, and compute selection.
App Service and Web API deployment.
Azure SQL Database and Storage.
Networking and private connectivity.
Microsoft Entra ID, RBAC, managed identity, and Key Vault.
Functions, messaging, and containers.
Monitoring, CI/CD, scaling, and cost management.
Architecture, IaC, security, and disaster recovery.

Important Azure Interview Questions

1. What is Microsoft Azure?

Microsoft Azure is a cloud computing platform that provides infrastructure, platform, and software services for building, deploying, and managing applications.

2. What is the difference between IaaS and PaaS?

IaaS provides infrastructure such as virtual machines and networking, while PaaS provides a managed application platform so developers can deploy code without managing the underlying server operating system.

3. What is an Azure Resource Group?

A resource group is a logical container for Azure resources that are managed together.

4. What is an Azure Region?

An Azure region is a geographic area containing one or more data centers connected through a dedicated regional network.

5. What is an Availability Zone?

An Availability Zone is a physically separate location within a region with independent infrastructure, used by supported services to improve resilience.

6. What is Azure App Service?

Azure App Service is a managed hosting platform for web applications and APIs.

7. What is an App Service Plan?

An App Service Plan defines the compute resources, pricing tier, and supported capabilities used by App Service apps.

8. What is Azure Functions?

Azure Functions is an event-driven compute service that executes code in response to triggers such as HTTP requests, timers, and messages.

9. What is Azure SQL Database?

Azure SQL Database is a managed relational database service based on the SQL Server database engine.

10. What is Azure Blob Storage?

Blob Storage is an object storage service for unstructured data such as documents, images, backups, and media.

11. What is Managed Identity?

Managed identity provides an identity to an Azure resource so it can authenticate to supported services without storing credentials in application code.

12. What is Azure Key Vault?

Key Vault securely manages secrets, keys, and certificates.

13. What is Azure RBAC?

Azure role-based access control assigns permissions to identities at defined scopes through role assignments.

14. What is Azure Monitor?

Azure Monitor collects and analyzes monitoring data such as metrics, logs, and traces from Azure resources and applications.

15. What is CI/CD?

CI/CD automates building, testing, and deploying application changes through controlled workflows.

16. What is the difference between Azure Container Apps and AKS?

Container Apps provides managed container hosting without requiring direct Kubernetes cluster management, while AKS provides managed Kubernetes with access to Kubernetes APIs and cluster-level capabilities.

17. What is a Private Endpoint?

A private endpoint provides a private IP address in a virtual network for supported Azure services.

18. What is the shared responsibility model?

It describes how security and operational responsibilities are divided between the cloud provider and customer. The division changes depending on whether the service is IaaS, PaaS, or SaaS.

Official Learning Resources

Use Microsoft's official documentation for current service capabilities, supported runtimes, regional availability, pricing, and configuration instructions.

What’s Next?

You now have a foundation for understanding Microsoft Azure from a .NET full stack development perspective. The next step is practical implementation: deploy an ASP.NET Core Web API, connect it securely to Azure SQL Database, host a frontend, configure managed identity, and automate deployment.

Learn each service by building with it, monitoring it, and understanding its operational and security responsibilities. Azure architecture becomes much clearer when you connect each cloud service to a real application requirement.

Programming

Microsoft Azure: Complete Cloud Learning Guide for .NET Developers