Agenda

Azure Application Hosting

App Service, Functions, ACI, ACA, AKS

Azure Key Vault

Secrets, Keys, Certificates

Azure Databases

Azure SQL & Cosmos DB

Azure Application Hosting

App Service • Functions • Container Platforms

Cloud Application Hosting Continuum

IaaS
Infrastructure Platform

CaaS
Container Platform

PaaS
Application Platform

FaaS
Serverless Platform

Azure App Service

Fully managed platform for web applications (PaaS)

• HTTP-based hosting for web apps, REST APIs, and mobile backends
• Supports .NET, Java, Node.js, Python, PHP, Ruby, and containers
• Built-in autoscale, CI/CD, deployment slots, and custom domains
• Runs on Windows or Linux App Service Plans
• Enterprise-grade SLA — up to 99.95%

App Service Key Features

Deployment Slots

Auto Scale

Custom Domains & TLS

VNet Integration

Deployment Slots

Zero-downtime releases with staging environments

• Each slot is a live app with its own hostname and config
• Swap traffic between slots instantly — no cold start
• Slot-specific app settings (e.g., staging DB connection string)
• Auto-swap — deploy to staging, auto-promote to production
• Available from Standard tier and above (up to 20 slots)

Auto Scale

Automatically adjust capacity to match demand

• Scale out (add instances) or in (remove instances) automatically
• Rules based on CPU %, memory %, HTTP queue length, or custom metrics
• Schedule-based scaling — e.g., more instances during business hours
• Cooldown periods prevent flapping (default 5 min)
• Available from Standard tier — Premium v3 supports up to 30 instances

Custom Domains & TLS

Production-ready web hosting with your brand

• Map custom domains via CNAME or A records
• Free managed certificates — auto-renewed, zero config (Standard+)
• Bring your own certificate or import from Key Vault
• Enforce HTTPS-only and minimum TLS version (1.2 recommended)
• SNI SSL included at no extra cost; IP SSL for legacy clients

App Service Networking

VNet Integration

Source: Microsoft Learn — App Service networking features

App Service Plans

Compute resources that power your apps

• Apps run on an App Service Plan — a set of VMs
• Multiple apps can share the same plan to optimize cost
• Plan tier determines features, scale limits, and SLA
• Scale up (bigger VM) or out (more instances)

App Service Plan Tiers

App Service Best Practices

• Use deployment slots for zero-downtime releases
• Enable health checks to auto-replace unhealthy instances
• Use managed identities — avoid storing credentials
• Enable diagnostic logging and integrate with App Insights
• Configure autoscale rules based on CPU, memory, or HTTP queue

Azure Functions

Serverless compute — event-driven code at scale

What is Serverless?

Azure Functions Overview

• Write small, focused functions triggered by events
• Supports C#, JavaScript, F#, Java, and Python (Go, Rust, others via custom handlers)
• Triggers start execution — Bindings connect to services
• Stateless by default; Durable Functions for workflows
• Multiple hosting options with different scale & pricing models

Functions Programming Model

React to timers, HTTP, or events from your favorite Azure services

Triggers / Inputs

→

Author in C#, F#, Node.js, Java, Python, PowerShell & more

Code

Send results to an ever-growing collection of services

Outputs

Function Code

Function Code

Functions Hosting Plans

Functions Best Practices

• Keep functions small and focused — single responsibility
• Use bindings over manual SDK calls where possible
• Handle idempotency — functions may retry on failure
• Use managed identities for service authentication
• Monitor with Application Insights integration

When to Use Functions vs App Service

Container Platforms

ACI • Azure Container Apps • AKS • AKS Automatic

Why Containers?

Portable

Consistent

Lightweight

Microservices

Azure Container Instances (ACI)

Simplest way to run a container in Azure

• Run containers on demand without managing infrastructure
• Per-second billing — pay only while the container runs
• Supports Linux and Windows containers
• Container groups for multi-container (sidecar) patterns
• VNet deployment for private networking

Azure Container Apps (ACA)

Serverless containers built on Kubernetes

• Fully managed serverless container platform
• Built on Kubernetes + Envoy + KEDA + Dapr
• Scale to zero — event-driven auto-scaling
• Built-in service discovery, ingress, and traffic splitting
• No Kubernetes expertise required

Container Apps Features

KEDA Auto-scaling

Traffic Splitting

Dapr Integration

Managed Identity & VNet

Azure Kubernetes Service (AKS)

Managed Kubernetes for full control

• Fully managed Kubernetes control plane — free
• You manage worker node pools, networking, and configuration
• Full Kubernetes API — any workload, any tooling
• Advanced networking: Azure CNI, Cilium, service mesh support
• Integrates with ACR, Azure AD, Monitor, Key Vault, Policy

AKS Architecture

Source: Microsoft Learn — AKS cluster architecture

AKS Automatic

AKS with opinionated, production-ready defaults

• Preconfigured with Microsoft's best practice settings
• Node auto-provisioning — automatic VM sizing and scaling
• Built-in monitoring, network policies, and pod sandboxing
• Automated upgrades and patching
• Reduces operational overhead while retaining Kubernetes API

AKS vs AKS Automatic

Container Platform Comparison

When to Use Which Container Service

Azure Compute Decision Guide

Azure Architecture Center — Choose an Azure compute service

Compute Services Summary

Azure Key Vault

Centralized secrets, keys, and certificate management

What is Azure Key Vault?

• Cloud service for securely storing and accessing secrets
• Centralized management of keys, secrets, and certificates
• FIPS 140-2 validated — HSM-backed in Premium tier
• Integrated with Azure RBAC and Azure AD authentication
• Full audit logging via Azure Monitor / Log Analytics

Key Vault Object Types

Keys

RSA & EC keys for encrypt, sign, wrap

Secrets

Connection strings, passwords, API keys

Certificates

TLS/SSL certs with auto-renewal

Key Vault Tiers

Access Control Models

Key Vault Networking

• Public endpoint — accessible over internet with firewall rules
• Service endpoints — restrict to specific VNet subnets
• Private endpoints — fully private via Azure Private Link
• Trusted services bypass — allow Azure services access
• Recommendation: use Private Endpoints for production

Key Vault Best Practices

• Use managed identities to access Key Vault — no secrets in code
• Enable soft delete and purge protection (on by default)
• Use separate vaults per environment (dev, staging, prod)
• Set expiration dates on secrets and rotate regularly
• Enable diagnostic logging for audit and compliance

Key Vault Integration Patterns

App Service / Functions References

AKS CSI Secret Store Driver

Disk & Storage Encryption (CMK)

Azure DevOps Variable Groups

Azure Databases

Azure SQL • Azure Cosmos DB

SQL vs NoSQL Databases

Azure SQL — The Family

Fully managed relational database service

• Built on the SQL Server engine — full T-SQL compatibility
• Intelligent performance tuning and threat detection
• Built-in high availability — up to 99.995% SLA
• Three deployment models for different scenarios

Azure SQL Deployment Options

SQL Database

Single or elastic pool — fully managed

SQL Managed Instance

Near 100% SQL Server compatibility

SQL Server on Azure VMs

Full OS & engine control

Deployment Options Comparison

Purchasing Models

Azure SQL Service Tiers

Azure SQL — Serverless Compute

Auto-pause and auto-scale for variable workloads

• Available in General Purpose tier (vCore model)
• Auto-scales vCores based on workload demand
• Auto-pause after inactivity — pay only for storage
• Auto-resumes on first connection (~1 min cold start)
• Great for dev/test and intermittent workloads

Azure SQL Security

TDE & Always Encrypted

Advanced Threat Protection

Dynamic Data Masking

Auditing & Compliance

Azure SQL Best Practices

• Use Azure AD authentication over SQL authentication
• Enable auto-failover groups for geo-redundancy
• Configure long-term backup retention (up to 10 years)
• Use elastic pools for multi-tenant SaaS with variable per-tenant load
• Monitor with Intelligent Insights and Query Performance Insight

Azure Cosmos DB

Globally distributed, multi-model database service

What is Azure Cosmos DB?

• Globally distributed NoSQL and relational database service
• Single-digit millisecond reads and writes at any scale
• Turnkey global distribution — replicate data to any Azure region
• Five consistency levels — tune availability vs. consistency
• 99.999% SLA for multi-region configurations

Cosmos DB APIs

NoSQL

JSON docs — native, recommended

MongoDB

Wire-compatible with MongoDB

PostgreSQL

Distributed PostgreSQL (Citus)

Gremlin

Graph database queries

Table

Key-value — Table Storage upgrade

Apache Cassandra

CQL-compatible column-family

Consistency Levels

Strong → Bounded Staleness → Session → Consistent Prefix → Eventual

Consistency Levels Compared

Request Units (RUs)

The currency of Cosmos DB throughput

• 1 RU = cost of a 1 KB point read by ID and partition key
• Writes cost ~5-6x more RUs than reads
• Cross-partition queries cost more than single-partition
• Provision RU/s per container or per database (shared)
• Over-consumption returns HTTP 429 — rate limiting

Partitioning Strategy

• Partition key determines data distribution across physical partitions
• Choose a key with high cardinality and even distribution
• Good keys: userId, tenantId, deviceId
• Avoid: status, country, category (low cardinality → hot partitions)
• Hierarchical partition keys for multi-level distribution

Cosmos DB Capacity Modes

Cosmos DB Best Practices

• Model data to minimize cross-partition queries
• Prefer embedding over referencing when data is read together
• Use point reads (by ID + partition key) — cheapest at 1 RU
• Reuse the CosmosClient instance — singleton pattern
• Handle 429 throttling with SDK retry logic

SQL vs Cosmos DB

When to use which database service

SQL vs Cosmos DB Overview

Feature Comparison

When to Use Which Database

Key Takeaways

• App Service — start here for web apps & APIs
• Functions — event-driven, pay-per-execution serverless
• Container Apps — the sweet spot for containerized workloads
• Key Vault — every production app needs centralized secret management
• Azure SQL & Cosmos DB — complementary, not competing

Resources

Azure Architecture Center

aka.ms/architecture

Azure Pricing Calculator

azure.microsoft.com/pricing/calculator

Microsoft Learn

learn.microsoft.com

Well-Architected Framework

aka.ms/waf

Hands-On Lab

Create & configure App Services, Container Apps, Key Vault & CosmosDB

Questions?

Thank you!