Azure Patterns

Design and implement Azure cloud architectures following Microsoft's Well-Architected Framework and best practices for service selection, cost optimization, and security.

When to Use

Use this skill when:

• •Designing new applications for Azure cloud
• •Selecting Azure compute services (Container Apps, AKS, Functions, App Service)
• •Architecting storage solutions (Blob Storage, Files, Cosmos DB)
• •Integrating Azure OpenAI or Cognitive Services
• •Implementing messaging patterns (Service Bus, Event Grid, Event Hubs)
• •Designing secure networks with Private Endpoints
• •Applying Azure governance and compliance policies
• •Optimizing Azure costs and performance

Core Concepts

Service Selection Philosophy

Azure offers 200+ services. Choose based on:

1. •Managed vs. IaaS - Prefer fully managed services (lower operational burden)
2. •Cost Model - Consumption vs. dedicated capacity
3. •Integration Requirements - Microsoft 365, Active Directory, hybrid cloud
4. •Control vs. Simplicity - More control = more operational overhead

Azure Well-Architected Framework (Five Pillars)

Reference references/well-architected.md for detailed pillar implementation patterns.

Compute Service Selection

Decision Framework

Container-based workload?
  YES → Need Kubernetes control plane?
          YES → Azure Kubernetes Service (AKS)
          NO → Azure Container Apps (recommended)
  NO → Event-driven function?
         YES → Azure Functions
         NO → Web application?
                YES → Azure App Service
                NO → Legacy/specialized → Virtual Machines

Service Comparison

Recommendation: Start with Azure Container Apps for 80% of containerized workloads (simpler and cheaper than AKS).

Reference references/compute-services.md for detailed comparison with Bicep and Terraform examples.

Storage Architecture

Blob Storage Tier Selection

Pattern: Use lifecycle management policies to automatically move data to lower-cost tiers.

Storage Service Decision

File system interface required?
  YES → Protocol?
          SMB → Azure Files (or NetApp Files for high performance)
          NFS → Azure Files (NFS 4.1)
  NO → Object storage → Blob Storage
       Block storage → Managed Disks (Standard/Premium SSD/Ultra)
       Analytics → Data Lake Storage Gen2

Reference references/storage-patterns.md for lifecycle policies, redundancy options, and performance tuning.

Database Service Selection

Decision Framework

Relational data?
  YES → SQL Server compatible?
          YES → Need VM-level access?
                  YES → SQL Managed Instance
                  NO → Azure SQL Database
          NO → Open source?
                 PostgreSQL → PostgreSQL Flexible Server
                 MySQL → MySQL Flexible Server
  NO → Data model?
         Document/JSON → Cosmos DB (NoSQL API)
         Graph → Cosmos DB (Gremlin API)
         Wide-column → Cosmos DB (Cassandra API)
         Key-value cache → Azure Cache for Redis
         Time-series → Azure Data Explorer

Cosmos DB Consistency Levels

Reference references/database-selection.md for capacity planning, indexing strategies, and migration patterns.

AI and Machine Learning Integration

Azure OpenAI Service

Use Cases:

• •Chatbots and conversational AI (GPT-4)
• •Content generation and summarization
• •Semantic search with embeddings (RAG pattern)
• •Code generation and completion
• •Function calling for structured outputs

Key Advantages:

• •Enterprise data privacy (no model training on customer data)
• •Regional deployment for data residency
• •Microsoft enterprise SLAs
• •Built-in content filtering

Integration Pattern:

from openai import AzureOpenAI
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = AzureOpenAI(
    azure_endpoint="https://myopenai.openai.azure.com",
    azure_ad_token_provider=token_provider,
    api_version="2024-02-15-preview"
)

response = client.chat.completions.create(
    model="gpt-4-turbo",
    messages=[{"role": "user", "content": "Hello!"}]
)

Other AI Services

Reference references/ai-integration.md for RAG architecture, function calling, and fine-tuning patterns.

Messaging and Integration

Service Selection Matrix

When to Use What:

• •Service Bus: Reliable messaging with transactions (e.g., order processing)
• •Event Grid: React to Azure resource events (e.g., blob created, VM stopped)
• •Event Hubs: High-throughput streaming (e.g., IoT telemetry, application logs)

Reference references/messaging-patterns.md for implementation examples, retry policies, and dead-letter handling.

Networking Architecture

Private Endpoints vs. Service Endpoints

Best Practice: Use Private Endpoints for all PaaS services in production (treat public endpoints as anti-pattern).

Hub-and-Spoke Topology

Components:

• •Hub VNet: Shared services (Azure Firewall, VPN Gateway, Private Endpoints)
• •Spoke VNets: Application workloads (isolated per environment or team)
• •VNet Peering: Low-latency connectivity between hub and spokes

Benefits:

• •Centralized security (firewall, DNS)
• •Cost optimization (shared egress)
• •Simplified governance

Reference references/networking-architecture.md for hub-spoke Bicep templates, NSG patterns, and DNS configuration.

Identity and Access Management

Managed Identity Pattern

Always use Managed Identity instead of:

• •Connection strings in code
• •Storage account keys
• •Service principal credentials
• •API keys

System-Assigned vs. User-Assigned:

Example Flow:

1. •Enable Managed Identity on Container App
2. •Grant identity access to Key Vault (RBAC or Access Policy)
3. •Application authenticates automatically (no credentials)

from azure.identity import DefaultAzureCredential

# Works automatically with Managed Identity
credential = DefaultAzureCredential()
keyvault_client = SecretClient(vault_url="...", credential=credential)

Azure RBAC Best Practices

• •Use built-in roles when possible (Owner, Contributor, Reader)
• •Apply least privilege principle
• •Assign roles at resource group level (not subscription)
• •Use Azure AD groups for user management
• •Audit role assignments regularly

Reference references/identity-access.md for Entra ID integration, Conditional Access policies, and B2C patterns.

Governance and Compliance

Azure Policy for Guardrails

Common Policy Patterns:

• •Require tags on all resources (Environment, Owner, CostCenter)
• •Restrict allowed Azure regions
• •Enforce TLS 1.2 minimum
• •Require Private Endpoints for storage accounts
• •Deny public IP addresses on VMs

Policy Effects:

• •Deny: Block non-compliant resource creation
• •Audit: Log non-compliance but allow creation
• •DeployIfNotExists: Auto-remediate missing configurations
• •Modify: Change resource properties during deployment

Cost Management

Optimization Strategies:

Monitoring:

• •Set budgets and alerts in Azure Cost Management
• •Review Azure Advisor cost recommendations weekly
• •Tag resources for cost allocation
• •Use FinOps Toolkit for Power BI dashboards

Reference references/governance-compliance.md for Azure Landing Zones, Policy definitions, and Blueprints.

Infrastructure as Code

Tool Selection

Recommendation:

• •Use Bicep for Azure-only infrastructure (best Azure integration, native type safety)
• •Use Terraform for multi-cloud or existing Terraform shops
• •Use Azure CLI for quick scripts and CI/CD automation

Bicep Best Practices

• •Use parameter files for environment-specific values
• •Leverage Azure Verified Modules (AVM) for tested patterns
• •Organize by resource lifecycle (networking, data, compute)
• •Use symbolic names (not string interpolation)
• •Enable linting and validation in CI/CD

Reference Bicep and Terraform examples in examples/bicep/ and examples/terraform/ directories.

Security Best Practices

Essential Security Controls

Defense-in-Depth Layers

1. •Network: Private Endpoints, NSGs, Azure Firewall
2. •Identity: Entra ID, Managed Identity, Conditional Access
3. •Application: Web Application Firewall, API Management
4. •Data: Encryption at rest, encryption in transit (TLS 1.2+)
5. •Monitoring: Microsoft Defender, Azure Monitor, Sentinel

Reference references/security-architecture.md (see also security-hardening and auth-security skills).

Cost Estimation

Pricing Considerations

Compute:

• •Container Apps: ~$60/month (1 vCPU, 2GB RAM, 24/7)
• •AKS: ~$400/month (3-node D4s_v5 cluster)
• •App Service P1v3: ~$145/month (2 vCPU, 8GB RAM)
• •Functions Consumption: ~$0.20 per 1M executions

Storage:

• •Blob Hot: $0.018/GB/month
• •Blob Cool: $0.010/GB/month
• •Blob Archive: $0.00099/GB/month
• •Managed Disks Premium SSD: $0.15/GB/month

Database:

• •Azure SQL Database (2 vCores): ~$280/month
• •Cosmos DB Serverless: Pay per RU consumed
• •PostgreSQL Flexible (2 vCores): ~$125/month

Use Azure Pricing Calculator: https://azure.microsoft.com/pricing/calculator/

Quick Reference Tables

Compute Service Decision Matrix

Storage Service Decision Matrix

Database Service Decision Matrix

Integration with Other Skills

• •infrastructure-as-code: Implement Azure patterns using Bicep or Terraform
• •kubernetes-operations: AKS-specific configuration and operations
• •deploying-applications: Container Apps and App Service deployment
• •building-ci-pipelines: Azure DevOps and GitHub Actions integration
• •auth-security: Entra ID authentication and authorization patterns
• •observability: Azure Monitor and Application Insights
• •ai-chat: Azure OpenAI Service for chat applications
• •databases-nosql: Cosmos DB implementation details
• •secret-management: Azure Key Vault integration patterns

Reference Documentation

For detailed implementation guidance, see:

• •references/compute-services.md - Container Apps, AKS, Functions, App Service with Bicep/Terraform
• •references/storage-patterns.md - Blob Storage, Files, Disks, lifecycle management
• •references/database-selection.md - SQL Database, Cosmos DB, PostgreSQL patterns
• •references/ai-integration.md - Azure OpenAI, RAG architecture, function calling
• •references/messaging-patterns.md - Service Bus, Event Grid, Event Hubs examples
• •references/networking-architecture.md - Hub-spoke, Private Endpoints, DNS configuration
• •references/identity-access.md - Entra ID, Managed Identity, RBAC
• •references/governance-compliance.md - Azure Policy, Landing Zones, cost optimization
• •references/well-architected.md - Five pillars implementation guide

Code Examples

Working examples available in:

• •examples/bicep/ - Infrastructure templates (Container Apps, AKS, networking, databases)
• •examples/terraform/ - Multi-cloud IaC examples
• •examples/sdk/python/ - Python SDK integration (OpenAI, Managed Identity, messaging)
• •examples/sdk/typescript/ - TypeScript SDK examples

Additional Resources

• •Azure Architecture Center: https://learn.microsoft.com/azure/architecture/
• •Azure Well-Architected Framework: https://learn.microsoft.com/azure/well-architected/
• •Azure Verified Modules: https://aka.ms/avm
• •Azure Charts (Service Comparison): https://azurecharts.com/
• •Azure Updates: https://azure.microsoft.com/updates/