| Terminology | Definition |
|---|
| Type | Description |
|---|---|
| Public Cloud | Anyone can access a public cloud |
| Private Cloud | A private cloud provides resources to a single organization |
| Hybrid Cloud | A combination of public and private clouds |
| Model | Description |
|---|---|
| Infrastructure as a Service (Iaas) | Delivers infrastructure to the client, such as processing storgae, networks and virtualized environments. The Iaas provider is responosible for managing the: Computing power, Storage, Networking. The Customer is responsible for: Operating Systems, Applications, Data, Access. |
| Platform as a Service | Paas come with the cost and complexity of buying and managing the underlying hardware and softawre. PaaS providers are responsible for: Operating Systems, Computing Power, Storage, Networking. Customer is responsible for: Data, access, applications. |
| Software as a Service (SaaS) | Delivers software applications to the client over the internet. A Saas Provider is responsible for managing: Operating System, Networking, Storage, Computing Power, Applications. |
| Benefit | Description |
|---|---|
| Backup | The Cloud provides reliable backup solutions. |
| Accessibility | The Cloud gives you access to your data on any device |
| Collaboration | Cloud-Based applications give you the ability to share documents and collaborate with other people. |
| Resource pooling | Many buisness want to expand their computing resources without purchasing and maintaining additionl in-house hardware. |
| Elasticity | Most cloud services are pay-as-you-go meaning that an organization only pays for what they use |
| Drawback | Description |
|---|---|
| Privacy and security concerns | Data files stored on the cloud are susceptible to hackers, who gain access to cloud storage devices or capture data as it travels over the internet |
| Internet Connection Issues | While Cloud infrastucture allows you to access data anywhere, it requires an active internet connection |
| Cloud Hosting outages | Even if you have an active internet connection sometimes the cloud service provider has an outage |
| Method | Description |
|---|---|
| Regions | Microsoft has multiple different data centers in multiple regions, offering benifits to the user such as: Resources closer to the user, Load balancing, Scalability, Redundancy, Resiliency. |
| Availability Zones | Availability Zones include one or more data centers within the same regon in different geographical locations |
| Region Pairs | Region Pairs are established to provide even further redundency, in case of natural disaster or other event |
| Categories | Services |
|---|---|
| Computer | Azure Virtual Machines, Azure Kubernetes Service, Azure Container Instances, Azure Functions, Azure App Services |
| Networking | Virtual Network, Load Balancer, VPN Gateway, Application Gateway, Content Delivery Network |
| Storage | Blob Storage, Disk Storage, File Storage, Archive Storage |
| Databases | Cosmos DB, Azure SQL Database, Azure Database for MySQL, Azure Database for PostgreSQL. Azure Database Migrationservice |
| Web | Azure App Service, Azure API Management, Azure Notification Hubs |
| Internet of Things (IoT) | IoT Hub, IoT Central |
| Big Data | Azure Synapse Analytics, HDInsight, Azure Databricks |
| Artificial Intelligence (AI) | Azure Machine Learning Service and Studio |
| DevOps | Azure DevOps, Azure DevTest Labs |
| Level | Description |
|---|---|
| Resources | Resources are items that can be managed using azure |
| Resource Groups | Resources groups are logical containers for resources. Policies, permissions and other operations can be applied to the resources group as a whole |
| Subscriptions | Subscriptions combine user accounts with the resources that users has created |
| Managment groups | Contain one or more resources to be managed and cloud include: Virtual machines, SQL databases, Storage, Web apps |
| Prodcut | Description | Use Case |
|---|---|---|
| Virtual Machines | Windows Server, Windows Client, or Linux Virtual Machines can be created on-demand. Virtual Machines increase stability and reduce hardware costs. | Times when you need full control over a machine. Running custom software. Testing and development. Increasing the size of a data center. Applications with fluctuating demands |
| Azure Container Instances | Web apps, configurations, and files are packaged together so they can be consistently shared and deployed over the cloud. | You need to run multiple isolated container instances on one computer. You do not need to have full control over the VM. You want to develop without worrying about managing a full virtual machine. You need to split your app into logical parts for maintenance and scalability |
| Azure Virtual Desktop | Azure Virtual Desktop is an application and desktop virtualization that can be run anywhere in the world using any operating system and any modern browser. | You do not want to risk personal data stored on a laptop or other physical device. Your end-users are using different operating systems. Your users are scattered across different locations and need anywhere-access. You need to accommodate users using various operating systems. |
| Azure Kubernetes Service (AKS) | Azure Kubernetes Service (AKS) is an orchestration service that can be used to manage numerous container instances (nodes). | Azure Kubernetes Service can be used when you need to manage a large number of container instances. |
| Product | Description | Use Case |
|---|---|---|
| Virtual Network | Azure virtual networks provide a method for Azure VMs, databases, and apps to communicate | Segmentation (subnets), Isolation ,Network traffic filtering, Communication between local and Azure resources |
| Azure VPN Gateway | Azure VPN Gateway provides a secure connection between an Azure virtual network and another network. | Network-to-network connection, Site-to-site connection, Point-to-site connection |
| Azure ExpressRoute | ExpressRoute is a private connection between your on-premises network and Microsoft cloud services such as Azure. | Azure ExpressRoute is useful when you need faster speeds, lower latency, and increased reliability over regular internet connectivity. |
| Virtual network peering | Virtual network peering provides a low-latency option for connecting one virtual network to another. Traffic between the two networks is done on Microsoft’s private infrastructure instead of over the Internet. | Virtual network peering is useful for database failover and data replication. |
| Product | Description | Use Case |
|---|---|---|
| Blob Storage | Blob storage houses large amounts of unstructured data such as images, audio, video, and text. Items stored in Blob storage are called blobs. Blobs are organized into containers. This data is connected to user accounts and can be accessed from anywhere. | Files that need distributed access, Streaming video ,Backup and disaster recovery data, Browser images or documents |
| Disk Storage | Azure-managed disks are used with Azure Virtual Machines. Azure provides hard disks, solid-state drives, and ultra disks. | A high level of availability, A large number (potentially thousands) of virtual machines, Protection against regional disasters, Protection from datacenter failures |
| File Storage | Azure files provide cloud-based file shares. These file shares can be accessed by Windows, macOS, or Linux deployments can access these file shares on the premises or in the cloud | Sharing files between on-premise or cloud-based applications, Sharing files between multiple virtual machines |
| Archive Storage | Archive storage is designed to store important data, but does not need to be accessed regularly. | Storing old data for compliance purposes, Long-term backup, Surveillance footage |
| Product | Description | Use Case |
|---|---|---|
| Cosmos DB | Cosmos DB is an Azure hosted NoSQL database system | Cosmos DB is useful when you want to migrate your database to Azure, but you do not want to change your API. |
| Azure SQL Database | Azure SQL Database is a platform as a service (PaaS) hosted by Microsoft. The backend infrastructure, upgrades, backups, and monitoring are fully managed, so you just need to focus on your data. | Azure SQL Database is useful when you need a highly reliable, high-performing relational database without the hassle of database management. |
| Azure Database for MySQL | Azure Database for MySQL is a relational database service hosted by Microsoft. The backend infrastructure, upgrades, and monitoring are fully managed so you can focus on your data. | Azure Database for MySQL is useful when you need a reliable relational database based on MySQL without the hassle of database design, building, and management. |
| Azure Database for PostgreSQL | Azure Database for PostgreSQL is a relational database service. Microsoft handles configuration, replication, backups, security, and monitoring. | Azure Database for PostgreSQL is useful when you need a reliable relational database based on the PostgreSQL database engine. |
| Azure SQL Managed Instance | Azure SQL Managed Instance is a more advanced version of the Azure SQL Database PaaS service. | Azure SQL Managed Instance is useful when you need the benefits of a hosted SQL database, but you need more functionality than is provided by Azure SQL Database. |
| Product | Description |
|---|---|
| Azure Synapse Analytics | Azure Synapse Analytics is a big data solution that combines data warehousing and analytics, including: Synapse SQL (distributed query service), Spark (an open-source big data solution), Synapse pipelines, Synapse tudio (data management, tasks, and user experience building) |
| HDInsight | |
| HDInsight is useful when you need an open-source analytics solution that supports a variety of frameworks: As a PaaS ,As a cloud-based analytics service, To supports Hadoop, Apache Spark, R, Hive, and other frameworks | |
| Azure Databricks | Azure Databricks is useful when focusing on data collaboration and transformation instead of data management. Azure Databricks: Is a PaaS cloud-based analytics service, Works with the Hadoop framework, Has two development environments for data applications:, Azure Databricks Workspace, Azure Databricks SQL Analytics |
| Solution | Description |
|---|---|
| Azure Machine Learning | Azure Machine Learning is: A cloud-based service, Used for training, deploying, and managing machine learning models |
| Cognitive Services | Cognitive Services are used to integrate cognitive intelligence into apps, including: A cloud-based service, Four cognitive services: Speech (speech recognition), Vision (video and image analysis), Decision (identify offensive content and personalize a user’s experience), Language (interpret the intended message, not just individual words) |
| Azure Bot Service | Azure Bot Service is a managed service for bot development. |
| Solution | Description |
|---|---|
| Azure DevOps | Azure DevOps Services is a suite of services designed for use throughout the software development life cycle (SDLC). The following tools are available in the Azure DevOps Suite: |
| DevTest Labs | DevTest Labs is an environment for testing. You can test the creation and management of virtual machines, IaaS, and PaaS before purchasing and implementing them in a live setting. |
| Solution | Description |
|---|---|
| Azure IOT Hub | Azure IoT Hub is designed for developers looking to create custom solutions for their IoT platform |
| Azure IoT Central | IoT Central is an application platform that provides software to connect your IoT devices to the cloud. |
| Azure Sphere | Azure Sphere is used for creating and programming IoT devices |
| Solution | Description |
|---|---|
| Azure Functions | Run code when triggered by Azure and on-premises system events that need an immediate response, Allow you to focus on the code running your service instead of its infrastructure, Support .NET, Java, Python, PowerShell, and several other languages |
| Logic Apps | Is used for scheduling, automating, and orchestrating workflow, Includes pre-built connectors for Microsoft services and third-party services |
| Management Tool | Description |
|---|---|
| Azure Portal | Azure Portal is a centralized, web-based interface for creating, monitoring, and managing your simple Azure deployments and applications. |
| Azure PowerShell | Azure PowerShell Is a command-line interface preferred by Windows users that: Can be used with Linux, Windows, and iOS, Is used for automation, Uses simple commands (cmdlets). Is run on a user’s local machine |
| Azure CLI | Azure CLI is used with Linux, Windows, and iOS. Azure CLI: Is often used with a command-line interface, Is used for automation, Is run on a user’s local machine |
| Cloud Shell | Azure Cloud Shell connects to a preinstalled Azure PowerShell or Azure CLI terminal. Azure Cloud Shell: Uses a web browser, Can be accessed using the Azure Mobile App on a mobile device, Is a free service |
| Azure Resource Manager (ARM) | Azure Resource Manager (ARM) is used to deploy and manage all resources and resource groups. ARM controls access to resources using the privileges defined by Azure Active Directory. |
| Azure Mobile App | You can use Azure Mobile App to connect to your Azure resources. You can monitor and manage virtual devices and applications using this app. |
| Document | Description |
|---|---|
| Microsoft Privacy Statement | The Microsoft Privacy Statement outlines issues related to personal data. It applies to all Microsoft products, including services, apps, software, servers, and devices. |
| Online Services Terms (OST) | The Online Services Terms (OST) is a legal agreement. When customers sign the OST, they agree to the privacy terms and conditions that apply to the purchased online service(s). |
| Data Protection Addendum (DPA) | The Data Protection Addendum (DPA) is an addendum to the OST. It provides additional information about the data processing and security terms and conditions for purchased service(s) |
| Trust Center | The Microsoft Trust Center is a website for an individual or an organization who wants to learn more about all of Microsoft’s privacy, security, and compliance efforts. |
| Regulatory and Compliance Offering | Description |
|---|---|
| Criminal Justice Information Services (CJIS) | Criminal Justice Information Services (CJIS) was created to address information and data security for the criminal justice and law enforcement fields. |
| Health Insurance Portability and Accountability Act (HIPAA) | The Health Insurance Portability and Accountability Act (HIPAA) is a standard created to address information and data security for the health care field. |
| International Organization of Standards/International Electrotechnical Commission (ISO/IEC) | The ISO/IEC standards include the following enforcements for cloud-stored data. These standards ensure that customer data is not used for marketing or advertising purposes and that the data will not be shared unless there is a legally binding order for disclosure. |
| National Institute of Standards (NIST) | The NIST is an agency of the U.S. Department of Commerce. The NIST encourages technological advancements and provides recommendations for data protection. |
| Layers | Description |
|---|---|
| Data | The data layer includes data stored in databases, virtual machines, cloud storage, and SaaS applications. |
| Application | The application layer includes applications and application secret storage. |
| Compute | The compute layer includes virtual machines, systems, and endpoints |
| Network | Network includes all network resources |
| Perimeter | Firewalls and DDoS protection are the primary defenses at the perimeter level. |
| Identity and access | Identify and access defense measures include SSO and multifactor authentication, control access, and event audits, ensuring that access is only granted as needed and logging all events and changes. |
| Physical | The physical layer includes building security and data center access. Physical defenses help to ensure that only authorized individuals have access to a building or a data center and that any loss or theft is documented and addressed. |
| Feature | Description |
|---|---|
| Azure Security Center | The Azure Security Center is a centralized security monitoring service that helps to protect your services from security threats. Azure Security Center: Monitors cloud and on-premises services, Monitors resources, Performs security assessments, Identifies vulnerabilities, Detects and stops malware installation, Applies security settings to new resources |
| Azure Sentinel | Azure Sentinel is a security information and event management (SIEM) system. SIEM systems collect data from various sources for threat detection and response that includes: Data collection from cloud and on-premises, Microsoft analytics and threat intelligence to detect hidden threats, Task automation to respond to incidents quickly |
| Azure Key Vault | Azure Key Vault is a centralized cloud service that stores highly sensitive secrets such as passwords, certificates, tokens, and API keys. Azure Key Vault: Stores and manages sensitive information, Can be used to create and manage encryption keys, Can be used to create and manage SSL/TLS certificates for both internal and Azure resources, Provides access control and access monitoring |
| Azure Dedicated Host | Although VMs are logically separated and isolated from VMs from other organizations, there is a good chance they are hosted on the same physical hardware. While this is okay for most situations, some regulations or compliance regulations may not allow this setup. |
| Feature | Description |
|---|---|
| Azure Firewall | Azure Firewall inspects network traffic and filters network traffic. Traffic can be filtered by port number, protocol, FQDN, and network address. Network administrators can set NAT, network, or application rules to deny or allow various traffic types. |
| Azure DDoS Protection | Azure DDoS Protection provides a level of defense against several types of distributed denial-of-service attacks, including: Volumetric attacks, Resource-level attacks. Protocol attacks |
| Network security groups | Network security groups (NSG) are firewall services offered by Azure. These NSGs filter network traffic between services in an Azure virtual network. |