Module 3 — Core Azure services
Place in the route
This module applies the cloud and architecture models to the service families that appear in a basic Azure workload.
Outcomes
You should be able to select a compute, network, storage, or migration service from its responsibility and connectivity boundary rather than from its name alone.
Compute and hosting
A VM is an IaaS computer with an OS, disks, NIC, and optional public connectivity. A container packages an application and its user-space dependencies so a compatible runtime can start it consistently; the hosting service still determines networking, scaling, and security. Functions run short, event- or request-triggered code with the platform managing server allocation. App Service hosts web applications on a managed platform. The choice is a control-versus-operations decision: use a VM for OS control, a managed web runtime for ordinary web hosting, and functions for discrete event-driven execution.
Networking and storage
A virtual network (VNet) supplies private address space and subnets. DNS resolves a name to an endpoint; it does not grant access. A VPN Gateway encrypts a connection over the internet to on-premises; ExpressRoute provides a private provider connection. A public endpoint is reachable through a public address; a private endpoint gives a service a private address in a VNet. Network security controls then decide whether traffic can pass.
An Azure Storage account is the management and namespace boundary for Blob Storage, Azure Files, queues, and tables. Blobs hold object data, Files exposes managed file shares, queues hold simple messages, and tables hold key-value entities. Managed disks are VM storage, not a replacement for every storage service. Select redundancy and access method with the data’s recovery, latency, and authorization needs in mind.
Migration
Migration tools discover and assess existing workloads, move or replicate them, and help modernize them. Discovery is not migration: inventory and dependency evidence must precede a move, and the cutover plan must account for data synchronization and rollback.
Conceptual checkpoint
For a web front end, a background image processor, a shared departmental file share, and a VM that needs a custom kernel, choose a likely service family and name the boundary that drove each decision. Explain why a DNS record alone cannot fix a blocked network path.
Hands-on / what to try
Read the AZ-900 Canvas from compute through network to storage and narrate each labeled edge as a request or data handoff.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- AZ-900 study guide, skills measured 2026-07-20, checked 2026-08-31.
- Azure Virtual Network overview, checked 2026-08-31.
- Azure Storage account overview, checked 2026-08-31.
Re-audit when service capabilities, endpoint behavior, or the AZ-900 source baseline changes.