Learn Microsoft Azure

A subscription is a billing and management boundary that also sets service quotas; costs roll up per subscription. A resource group is a logical container inside a subscription that groups related resources so they share a lifecycle — you can deploy, manage, and delete them together, and apply RBAC and tags at that level.

A managed identity is an automatically-managed identity in Microsoft Entra ID that an Azure resource (like a VM or Function) uses to authenticate to other Azure services without storing credentials in code. System-assigned identities are tied to one resource's lifecycle; user-assigned identities are standalone and can be shared across multiple resources.

LRS keeps three copies within a single data center. ZRS spreads copies across Availability Zones in one Region. GRS replicates to a paired secondary Region (with RA-GRS adding read access to the secondary). GZRS combines zone redundancy in the primary with geo-replication for the highest durability.

An NSG is a stateful firewall containing prioritized allow/deny rules that filter inbound and outbound traffic by source/destination IP, port, and protocol. NSGs can be associated with a subnet or a network interface; rules are evaluated by priority, and because they're stateful, return traffic is automatically permitted.

Choose App Service (PaaS) when you want to deploy a web app or API without managing the OS, patching, or scaling infrastructure — Azure handles the platform, and you get built-in load balancing, autoscaling, and deployment slots. Choose a VM (IaaS) when you need full OS control, custom software, or to lift-and-shift an existing workload.

RBAC controls who can perform actions on resources — it grants or denies permissions to identities. Azure Policy controls what configurations resources may have — it enforces rules like 'only allow VMs in these regions' or 'require encryption', and can audit or deny non-compliant deployments. They are complementary: RBAC is about access, Policy is about compliance.