Microsoft Azure
In plain English
Plain definition
A concise technical definition of Microsoft Azure covering its architecture, resource-management model, operational boundaries, a common misunderstanding, and related terminology.
Technical Definition
Azure is a hyperscale, multi-tenant cloud platform delivering Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) offerings across a global network of Microsoft-operated regions and availability zones. Resources are organised within a management hierarchy — tenant, management group, subscription, resource group, resource — and are provisioned, governed and audited through Azure Resource Manager (ARM), the platform’s control-plane API. ARM exposes a consistent interface across the Azure Portal, Azure CLI, Azure PowerShell and declarative templates (ARM JSON or Bicep), so any resource type can be deployed, tagged, locked and role-assigned using the same underlying mechanism.
Operational Relevance
Practitioners encounter Azure most directly through workload-specific services: virtual machines (Azure Virtual Machines), container platforms (Azure Kubernetes Service, Azure Container Apps), managed databases (Azure SQL Database, Azure Cosmos DB), identity (Microsoft Entra ID) and event-driven compute (Azure Functions). Operational correctness depends on boundaries that are easy to overlook: the subscription is normally the billing and default-policy boundary, not the security boundary; the tenant is the identity boundary; and role-based access control (RBAC) determines what an identity may do within a scope, not merely whether it can authenticate.
- Cost and quota limits apply per subscription and per region, and can silently throttle deployments if not checked in advance.
- Monitoring and diagnostics are opt-in per resource through Azure Monitor and Log Analytics; nothing beyond platform-level activity logs is captured by default.
- Azure Policy and management-group-level guardrails apply top-down and can block an otherwise valid deployment without an obvious local error message.
Architecture Relationship
Azure’s networking primitives — Virtual Networks, subnets, network security groups and Azure DNS — are built on standard Internet protocols such as TCP/IP and DNS, whose specifications are maintained by the IETF and published through the RFC Editor’s RFC Series.[1] Azure Resource Manager sits above this network layer as the shared control plane for almost every Azure service, so identity, networking and compute concerns are usually resolved through the same subscription, resource group and RBAC model regardless of which service is deployed. Microsoft Entra ID provides the identity plane that Azure Resource Manager, and most PaaS services, rely on for authentication and conditional access.
Example
A bounded, non-production example: an engineer creates a dedicated resource group in an isolated subscription, deploys a single virtual network with one subnet, attaches a network security group that denies all inbound traffic except a specific management range, and deploys one small virtual machine into that subnet. The engineer then confirms the VM is reachable only from the permitted range, and records the resource group name so the whole example can be removed as a single unit once validation is complete.
Misunderstanding
A common misunderstanding is treating an Azure subscription and a Microsoft Entra tenant as the same boundary. A tenant can contain many subscriptions, and a subscription’s RBAC assignments do not automatically restrict what the underlying tenant’s identities can do elsewhere. Another frequent error is assuming that deleting a resource group is a low-risk, easily reversible action; resource group deletion permanently removes every resource inside it, and there is no platform-level undo — recovery depends entirely on whatever backups, exports or infrastructure-as-code definitions existed beforehand. Because this behaviour is version- and configuration-sensitive, it should be confirmed against current Microsoft documentation before relying on it operationally.
Related Terms
- Microsoft Entra ID
- Azure Resource Manager
- Azure Virtual Network
- Infrastructure as a Service (IaaS)
- Azure Kubernetes Service
Further Reading
For authoritative, current detail beyond this definition, consult Microsoft’s official Azure documentation on Microsoft Learn for service-specific and version-specific behaviour, and the IETF RFC Editor’s RFC Series for the underlying Internet protocol specifications that Azure networking implements.