Home/Certifications/Microsoft/Azure Virtual WAN Design Decisions Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Azure Virtual WAN reduces some of the manual routing and connectivity work in a distributed network, but it introduces a managed hub control plane with its own route association, propagation, inspection and cost model. Evaluate it against the actual branch and workload architecture before replacing a functioning hub-and-spoke network. Managed transit can reduce repetitive hub configuration, but a change in route association or propagation can alter traffic across many branches. Evaluate Virtual WAN with explicit…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure VPN Gateway Design Cloud & ArchitectureUpdated October 10, 2026 · 7 min read A VPN Gateway design succeeds when the required networks exchange routes securely and recover predictably from tunnel, device or gateway failures. Picking a gateway SKU is only one part of planning authentication, routing, resilience and operations. A working VPN tunnel is only the beginning of connectivity. Engineers must validate advertised routes, overlapping address ranges, authentication choices, gateway redundancy, and the behavior users see when one peer or circuit fails. On this pageChoose the connection…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure Subscription Design Cloud & ArchitectureUpdated October 10, 2026 · 7 min read An Azure subscription is simultaneously a deployment scope, a governance boundary and a unit with billing and service limits. Good subscription design makes those boundaries deliberate without turning every application team into an isolated platform operator. Subscription boundaries should reflect governance, operational ownership, service limits, and cost allocation rather than every application name. A good design lets shared networking and security controls apply consistently without creating needless cross-subscription dependencies. On this pageStart with the purpose…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure Resource Locks Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Azure resource locks are guardrails against accidental management operations, not a replacement for least-privilege access, backups or recovery planning. Knowing precisely what a lock blocks—and what it does not—is essential before applying one to a production estate. A delete lock may prevent one management operation while leaving data-plane behavior and other forms of loss unaffected. Test the intended protection with a representative resource and document how an authorized operator removes it during maintenance. On this…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure Management Groups Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Management groups let a large Azure estate apply governance above individual subscriptions. The hard design problem is not creating folders in a hierarchy; it is placing subscriptions so inherited access and policy match how the organization actually operates. A hierarchy that mirrors an organization chart too closely can make policy and role inheritance harder to manage after a reorganization. Group subscriptions where governance requirements genuinely differ, and test effective policy at the destination scope. On…

Home/Certifications/Microsoft/Microsoft AZ-104: Hybrid Identity Decisions Cloud & ArchitectureUpdated October 10, 2026 · 7 min read Hybrid identity is a decision about where account attributes originate, how sign-ins are verified and which synchronization or provisioning service owns each object. Reliable Azure administration requires distinguishing identity sources and authentication paths before choosing a synchronization agent. An on-premises account can synchronize to Microsoft Entra without using the same authentication path for every application. Clarify the authoritative attribute source, provisioning method, sign-in flow, and exception process before deploying a connector. On this pageSeparate directory…

Home/Certifications/Microsoft/Azure Front Door vs. Application Gateway Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Azure Front Door and Application Gateway both route HTTP traffic, but they operate at different points in a request’s journey. The right choice depends on global reach, regional network boundaries, origin exposure, failure domains and the kind of traffic the application actually serves. An application with users across continents has different entry-point needs from a private regional workload. Origin reachability, web application filtering, health probes, and failover routes should decide whether a global front…

Home/Certifications/Microsoft/FSLogix Profiles for Azure Virtual Desktop Cloud & ArchitectureUpdated October 10, 2026 · 6 min read FSLogix profile containers can make pooled Azure Virtual Desktop sessions feel persistent, but an apparently simple VHDX attachment depends on identity, file-share permissions, network access and a clean session lifecycle. Operational evidence matters more than a successful initial sign-in. Profile containers depend on more than file-share capacity. In a pooled desktop fleet, attachment rights, network reachability, lock behavior, and sign-out cleanup determine whether a user resumes with the expected settings rather than a temporary…

Home/Certifications/Microsoft/ExpressRoute Resilience Patterns Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Private connectivity can be reliable and still contain one unexpected point of failure. ExpressRoute resilience depends on physical diversity, independent routing paths and tested failover behavior—not simply the presence of two BGP sessions on a circuit. Redundant sessions across one physical location may still share a provider or facility failure. ExpressRoute resilience should be assessed through independent circuits, peering, routing choices, and a controlled test of the exact failure the design must survive. On this pageDistinguish link…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure Backup and Recovery Design Cloud & ArchitectureUpdated October 10, 2026 · 6 min read A useful Azure recovery design starts with what the business must restore, how much data it can lose and who can authorize recovery. Selecting a vault is one important step, but it does not establish that a damaged application can return to service. Restoring a database copy is not the same as restoring a working business service. Document which dependencies return first, how access is re-established, what the recovery objective means, and how…

Home/Certifications/Microsoft/Azure Firewall Egress Design Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Centralized egress control works only when applications actually traverse the intended inspection path and DNS, rules, logging and exception ownership are consistent. A firewall deployed in a hub is not evidence that all outbound traffic is protected. An outbound inspection design fails when one workload bypasses the intended firewall or resolves a destination differently from the rule owner. Route tables, DNS, application dependencies, logging, and exception handling must be considered together. On this pageDefine the allowed…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure Cost Governance Cloud & ArchitectureUpdated October 10, 2026 · 6 min read Sustainable Azure spending needs ownership, useful cost allocation, budget conversations and controls that prevent waste without interrupting legitimate services. Price optimization comes after understanding usage and business value. Budgets identify pressure; tags and cost allocation assign responsibility; policy can prevent selected waste before it occurs. A useful governance process connects each signal to an owner who can explain, investigate, and safely change the resource. Costs should be evaluated with service reliability, recovery requirements, and security…

Home/Certifications/Microsoft/Azure Virtual Desktop Profile Storage Cloud & ArchitectureUpdated October 10, 2026 · 7 min read Azure Virtual Desktop performance depends heavily on where user profiles live, how quickly session hosts can mount them, and whether identity, storage and recovery controls survive a busy sign-in period. User profiles travel across session hosts only when storage permissions, network access, identity, and container lifecycle are consistent. The design must handle a second sign-in, a disconnected session, and a storage failure—not only the first successful login. On this pageTreat profiles as an application dependencyCompare…

Home/Certifications/Microsoft/Azure Route Server for Hybrid Networks Cloud & ArchitectureUpdated October 10, 2026 · 7 min read Azure Route Server exchanges BGP route information with supported network virtual appliances and Azure routing. It simplifies dynamic routing only when route ownership, failover, propagation and security inspection paths are designed deliberately. Route Server can simplify dynamic route exchange, but it does not replace a correct transit architecture or every gateway function. Know which peers advertise which prefixes, how route propagation affects spokes, and what happens when the advertised path disappears. On this pageChoose…

Home/Certifications/Microsoft/Microsoft AZ-104: Azure RBAC for Platform Teams Cloud & ArchitectureUpdated October 10, 2026 · 7 min read Platform teams need a repeatable way to delegate Azure permissions without accumulating subscription-wide Owners. The design starts with service responsibilities, assignment scope, and evidence that temporary privilege is controlled. Platform teams often require broad visibility but narrowly scoped change rights across several subscriptions. Treat monitoring, resource deployment, identity administration, and security review as different tasks; inherited assignments and role definitions determine the actual blast radius. On this pageTranslate platform responsibilities into permission boundariesPlace…