430-azure

Microsoft Azure Best Practices

Guiding Principles

1. Cloud-Native Design: Leverage Azure-native services (App Service, Functions, Container Apps)
2. Infrastructure as Code: Use Bicep over ARM templates, Terraform for multi-cloud
3. Security by Default: Azure AD, Key Vault, Private Endpoints, NSGs
4. Cost Optimization: Right-size resources, use reservations, implement auto-scaling
5. High Availability: Availability Zones, geo-redundancy, Traffic Manager

---

Azure Resource Naming Convention

Standard Format

{resource-type}-{workload/app-name}-{environment}-{region}-{instance}

Examples

# Virtual Machine
vm-webserver-prod-eastus-001

# Storage Account (no hyphens, lowercase only, max 24 chars)
stwebprodeastus001

# App Service
app-webapp-prod-eastus-001

# Key Vault (max 24 chars)
kv-webapp-prod-eus-001

# Resource Group
rg-webapp-prod-eastus

# Virtual Network
vnet-webapp-prod-eastus-001

# Network Security Group
nsg-webapp-prod-eastus-001

# Azure SQL Database
sql-webapp-prod-eastus-001

---

Bicep Best Practices

Basic Bicep Template

@description('Environment name (dev, staging, prod)')
@allowed([
  'dev'
  'staging'
  'prod'
])
param environment string

@description('Azure region for resources')
param location string = resourceGroup().location

@description('Application name')
param appName string

@description('Tags for all resources')
param tags object = {
  Environment: environment
  ManagedBy: 'Bicep'
  Application: appName
}

// Storage Account
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'st${appName}${environment}${uniqueString(resourceGroup().id)}'
  location: location
  tags: tags
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    allowBlobPublicAccess: false
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
    }
    encryption: {
      services: {
        blob: {
          enabled: true
        }
        file: {
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
  }
}

// App Service Plan
resource appServicePlan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: 'asp-${appName}-${environment}-${location}'
  location: location
  tags: tags
  sku: {
    name: environment == 'prod' ? 'P1v3' : 'B1'
    tier: environment == 'prod' ? 'PremiumV3' : 'Basic'
  }
  properties: {
    reserved: true // Linux
  }
}

// Web App
resource webApp 'Microsoft.Web/sites@2023-01-01' = {
  name: 'app-${appName}-${environment}-${location}'
  location: location
  tags: tags
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: true
    siteConfig: {
      linuxFxVersion: 'NODE|20-lts'
      minTlsVersion: '1.2'
      ftpsState: 'Disabled'
      alwaysOn: environment == 'prod'
      healthCheckPath: '/health'
      appSettings: [
        {
          name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'
          value: 'false'
        }
        {
          name: 'ENVIRONMENT'
          value: environment
        }
      ]
    }
  }
}

// Outputs
output webAppName string = webApp.name
output webAppHostname string = webApp.properties.defaultHostName
output storageAccountName string = storageAccount.name