Working on Microsoft Azure: Workloads, Account Security, Management and Cost Control
The Azure services teams build on, how to secure a subscription with Entra ID and NSGs, management habits with tags and resource groups, and how Azure pricing options compare.
Microsoft Azure combines a broad infrastructure catalog with deep integration into the Microsoft ecosystem, which is why it is common in organizations already running Windows Server, SQL Server or Microsoft 365. This guide covers what teams build on Azure, the security steps for a new subscription, the management habits that keep resources organized, and how Azure’s pricing options fit together. If tenants, subscriptions and resource groups are still fuzzy, read our Azure fundamentals guide first.
What you can build on Azure #
| Area | Services | What they do |
|---|---|---|
| Compute | Azure Virtual Machines | General-purpose, compute-optimized, memory-optimized and GPU VM sizes |
| Storage | Blob Storage, Disk Storage, Azure Files | Object storage, managed block disks and SMB or NFS file shares |
| Managed databases | Azure SQL Database, Cosmos DB, Database for PostgreSQL, Database for MySQL | Relational and multi-model databases with automated backups, patching and scaling |
| AI and machine learning | Azure Machine Learning, Azure OpenAI Service, AI services, AI Foundry | End-to-end ML lifecycle, hosted large language models and prebuilt vision, speech and language APIs |
| Networking and delivery | Azure CDN, Azure DNS, Virtual Network, API Management | Content delivery, DNS, private networks and API publishing |
| Serverless | Azure Functions, Logic Apps, Event Grid | Event-driven code, workflow automation and event routing |
| DevOps | Azure DevOps, Azure Pipelines, GitHub Actions | Repositories, boards and CI/CD pipelines |
| Analytics | Synapse Analytics, HDInsight, Data Lake, Stream Analytics | Warehousing, managed Hadoop and Spark, large-scale storage and real-time processing |
| Security and identity | Microsoft Entra ID, Key Vault, Defender for Cloud, Sentinel | Identity and access, secrets and keys, security posture and a cloud SIEM |
How teams use it #
Developers use separate subscriptions or resource groups to keep projects apart. Startups build on managed services to avoid running infrastructure. Agencies usually work inside a client’s own tenant through guest accounts and role assignments, which keeps billing and security with the client. Researchers use GPU VM sizes and HDInsight or Synapse for data processing. AI teams combine Azure OpenAI Service for generative applications with Azure Machine Learning for custom model training and deployment; our overview of Azure AI services goes deeper. Azure also supports lift-and-shift migrations, hybrid deployments that span on-premises and cloud, and fully cloud-native development.
Securing a new Azure subscription #
- Protect the Global Administrator account with a strong password and multi-factor authentication, and keep the number of global admins small.
- Create Entra ID users and assign Azure RBAC roles scoped to the subscription, resource group or resource that each person needs, rather than working as a global administrator.
- Set budgets and billing alerts in Cost Management.
- Review network security groups (NSGs) and firewall rules so only intended inbound and outbound traffic is allowed.
- Enable activity logging through Azure Monitor and route logs to a Log Analytics workspace so you can query and alert on them.
- Audit regularly. Defender for Cloud gives a secure score and recommendations; review role assignments and NSGs on a schedule.
Management essentials #
- Resource groups and tags: group resources by application or environment and tag them by project, cost center or owner so cost reports line up with how your organization thinks.
- Cost monitoring: use Cost Management and Budgets to track spending trends rather than only the monthly invoice.
- Least privilege: prefer built-in RBAC roles with narrow scope; avoid granting Owner at the subscription level.
- Backup and recovery: use Azure Backup for VMs and databases and test a restore.
- Compliance: Azure Policy enforces standards such as allowed regions or required tags, and Defender for Cloud monitors posture.
For organizations with several subscriptions, management groups provide a hierarchy for applying policies and RBAC centrally. Assign roles to team members based on responsibility, and use Privileged Identity Management if you need time-bound elevated access.
How Azure pricing works #
| Model | How it works |
|---|---|
| Pay-as-you-go | Pay for compute by the second with no long-term commitment |
| Reserved Instances | Commit to a resource type for one or three years for a significant discount |
| Azure Hybrid Benefit | Apply existing Windows Server and SQL Server licenses to Azure resources to reduce cost |
| Spot Virtual Machines | Unused capacity at a large discount; VMs can be evicted when Azure needs the capacity |
| Free account | New users may receive a credit for a limited period plus twelve months of free access to popular services, subject to Microsoft’s current terms |
Keeping Azure costs under control
- Set Azure Budgets with alert thresholds and email recipients.
- Review Cost Management views weekly, grouped by resource group and tag.
- Right-size VMs using Azure Advisor recommendations.
- Use autoscale on VM scale sets and App Service plans.
- Apply Reserved Instances or Hybrid Benefit to predictable workloads.
- Delete unused resources such as orphaned disks, public IPs and stopped-but-allocated VMs.
See cloud pricing models compared for how these options line up against AWS and Google Cloud.
A first-week checklist for a new subscription #
- Decide the resource group layout (by application and environment) before creating anything.
- Create a budget in Cost Management with alert thresholds and a shared recipient.
- Assign RBAC roles at resource group scope; avoid subscription-wide Owner grants.
- Enable Defender for Cloud’s free tier to get a secure score and recommendations.
- Apply Azure Policy definitions for required tags and allowed regions so drift is caught automatically.
- Route activity logs to a Log Analytics workspace and create an alert on role assignment changes.
Official references #
Microsoft Learn for Azure holds the documentation for every service above. Our Azure platform overview covers where the platform fits and how to sign up officially.
Frequently asked questions #
How do I manage an Azure subscription?
Through the Azure Portal, or with the Azure CLI, Azure PowerShell and SDKs for scripting. Bicep and Terraform are common for infrastructure as code.
What is Azure Hybrid Benefit?
A licensing benefit that lets organizations with existing Windows Server or SQL Server licenses covered by Software Assurance apply them to Azure resources, lowering the VM or database price.
What should I check first on an existing subscription?
Who holds Owner and Contributor roles, whether MFA is enforced for administrators, and whether any NSG allows inbound management ports from the whole internet.
