DEV Community: Louis Oodo

Organising and Protecting Azure Resources: A Guide to Tags and Locks

Louis Oodo — Sun, 15 Mar 2026 08:24:52 +0000

Organizing and Protecting Azure Resources: A Guide to Tags and Locks

Introduction

As your cloud environment grows, keeping track of your resources and preventing accidental data loss becomes a top priority. Azure provides two simple yet powerful tools for this: Tags and Resource Locks. Tags allow you to categorize resources for better billing and organization, while Locks provide a safety net against accidental deletion. In this guide, we will walk through applying these management features to a Virtual Machine and a Virtual Network.

Add Tags and a Resource Lock to a VM

Login to Microsoft Azure at https://portal.azure.com.
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
From the menu pane, select Tags.
On one line for Name enter Department and for Value enter Customer Service.
On the next line, for Name enter Purpose and for Value enter FTP Server.
Select Apply.

Add a Resource Lock to a VM

While you’re working on the virtual machine, it’s a great time to add a resource lock to ensure it isn't accidentally removed.

If necessary, expand the Settings submenu.
Select Locks.
Select + Add.
For the name, enter VM-delete-lock.
For the Lock type, select Delete.
You may enter a note to help remind you why you created the lock.
Select OK.

That’s it! Now the VM is protected from deletion and has tags assigned to help track use. Time to move onto the network.

Select Home to return to the Azure portal home page.

Add Tags to Network Resources

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet network.
From the menu pane, select Tags.

Note: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and create something new in the other field.
For the Name select Department.
For the Value enter IT.
Select Apply.

Conclusion

Now both the VNet and VM are organized and secured. By implementing a consistent tagging strategy, you make it much easier to filter resources and analyze your Azure bill by department or project. Furthermore, by applying a "Delete" lock, you've added a critical layer of protection for your infrastructure. These small administrative steps go a long way in maintaining a professional and reliable cloud environment.

I would love to hear from you

Managing Azure Storage: Containers, File Shares, and Security Tokens

Louis Oodo — Sun, 15 Mar 2026 07:20:52 +0000

Managing Azure Storage: Containers, File Shares, and Security Tokens

Introduction

Storage is the backbone of any cloud application. In Azure, Storage Accounts provide a versatile foundation for holding everything from unstructured data like images to structured file shares for collaborative work. In this guide, we will walk through the lifecycle of data management: creating containers, uploading blobs, managing cost-efficiency through access tiers, and securing your data using Shared Access Signatures (SAS). We will also cover the critical administrative task of revoking access by rotating security keys.

Create a Storage Container

Login to Microsoft Azure at https://portal.azure.com.
From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)
On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.
In the Name field, enter storage-container.
Select Create.

Great! With a storage container created, you can upload a blob to the container. Locate a picture that you can upload, either on your computer or from the internet, and save it locally to make uploading easier.

Upload a File to the Storage Container

Select the storage container you just created.
Select Upload and upload the file you prepared.
Once the file is ready for upload, select Upload.

With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file.

Change the Access Tier

Select the file you just uploaded (the file name is a hyperlink).
Select Change tier.
Select Cold.
Select Save.

Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.
Select Home to return to the Azure portal home page.

Good job! You’ve successfully uploaded a storage blob and changed the access tier from Hot to Cold. Next, you’ll work with file shares.

Create a File Share

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created earlier (associated with guided-project-rg).
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.
On the Basics tab, in the name field enter file-share.
On the Backup tab, uncheck Enable backup.
Select Review + create, then select Create.
Once the file share is created, select Upload and upload the same file or a different one.
Select Home to return to the Azure portal home page.

Create a Shared Access Signature (SAS) Token

The Azure admin wants you to use shared access tokens or keys to control access to files.

From the Azure portal home page, search for and select storage accounts.
Select your storage account.
On the storage account blade, select Storage browser.
Expand Blob containers. (Note: Blob container is another name for the storage containers.)
Select storage-container.
Select the ellipses (three dots) at the end of the line for the image you uploaded and select Generate SAS.
Set Signing method to Account key and Signing key to Key 1.
Set Stored access policy to None and Permissions to Read.
Enter a custom start and expiry time or leave the defaults.
Set Allowed protocols to HTTPS only.
Select Generate SAS token and URI.
Copy the Blob SAS URL and paste it into a new browser tab. Your image should appear. Keep this tab open.
Select Home to return to the Azure portal home page.

Rotate Access Keys

To revoke access, you need to invalidate the SAS token by rotating the key used to sign it.

Navigate back to your Storage account.

Expand the Security + networking submenu and select Access keys.
For Key 1, select Rotate key.
Acknowledge the warning by selecting Yes.
Once successful, go back to the browser tab where you viewed the image via the SAS URL and refresh the page. You should receive an authentication failed error.

Conclusion

Managing Azure Storage is about balancing accessibility with security and cost. By moving data to the Cold tier, you've optimized storage costs for infrequently accessed data. By creating and then revoking a Shared Access Signature through key rotation, you have practiced a fundamental cloud security principle: ensuring that access is granted only for as long as it is needed. These skills form the basis of robust data management in any Azure-based project.

I would like to hear from you

Optimizing Your Azure Virtual Machine: Subnets, Scaling, and Storage

Louis Oodo — Sun, 15 Mar 2026 03:52:30 +0000

Optimizing Your Azure Virtual Machine: Subnets, Scaling, and Storage

Introduction

Once a Virtual Machine is deployed, the real work of an Azure Administrator begins: optimization. Whether you need to move a resource to a more secure network segment, increase computing power to handle heavier workloads, or expand storage for data-heavy applications, knowing how to modify existing resources is critical. In this guide, we will walk through migrating a VM to a new subnet, vertically scaling its size, attaching additional data disks, and implementing cost-saving automation through scheduled shutdowns.

Move the Virtual Machine Network to the New Subnet

Login to Microsoft Azure at https://portal.azure.com.
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If the virtual machine is running, select Stop.

Note: In order to make some configuration changes, such as changing the subnet, the VM will need to be restarted. You can request the change without stopping the VM, but Azure will force a restart before completing the change.
Wait for the Status field to update and show Stopped (deallocated).
Within the Networking subsection of the menu, select Network settings.
Select the Network interface / IP configuration hyperlink for the VM.
On the IP Configurations page, update the Subnet to ftpSubnet.
Select Apply.

Note: since we couldn't create a VM in east US we will go ahead and select the default for Korea central. In this analogy, vertical scaling is like taking your apartment and upgrading it from a studio apartment (low computing power) to a penthouse suite (high computing power) with more rooms (CPU) and space (RAM).

The physical task of upgrading your apartment (changing its size and amenities) is a completely separate decision from which floor (subnet) it happens to be located on. You can just as easily upgrade an apartment on the default floor as you can an apartment on the ftpSubnet floor. The final "Applying Changes" step, shown in your screenshot, will just register the VM's location and configuration

Select Home to return to the Azure portal home page.

Good job! You’ve migrated the VM from one subnet to another. Remember, the new subnet had specific network security rules applied to help it function as an FTP server.

Vertically Scale the Virtual Machine

The next task from the Azure admin relates to the computing power of the VM. The admin would like you to vertically scale the machine to increase the computing power.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the Availability + scale submenu and select Size.
Select a new VM size D2s_v5 for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)
Select Resize.

Note: The VM size may not update in the Azure UI until the VM is restarted.

Select Home to return to the Azure portal home page.

Well done. With the VM scaled up to a more robust processor, it can handle the new role it’s being assigned.

Attach Data Disks to a Virtual Machine

Now the Azure admin realizes that if the VM is going to serve as an FTP server, it needs more storage. The Azure admin asked you to attach a new data disk to the VM.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the settings submenu and select Disks.
Select Create and attach a new disk.
Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine.
Select Home to return to the Azure portal home page.

Nice! Now the VM has enough storage to handle some uploads.

Configure Automatic Shutdown on a Virtual Machine

The final thing the Azure admin is concerned about is the cost of running the computer 24 hours a day. The first thing they’ll do every morning is start up the FTP server. However, they’d like you to configure it to automatically shutdown every day at 7 PM Coordinated Universal Time (UTC).

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown.
In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.
Select Save.
Note: I ended up using the default as it won't let me change the scheduled shutdown.
Select Home to return to the Azure portal home page.

Conclusion

Managing a cloud environment is an iterative process. By moving the VM to a specific subnet, scaling its performance, adding storage, and automating its shutdown, you have transformed a basic virtual machine into a cost-effective, high-performance FTP server. These administrative tasks ensure that your cloud infrastructure remains both functional and fiscally responsible.

Would you like me to walk you through how to verify the new disk inside the Ubuntu OS so you can actually start using that 20GB of space?

Setting Up Your Azure Environment: A Guided Project Walkthrough

Louis Oodo — Sun, 15 Mar 2026 02:36:50 +0000

Setting Up Your Azure Environment: A Guided Project Walkthrough

Introduction

Getting started with cloud infrastructure can feel overwhelming, but the Azure Portal makes it manageable through a structured UI. In this guide, we will walk through the essential steps to provision a Resource Group, a Virtual Network, a Virtual Machine, and a Storage Account. By following this sequence, you will ensure your environment is organized and easy to manage from start to finish.

Create a Resource Group

In order to make clean-up easy at the end, start with creating a new resource group to hold the resources for this guided project. Using resource groups to organize things is a quick way to ensure you can manage resources when a project is over.

From the Azure portal home page, in the search box, enter resource groups.
Select Resource groups under services.

Important: Take note of other resource groups that are already created. During clean up, you want to avoid deleting resource groups that were already here. Pay special attention for a resource group called NetworkWatcherRG. If it doesn’t already exist, the NetworkWatcherRG will be created during this guided project and should be deleted at the end. However, if the NetworkWatcherRG already exists prior to starting this project, you should NOT delete it at the end. It may be helpful to take a screenshot of resource groups that exist before you create the group for the guided project.

Select Create.

Note: Your subscription should already be selected. If you have multiple Azure subscriptions associated with this login, select the one you’d like to use for the guided project.

Enter guided-project-rg in the Resource group name field.

The Region field will automatically populate. Leave the default value. Unfortunately the East US would not allow me create a Virtual Machine as there were no availability so I had to use Korea central.
Select Review + create.
Select Create.
Return to the home page of the Azure portal by selecting Home.

Create a Virtual Network with One Subnet

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Create.

Note: The subscription and resource group should automatically fill in. Verify that the information filled in matches the correct subscription and the new resource group created for the guided project (guided-project-rg if you’re following along with the naming conventions).

Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

Create a Virtual Machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select Create and then select Virtual machine.

Note: The subscription should automatically fill in. Verify that the information filled in matches the correct subscription.

Select guided-project-rg for the Resource group.
Enter guided-project-vm for the Virtual machine name.
For the Image, select one of the Ubuntu Server options (For example, Ubuntu Server 24.04 LTS - x64 Gen2).
Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.
Enter guided-project-admin for the admin Username.
Enter a password for the admin account and confirm it.
Leave the rest of the settings as default settings. You can review the settings if you like, but shouldn’t change any.
Select Review + create.
!Review + create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/edwgkwek9f0ygts1j2ck.png)

Note: Once validation has passed, you’ll receive a cost estimate of how much it will cost per hour to run the VM.

Select Create to confirm the resource cost and create the virtual machine.
Select Home to return to the Azure portal home page.

Create a Storage Account

From the Azure portal home page, in the search box, enter storage accounts.
Select Storage accounts under services.
Select Create.

Note: The subscription and resource group should automatically fill in. Verify that the information filled in matches the correct subscription and the new resource group created for the guided project.

Scroll down to the Instance details section and enter a name for the storage account. > Note: Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

Conclusion

By following these steps, you have successfully deployed a foundational set of resources in Azure. You now have a dedicated Resource Group containing a Virtual Network, a Linux-based Virtual Machine, and a Storage Account. Organizing your work this way not only provides a clean environment for your project but also ensures that when you are finished, you can easily remove the resource group to prevent unnecessary costs.

Let's hear your thought

From Terminal to Cloud: A Mac User's Guide to Deploying Linux on Azure cli

Louis Oodo — Fri, 13 Mar 2026 12:18:10 +0000

This comprehensive guide will show you how to transition from a clean macOS terminal to a fully functioning Linux web server in Azure using the Azure CLI. By following these steps, you’ll implement a secure, segmented architecture aligned with cloud best practices.

🏗️ Introduction

Building in the cloud shouldn't require clicking through dozens of portal screens. Using the Azure CLI on your Mac allows for repeatable, scriptable, and professional infrastructure management. In this guide, we will follow the Azure Well-Architected Framework pillars—specifically Security and Operational Excellence—to deploy a virtualized environment.

Below is a Dev.to-style tutorial rewritten in original wording and structured as a step-by-step guide for macOS users. You can paste this directly into a Dev.to article editor.

How to Create Azure Infrastructure Using Azure CLI on macOS (Step-by-Step Guide)

Managing cloud infrastructure from the command line is one of the fastest and most repeatable ways to deploy resources in Microsoft Azure. Instead of manually clicking through the Azure Portal, you can automate the entire process with the Azure CLI.

In this guide, you'll learn how to:

Install the Azure CLI on macOS
Authenticate with your Azure account
Create a Resource Group
Build a Virtual Network and Subnet
Configure a Network Security Group (NSG)
Deploy an Ubuntu Virtual Machine
Install Nginx and verify your web server

By the end, you'll have a working Linux VM running inside your own Azure network and accessible through the internet.

This approach also aligns with Azure Well-Architected Framework best practices, particularly Operational Excellence, by encouraging automation and repeatable infrastructure deployment.

1. Install Azure CLI on macOS

Before interacting with Azure resources from your terminal, you need the Azure Command Line Interface installed locally.

macOS users typically install software using Homebrew, a popular package manager.

Install Azure CLI

brew install azure-cli

This command downloads and installs the Azure CLI along with its dependencies.

Confirm Installation

az --version

If the installation succeeded, the terminal will display the CLI version and installed components.

Running the CLI locally allows you to interact directly with Azure APIs from your machine.

2. Authenticate With Your Azure Account

Next, you must sign in so Azure knows which account and subscription will own the resources you create.

Sign In

az login

Your default browser will open and prompt you to authenticate with your Azure account.

Once authenticated, your terminal session becomes authorized to execute Azure commands.

To confirm my active subscription, I entered 1 as this is my only active subscription.

Check Your Active Subscription

az account show

This command returns details about the currently selected Azure subscription.

Switch Subscription (Optional)

If you have multiple subscriptions:

az account set --subscription "Your Subscription Name"

This ensures all resources created during the lab are billed under the correct account.

From a security standpoint, authentication ensures only authorized users can create or modify cloud infrastructure.

3. Create a Resource Group

In Azure, every resource must exist inside a Resource Group, which acts as a logical container for related services.

Resource groups make it easier to:

Manage permissions
Monitor resources
Delete entire environments at once

Define Variables

To make commands reusable and reduce typos, define variables for the resource group name and location.

RG="azurecli-lab-rg"
LOCATION="eastus"

Using variables allows you to reference the same values throughout your script.

Create the Resource Group

Creates a named resource group in East US. All resources in this lab will be placed here for easy cleanup.

Azure requires every resource to live inside a resource group. They make it easy to manage, monitor, and delete everything together at the end of the lab.

Operational Excellence — grouping related resources together is a best practice for manageability and cost tracking.

az group create --name $RG --location $LOCATION

This command provisions a new resource group in the East US region. Notice also the provisioning state is succeeded.

Verify Creation

You can also verify if it was created by running this command

az group show --name $RG

The output confirms the group exists and displays its configuration.

Organizing infrastructure into groups is a core Operational Excellence practice in Azure.

4. Create a Virtual Network

Most cloud resources require a private network so they can communicate securely.
Here, you will Creates a Virtual Network with a broad 10.0.0.0/16 IP address space.
This is needed VMs and other infrastructure need a secure, isolated private network to communicate with each other.
Security — creating an isolated network boundary is the foundational step of cloud security.

Azure provides this using a Virtual Network (VNet).

Create the VNet

az network vnet create \
--resource-group $RG \
--name lab-vnet \
--address-prefix 10.0.0.0/16 \
--location $LOCATION

This command builds a VNet with an address range of 10.0.0.0/16.

Think of the VNet as your private data center network inside Azure.

Creating isolated networks is an important security boundary in cloud architecture.

5. Create a Subnet

Subnets divide a larger network into smaller segments.

This allows you to separate different resource types and apply specific rules to them.
This Carves out a smaller 10.0.1.0/24 piece (subnet) of the VNet specifically for your VMs.
Segmenting networks allows you to apply different routing and firewall rules to different types of resources.

Create the Subnet

az network vnet subnet create \
--resource-group $RG \
--vnet-name lab-vnet \
--name lab-subnet \
--address-prefix 10.0.1.0/24

Here we allocate a smaller portion of the VNet specifically for our virtual machines.

Network segmentation improves both security and traffic management.

6. Create a Network Security Group

A Network Security Group (NSG) functions as a firewall for Azure resources.

It controls which traffic is allowed or denied.

Without an NSG attached, Microsoft allows no inbound traffic but allows all outbound traffic. We need an NSG to poke specific holes in the firewall.

Security — controlling traffic flow with firewalls is a basic security requirement.

Create the NSG

az network nsg create \
--resource-group $RG \
--name lab-nsg

The NSG will later be attached to the subnet so all resources inside inherit the same security rules.

7. Allow SSH and HTTP Traffic

Adds inbound rules prioritizing SSH (port 22) and HTTP (port 80) access from the internet.

You'll need SSH to log in and configure the server, and HTTP so users can view the web page.

Security — explicitly defining inbound access using the principle of least privilege.

By default, inbound traffic is restricted. We must explicitly allow access for:

SSH (port 22) to manage the server
HTTP (port 80) to serve web traffic

Allow SSH

az network nsg rule create \
--resource-group $RG \
--nsg-name lab-nsg \
--name AllowSSH \
--priority 1000 \
--destination-port-ranges 22 \
--access Allow \
--protocol Tcp \
--direction Inbound

Allow HTTP

az network nsg rule create \
--resource-group $RG \
--nsg-name lab-nsg \
--name AllowHTTP \
--priority 1010 \
--destination-port-ranges 80 \
--access Allow \
--protocol Tcp \
--direction Inbound

These rules define exactly which ports external users may access.

This follows the principle of least privilege, allowing only required traffic.

8. Attach the NSG to the Subnet

To enforce the firewall rules, attach the NSG to the subnet.

Applying the NSG to the subnet ensures that any VM created in that subnet automatically inherits those exact firewall rules — protecting the entire subnet.

Security — subnet-level application of security controls.

az network vnet subnet update \
--resource-group $RG \
--vnet-name lab-vnet \
--name lab-subnet \
--network-security-group lab-nsg

Applying security at the subnet level ensures every VM deployed in the subnet automatically inherits the rules.

9. Allocate a Public IP Address

For external users to reach your virtual machine, it needs a public IP address.
Allocates a static public IP address in Azure.

Without a public IP, the VM can only be accessed internally through the VNet or a VPN. You need this to reach your web server from your browser.

Reliability — using a Static IP ensures the address does not change upon reboot.

Create a Static Public IP

az network public-ip create \
--resource-group $RG \
--name lab-public-ip \
--allocation-method Static \
--sku standard

Using a static IP ensures the address remains the same even if the VM restarts.

Stable IP addresses improve reliability and connectivity.

10. Create the Linux Virtual Machine

Now it's time to deploy the compute instance that will host your application.
Creates a B1s Ubuntu VM with auto-generated SSH keys and connects it to the existing subnet and firewall.

This is the actual cloud compute instance that will run your web application code.

Performance Efficiency — selecting the appropriately sized VM for your workload (B1s for dev/test).

Provision the VM

az vm create \
--resource-group $RG \
--name lab-vm \
--image Ubuntu2204 \
--size Standard_B1s \
--admin-username azureuser \
--generate-ssh-keys \
--vnet-name lab-vnet \
--subnet lab-subnet \
--public-ip-address lab-public-ip \
--nsg lab-nsg

This command:

Deploys an Ubuntu 22.04 server
Uses a B1s VM size suitable for development/testing
Generates SSH keys automatically
Connects the VM to your VNet and firewall

Choosing appropriately sized instances is part of Performance Efficiency in cloud architecture.

11. Retrieve the VM's Public IP

You’ll need the IP address to connect to the server.

Filters the Azure API response to return just the IP address string.

You'll need this IP to SSH into the machine and to test the web application.

Operational Excellence — automated retrieval of resource attributes avoids manual portal lookups.

az network public-ip show \
--resource-group $RG \
--name lab-public-ip \
--query ipAddress \
--output tsv

The command outputs just the IP address for easy copying.

12. Confirm the VM is Running

Before connecting, verify the VM is successfully deployed.

Queries the VM status and displays it in a clean table format.

Always verify provisioning success before attempting connections.

Operational Excellence — verification and monitoring.

az vm show \
--resource-group $RG \
--name lab-vm \
--show-details \
--query '{Name:name, State:powerState, IP:publicIps}' \
--output table

This displays the VM name, power state, and public IP in a readable format.

Always validating infrastructure after provisioning is a key Operational Excellence practice.

13. Connect via SSH and Install Nginx

Now you can access the server remotely.

Log into the VM over the internet via SSH, installs the Nginx package using APT, and starts the service.

A fresh VM is blank. Nginx serves as the web server to test our HTTP port 80 firewall rule.

Operational Excellence — bootstrap scripts or userdata are typically used to automate this step.

Connect to the VM

ssh -i ~/.ssh/id_rsa azureuser@<YOUR_PUBLIC_IP>

Replace <YOUR_PUBLIC_IP> with the IP from the earlier step.

Install Nginx

Once logged in:

sudo apt update && sudo apt install nginx -y

Start and Enable the Web Server

sudo systemctl enable nginx && sudo systemctl start nginx

This installs and launches the Nginx web server.

14. Test the Web Server

From your local machine:

curl http://<YOUR_PUBLIC_IP>

If everything worked correctly, you'll receive the default Nginx HTML response.

You can also open the IP address in your browser to see the web page.

Conclusion

Congratulations! You have successfully used your Mac to orchestrate a professional Azure environment. You’ve installed the tooling, established a secure network boundary with NSG rules, and deployed a functional Ubuntu web server.
Using the Azure CLI is a powerful way to deploy and manage cloud infrastructure without relying on the Azure Portal.

In this guide, you learned how to:

Install and configure the Azure CLI
Authenticate to Azure from your Mac
Create foundational infrastructure including:
- Resource Groups
- Virtual Networks
- Subnets
- Network Security Groups
Deploy an Ubuntu Virtual Machine
Install and test a web server

This CLI-driven workflow is a key step toward Infrastructure as Code, automation, and scalable cloud operations.

Mastering the Azure CLI gives you full control over your cloud environment directly from your terminal.

I would love to hear from you.

how to create azure resources via azure cli

Louis Oodo — Thu, 12 Mar 2026 22:52:30 +0000

This guide provides a comprehensive walkthrough for setting up an Azure environment from your Mac. Whether you are prepping for a certification or building a personal lab, these steps will take you from a blank terminal to a running Linux server.

1. Install Azure CLI & Login

On macOS, the most efficient way to manage the Azure CLI is through Homebrew.

Step-by-Step Installation:

Open Terminal: Press Cmd + Space, type "Terminal," and hit Enter.
Update Homebrew: Ensure your package manager is current.

brew update

Install Azure CLI:

brew install azure-cli

Login to Azure: Run the following command. It will automatically open your default web browser (Safari/Chrome).

az login

Pro Tip: If your browser doesn't open or you are on a remote server, use az login --use-device-code.

Set your Subscription: If you have multiple accounts, list them and select the correct one:

az account list --output table
az account set --subscription "Your-Subscription-Name"

2. Create a Resource Group

A Resource Group (RG) is a logical container. Deleting the RG later will automatically clean up all resources inside it, preventing "ghost" charges on your bill.

Run this command:

az group create --name MyLabGroup --location eastus

--name: The identifier for your group.
--location: Choose a region close to you (e.g., eastus, westeurope, southeastasia).

3. Build a Virtual Network (VNet) & Subnet

Before you can drop a VM into Azure, you need a network. We will create a VNet and a Subnet simultaneously.

Run this command:

az network vnet create \
  --resource-group MyLabGroup \
  --name MyVNet \
  --address-prefix 10.0.0.0/16 \
  --subnet-name MySubnet \
  --subnet-prefix 10.0.1.0/24

10.0.0.0/16: This is your private "building."
10.0.1.0/24: This is a specific "room" (subnet) within that building where your VM will live.

4. Provision a Linux Virtual Machine

Now, let's launch an Ubuntu 22.04 VM. This command handles the compute, creates a Public IP, and secures it with SSH keys.

az vm create \
  --resource-group MyLabGroup \
  --name MyLinuxVM \
  --image Ubuntu2204 \
  --vnet-name MyVNet \
  --subnet MySubnet \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

What's happening here?

--generate-ssh-keys: This is the "Magic Mac" flag. It looks in your ~/.ssh folder for a key; if it doesn't find one, it creates one for you automatically.
--public-ip-sku Standard: Assigns a static-capable IP so you can reach the machine from your laptop.

5. Verify & Connect

Once the command finishes, you will see a JSON output. Look for the publicIpAddress field.

To connect from your Mac:

ssh azureuser@<YOUR_PUBLIC_IP>

If this is your first time connecting, type yes when asked about the authenticity of the host.

Summary of Commands

Action	Command Snippet
Install	`brew install azure-cli`
Login	`az login`
Create Group	`az group create -n <name> -l <location>`
Create Network	`az network vnet create ...`
Create VM	`az vm create ...`

Would you like me to provide a script to automatically shut down or delete these resources so you don't get charged when you're finished with your lab?

Advanced Azure Storage Security: Managed Identities, Key Vaults, and Immutability

Louis Oodo — Thu, 26 Feb 2026 19:59:27 +0000

Advanced Azure Storage Security: Managed Identities, Key Vaults, and Immutability

Introduction

Security is a multi-layered responsibility in the cloud. Beyond simple access keys, enterprise-grade storage requires robust identity management and data protection. In this guide, we will walk through the advanced configuration of an Azure Storage account. We will cover the implementation of User-Assigned Managed Identities, securing data with Customer-Managed Keys (CMK) via Azure Key Vault, and enforcing data integrity using time-based retention policies and infrastructure encryption scopes.

Create the storage account and managed identity

Provide a storage account for the web app.

In the portal, search for and select Storage accounts.
Select + Create.
For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name is unique and meets the naming requirements.
Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.
Select Review + Create.
Wait for the resource to deploy.

Provide a managed identity for the web app to use. Learn more about managed identities.

Search for and select Managed identities.
Select Create.
Select your resource group.
Give your managed identity a name.
Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. Learn more about how to assign Azure roles.

Search for and select your storage account.
Select the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Storage Blob Data Reader role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.
Click Select and then Review + assign the role.
Select Review + assign a second time to add the role assignment.
Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. Learn more about how to provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Administrator role.
On the Members page, select User, group, or service principal.
Select Select members.
Search for and select your user account. Your user account is shown in the top right of the portal.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.
You are now ready to continue with the lab.

Create a key vault to store the access keys.

In the portal, search for and select Key vaults.
Select Create.
Select your resource group.
Provide the name for the key vault. The name must be unique.
Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
Select Review + create.
Wait for the validation checks to complete and then select Create.
After the deployment, select Go to resource.
On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.
In your key vault, in the Objects section, select the Keys blade.
Select Generate/Import and Name the key.
Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. Learn more about how to use a system-assigned managed identity to authorize access

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.
In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.
Select a key vault and key. Select your key vault and key.
Select to confirm your choices.
Ensure the Identity type is User-assigned.
Select an identity.
Select your managed identity then select Add.
Save your changes.
If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator. Learn more about blob immutable storage.

Navigate to your storage account.
In the Data storage section, select the Containers blade.
Create a container called hold. Take the defaults. Be sure to Create the container.
Upload a file to the container.
In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.
For the Policy type, select time-based retention.
Set the Retention period to 5 days.
Be sure to Save your changes.
Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.

The developers require an encryption scope that enables infrastructure encryption. Learn more about infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.
Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.
Create the encryption scope.
Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Conclusion

By implementing these configurations, you have successfully established a highly secure and compliant storage environment. Using User-Assigned Managed Identities removes the risk associated with hard-coded credentials, while Customer-Managed Keys ensure you maintain full control over your data encryption. Furthermore, the use of immutable storage and specialized encryption scopes provides the data integrity required for modern development workflows. This architecture not only protects against external threats but also safeguards your data from accidental modification or deletion.

Deploying Secure Azure File Shares: Premium Performance and Network Security

Louis Oodo — Thu, 26 Feb 2026 10:20:02 +0000

Deploying Secure Azure File Shares: Premium Performance and Network Security

Introduction

Azure Files offers fully managed file shares in the cloud that are accessible via the industry-standard SMB and NFS protocols. For departments like Finance, balancing high performance with strict network security is critical. In this guide, we will walk through deploying a Premium Azure File share, protecting data with snapshots, and restricting access to a specific Virtual Network to ensure enterprise-grade security.

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files. Learn more about storage accounts for Azure Files deployments.

In the portal, search for and select Storage accounts.
Select + Create.
For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name meets the naming requirements.
Set the Performance to Premium.
Set the Premium account type to File shares.
Set the Redundancy to Zone-redundant storage.
Select Review and then Create the storage account.
Wait for the resource to deploy.
Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office. Learn more about Azure File tiers.

In the storage account, in the Data storage section, select the File shares blade.
Select + File share and provide a Name.
Review the other options, but take the defaults.
Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.
Name the new directory finance.
Select Browse and then select the finance directory.
Notice you can Add directory to further organize your file share.
Upload a file of your choosing.

Configure and test snapshots.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots. Learn more about file snapshots.

Select your file share.
In the Operations section, select the Snapshots blade.
Select + Add snapshot. The comment is optional. Select OK.
Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.
Browse to your file directory.
Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.
Select the Snapshots blade and then select your snapshot.
Navigate to the file you want to restore,
Select the file and the select Restore.
Provide a Restored file name.
Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.
Select Create. Select your resource group. and give the virtual network a name.
Take the defaults for other parameters, select Review + create, and then Create.
Wait for the resource to deploy.
Select Go to resource.
In the Settings section, select the Subnets blade.
Select the default subnet.
In the Service endpoints section choose Microsoft.Storage in the Services drop-down.
Do not make any other changes.
Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints.

Return to your files storage account.
In the Security + networking section, select the Networking blade.
Change the Public network access to Enabled from selected virtual networks and IP addresses.
In the Virtual networks section, select Add existing virtual network.
Select your virtual network and subnet, select Add.
Be sure to Save your changes.
Select the Storage browser and navigate to your file share.
Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Conclusion

By completing these steps, you have successfully deployed a high-performance, resilient file storage solution. Using Premium File Shares with Zone-redundant storage (ZRS) ensures low latency and protection against datacenter failures. Furthermore, by implementing Service Endpoints and restricting traffic to a specific Virtual Network, you have significantly reduced the attack surface of your financial data. This layered approach to security and availability represents best practices for managing sensitive departmental data in Azure.

How to Create an EC2 instance in AWS free tier: A Step-by-Step Guide

Louis Oodo — Sat, 21 Feb 2026 15:22:57 +0000

How to Create an EC2 instance in AWS free tier: A Step-by-Step Guide

Deploying a virtual server in the cloud is one of the most essential skills for any developer or IT professional. Amazon Web Services (AWS) provides a robust environment to launch these instances via their EC2 service. In this guide, we will walk through the exact steps to get your Ubuntu server up and running using the AWS Free Tier.

Step-by-Step Instructions

In the search bar of the aws free tier account type EC2.
Select the first EC2
Click the dashboard
Click the orange launch instance button.
Type a name in the name section
Click on add additional tags
In the application and OS images (Amazon machine image) section select ubuntu
In the key pair section Select create new key pair.
Type a name in the enter key pair name section
Click on create key pair
Set everything else as default.
Click on launch instance
Allow to launch successfully.
Click on the connect to instance in the connect to your instance section.
Click on connect at the bottom right

Conclusion

Congratulations! You have successfully navigated the AWS Management Console to launch and connect to your own Ubuntu virtual machine. By following these steps, you have laid the foundation for hosting applications, running scripts, or exploring the vast ecosystem of AWS. Remember to terminate or stop your instances when they are no longer in use to manage your Free Tier limits effectively. Happy cloud computing!

How to Create and Connect to an Azure Virtual Machine: A Beginner's Guide

Louis Oodo — Fri, 20 Feb 2026 14:17:28 +0000

How to Create and Connect to an Azure Virtual Machine: A Beginner's Guide

Introduction

Provisioning a Virtual Machine (VM) is one of the most fundamental tasks in cloud computing. Whether you need a sandbox for development, a host for a web application, or a remote Windows environment, Azure makes the deployment process seamless. In this guide, we will walk through the exact steps to search for, configure, deploy, and connect to your first Azure VM.

3. Search for "Virtual Machines"

In the Search bar, type "Virtual Machines" and click on virtual machine.
You can also find it by clicking the hamburger menu or selecting "Create a Resource" → "Virtual Machine".

4. Select Virtual Machine from the Search Results

Click on "Virtual Machine" from the search results.

5. Click on "Create"

Click "Create" → "Azure Virtual Machine".
Choose "Virtual Machine hosted by Azure".

6. Enter Project Details

Select the appropriate Subscription.
Click "Create Resource Group" → Enter a name for it and click OK.

7. Configure Virtual Machine Details

Enter:

Virtual Machine Name (e.g., MyAzureVM)
Region and select Europe west.
Security type select standard.
Operating System: Select Windows Server Datacenter - x64 G2
VM Size: Keep the default option.
Run with azure spot discount and check box

8. Set Up Administrator Account

Authentication Type: Select Password.
Username: Azureuser
Password: password•••* (Change for security purposes).

9. Configure Inbound Port Rules

Select RDP (for Windows).

10. Accept Licensing Terms

Click the checkbox to accept the license agreement.

11. Disable Boot Diagnostics

Click Next → Navigate to Monitoring Tab → Disable Boot Diagnostics.
Click Tag(a key value pair) add name and value to identify resources

12. Review & Deploy the Virtual Machine

Click "Review + Create".
Ensure validation passes.
Go to resource
Go to the public IP address and click on it
Stretch the idle timeout to 30
click save

14. Check VM Status

If the status is "Running", your VM is ready! 🎉

15. Connect to the Virtual Machine

Click "Connect" in the Azure VM blade.
Click on check VM access

16. Download & Open RDP File (Windows VM Only)

Click "Native RDP" → Download RDP file.
Open the RDP file on your computer.

17. Enter Admin Credentials

Enter the Username & Password created earlier.
Click "Connect" to access the VM.

18. Complete Connection

Follow the prompts & click "Continue" when asked.

19. Wait for Configuration

The remote desktop will be configured in a few seconds.

Conclusion

Congratulations! You have successfully navigated the Azure Portal to deploy and access your own Virtual Machine. By following these steps, you’ve learned how to manage project details, configure security through inbound port rules, and establish a remote connection. As you move forward, remember to stop or delete your VM when it's not in use to manage costs effectively. Happy cloud computing!

Securing Corporate Data: Azure Storage Private Access & Lifecycle Management

Louis Oodo — Fri, 20 Feb 2026 00:25:54 +0000

Securing Corporate Data: Azure Storage Private Access & Lifecycle Management

Introduction

In cloud architecture, managing internal company documents requires a different strategy than public assets. You must prioritize high availability while strictly limiting access to authorized users. This guide covers how to set up a private storage account with Geo-redundant storage (GRS), implement temporary access using Shared Access Signatures (SAS), and optimize costs using automated lifecycle management. By the end, you will also learn how to create an automated backup using Object Replication between storage accounts.

Create a storage account and configure high availability.

Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts.
Select + Create.
Select the Resource group created in the previous lab.
Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
Select Review, and then Create the storage account.
Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Geo-redundant storage (GRS) is selected.
Refresh the page.
Review the primary and secondary location information.
Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults.
Select Create.

For testing, upload a file to the private container. The type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container.
Select Upload.
Browse for files and select a file.
Upload the file.
Select the uploaded file.
On the Overview tab, copy the URL.
Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS). Learn more about Shared Access Signatures.

Select your uploaded blob file and move to the Generate SAS tab.
In the Permissions drop-down, ensure the partner has only Read permissions.
Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.
Copy the Blob SAS URL to a new browser tab.
Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier. Learn more how manage the Azure Blob storage lifecycle.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.
In the Data management section, select the Lifecycle management blade.
Select Add rule.
Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.
Ensure Last modified is selected.
Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
As you have time, review other lifecycle options in the drop-down.
Add the rule.

The public website files need to be backed up to another storage account. Learn more about object replication.

In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.
Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.
In the Data management section, select the Object replication blade.
Select Create replication rules.
Set the Destination storage account to the private storage account.
Set the Source container to public and the Destination container to backup.

Create the replication rule.

Conclusion

By following these steps, you have secured your corporate documents while maintaining a cost-effective and resilient architecture. Implementing GRS ensures your data survives regional incidents, while Private access levels and SAS tokens ensure only authorized parties can view sensitive content. Additionally, with Lifecycle Management and Object Replication in place, your data is now both cost-optimized and backed up automatically. These settings form a professional foundation for enterprise-grade storage management in Azure.

Setting Up Azure Storage for a Public Website: A Step-by-Step Guide

Louis Oodo — Thu, 19 Feb 2026 18:53:18 +0000

Setting Up Azure Storage for a Public Website: A Step-by-Step Guide

Introduction

In Azure cloud architecture, a storage account plays a key role in hosting and protecting application data. For public-facing websites, it’s important to balance accessibility with security. Configuring features like Read-access Geo-redundant storage (RA-GRS), anonymous access, soft delete, and versioning ensures high availability, protection against accidental data loss, and resilience during regional outages.

Create a storage account with high availability. Create a storage account to support the public website.

In the portal, search for and select Storage accounts.
Select + Create.
For resource group select new.Give your resource group a name and select OK.
Set the Storage account name to publicwebsite. Make sure the storage account name is unique by adding an identifier.
Take the defaults for other settings.
Select Review and then Create.
Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region, Learn more about storage account redundancy.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Read-access Geo-redundant storage is selected.
Review the primary and secondary location information.

Create a storage account to support the public website.

Information on the public website should be accessible without requiring customers to login.

In the storage account, in the Settings section, select the Configuration blade.
Ensure the Allow blob anonymous access setting is Enabled.
Be sure to Save your changes.

Create a blob storage container with anonymous read access

The public website has various images and documents. Create a blob storage container for the content. Learn more about storage containers.

In your storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is public.
Select Create.

Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs. Learn more about configuring anonymous public access.

Select your public container.
On the Overview blade, select Change access level.
Ensure the Public access level is Blob (anonymous read access for blobs only).
Select OK.

Practice uploading files and testing access.

For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice.

Ensure you are viewing your container.
Select Upload.
Browse to files and select a file. Browse to a file of your choice.
Select Upload.
Close the upload window, Refresh the page and ensure your file was uploaded.

Determine the URL for your uploaded file. Open a browser and test the URL.

Select your uploaded file.
On the Overview tab, copy the URL.
Paste the URL into a new browser tab.
![URL into a new browser](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e5iig5jx500arz1vqfnc.png.
If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

Configure soft delete

It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days. Learn more about soft delete for blobs.

Go to the Overview blade of the storage account.
On the Properties page, locate the Blob service section.
Select the Blob soft delete setting.
Ensure the Enable soft delete for blobs is checked.
Change the Keep deleted blobs for (in days) setting to 21.
Notice you can also Enable soft delete for containers.
Don’t forget to Save your changes.

If something gets deleted, you need to practice using soft delete to restore the files.

Navigate to your container where you uploaded a file.
Select the file you uploaded and then select Delete.
Select delete to confirm deleting the file.
On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.
Select your deleted file, and use the ellipses on the far right, to Undelete the file.
Refresh the container and confirm the file has been restored.

Configure blob versioning

It’s important to keep track of the different website product document versions. Learn more about blob versioning.

Go to the Overview blade of the storage account.
In the Properties section, locate the Blob service section.
Select the Versioning setting.
Ensure the Enable versioning for blobs checkbox is checked.
Notice your options to keep all versions or delete versions after.
Don’t forget to Save your changes.

As you have time experiment with restoring previous blob versions.

Upload another version of your container file. This overwrites your existing file.
Your previous file version is listed on Show deleted blobs page.

Conclusion

By enabling RA-GRS along with soft delete and blob versioning, you create a storage solution that is both highly available and protected from human error. While anonymous access supports public content delivery, it should be carefully managed to expose only intended assets. With these settings, your Azure Storage account is well-prepared to deliver reliable, globally accessible content.