DEV Community: Samuel Ojo

How to deploy scalable web apps with Azure App service

Samuel Ojo — Fri, 30 Jan 2026 01:41:13 +0000

Introduction

Deploying web applications shouldn’t feel complicated or overwhelming. Azure App Service simplifies the process by providing a fully managed platform where you can build, deploy, and scale applications without worrying about the underlying infrastructure.

In this lab, you’ll learn how to create an Azure App Service from scratch and deploy your application using the Azure Portal. Whether you’re new to Azure or looking for a clean deployment workflow, this walkthrough will help you get a production-ready app up and running quickly.

Key Terms

Azure Portal
The web-based management interface for Azure that allows you to create, configure, and monitor cloud resources.

Azure App Service
A Platform as a Service (PaaS) offering that enables you to host web apps, REST APIs, and backend services with built-in scaling, security, and monitoring.

Resource Group
A logical container in Azure that holds related resources (such as App Services, databases, and storage accounts) for easier management and lifecycle control.

App Service Plan
Defines the compute resources (CPU, memory, pricing tier) used by one or more App Services. Scaling an app is done by adjusting the plan.

Runtime Stack
The programming language and framework used by your application, such as .NET, Node.js, Python, or Java.

Deployment Center
An Azure feature that simplifies continuous deployment by connecting your App Service to source control systems like GitHub or Azure Repos.

1.Login to your azure portal: Sign in to the Azure Portal using your Azure account.

Type App Services in the search bar of your Azure portal and select App Services from the options it displays

2.Click + create and select Web App.

3.In the Project details, create a Resource group.

4.In your Instance details, choose the web name, Runtime stack .Net 10 (LTS), publish (we choose Code), region - (Canada Central). Then Click Review + create

5.Click create.

6.Wait for the deployment to complete, then click Go to resource.

7.This is the App we just created. Now, click the default domain link

8.This shows we have created an App but it is still empty which is why it shows Your Web App is running and waiting for your content

9.The App we created is empty at the moment, and we need to fill it up. Now, type a prompt to ChatGPT to generate a code for any type of application you intend to build. In this article, we are building a Game App called "Dodge App". So this is the prompt we are using "Create for me an HTML/CSS/JS code for a game called “Dodge App” (dodge falling blocks, survive as long as possible)".

10.When it finishes, copy the code

11.In the search bar of the Web App, search for Advanced Tools, select it and then click Go.

12.Click Debug console and select powershell.

13.Click site.

14.Click wwwroot.

15.Click edit (pencil icon).

16.Now, remove anything you see on this page and replace it with the code you copied from chatGPT

17.Click Save.

18.Go back to Azure portal, click Home and select App Services.

19.Click the App you created

20.Click the default domain link of the App you created

21.This is the Dodge App we created from Azure App Services

Conclusion
Azure App Service offers a straightforward and reliable way to deploy web applications without managing servers or infrastructure. By combining easy resource creation, multiple deployment options, and built-in monitoring, it allows developers to focus on writing code rather than maintaining environments.

Once your app is deployed, you can enhance it further by enabling logging, configuring custom domains, setting up CI/CD pipelines, or scaling based on demand. Azure App Service is a solid foundation for both small projects and enterprise-grade applications.

Thanks for reading, see you in the next one

Deploy and configure Azure Monitor

Samuel Ojo — Thu, 08 Jan 2026 01:37:59 +0000

Azure Monitor Series

Ever wondered how to keep your Azure resources healthy and your applications running smoothly? Azure Monitor is the ultimate observability solution for the cloud. With real-time metrics, logs, and intelligent alerts, Azure Monitor empowers you to detect issues before they impact users and optimize performance effortlessly. In this guide, we’ll walk through how to deploy and configure Azure Monitor step by step, so you can gain full visibility into your cloud environment.

Prepare your bring-your-own-subscription (BYOS)
This set of lab exercises assumes that you have global administrator permissions to an Azure subscription.

[!NOTE] This set of exercises assumes that you choose to deploy in the East US Region, but you can change this to another region if you choose. Just remember that each time you see East US mentioned in these instructions you will need to substitute the region you have chosen.

In the Azure Portal Search Bar, enter Resource Groups and select Resource groups from the list of results.

On the Resource Groups page, select Create.

On the Create a Resource Group page, select your subscription and enter the name rg-alpha. Set the region to East US, choose Review + Create, and then choose Create.

Create App Log Examiners security group
In this exercise, you create an Entra ID security group.

1.In the Azure Portal Search Bar, enter Azure Active Directory (or Entra ID) from the list of results.

2.On the Default Directory page, select Groups.

3.On the Groups page, choose New Group.
4.On the New Group page, provide the values in the following table and choose Create.
Property - Value
Group type - Security
Group name - App Log Examiners
Group description - App Log Examiners

Deploy and configure WS-VM1
In this exercise, you deploy and configure a Windows Server virtual machine.

1.In the Azure Portal Search Bar, enter Virtual Machines and select Virtual Machines from the list of results.

2.On the Virtual Machines page, choose Create and select Azure Virtual Machine.

3.On the Basics page of the Create A Virtual Machine wizard, select the following settings and then choose Review + Create.

4.Review the settings and select Create.

5.Wait for the deployment to complete. Once deployment completes choose Go to resource.

6.On the WS-VM1 properties page, choose Networking.
7.On the Networking page, select the RDP rule.
8.On the RDP rule space, change the Source to My IP address and choose Save.

This restricts incoming RDP connections to the IP address you’re currently using.

9.On the Networking page, choose Add inbound port rule.

10.On the Add inbound security rule page, configure the following settings and choose Add.

11.On the WS-VM1 page, choose Connect.

12.Under Native RDP, choose Select.
13.On the Native RDP page, choose Download RDP file and then open the file. Opening the RDP file opens the Remote Desktop Connection dialog box.

14.On the Windows Security dialog box, choose More Choices and then choose Use a different account.
15.Enter the username as .\prime and the password as the secure password you chose in Step 3, and choose OK.

16.When signed into the Windows Server virtual machine, right-click on the Start hint and then choose Windows PowerShell (Admin).

17.At the elevated command prompt, type the following command and press Enter. Install-WindowsFeature Web-Server -IncludeAllSubFeature -IncludeManagementTools

18.When the installation completes run the following command to change to the web server root directory. cd c:\inetpub\wwwroot\

19.Run the following command. Wget https://raw.githubusercontent.com/Azure-Samples/html-docs-hello-world/master/index.html -OutFile index.html

Deploy and configure LX-VM2
In this exercise you deploy and configure a Linux virtual machine.

1.In the Azure Portal Search Bar, enter Virtual Machines and select Virtual Machines from the list of results.

2.On the Virtual Machines page, choose Create and select Azure Virtual Machine.

3.On the Basics page of the Create A Virtual Machine wizard, select the following settings and then choose Review + Create.

4.Review the information and choose Create.

5.After the VM deploys, open the VM properties page and choose Extensions + Applications under Settings.

6.Choose Add and select the Network Watcher Agent for Linux. Choose Next and then choose Review and Create. Choose Create.

!Network Watcher Agent for Linux](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jye9v2wnihybvfsmbk8s.png)

[!NOTE] The installation and configuration of the OmsAgentForLinux extension will be performed in Exercise 2 after the Log Analytics workspace is created.

Deploy a web app with an SQL Database
1.Ensure that you’re signed into the Azure Portal.

2.In your browser, open a new browser tab and navigate to https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.web/web-app-sql-database

3.On the GitHub page, choose Deploy to Azure.

4.A new tab opens. If necessary, re-sign into Azure with the account that has Global Administrator privileges.
5.On the Basics page, select Edit template.

6.In the template editor, delete the contents of lines 158 to 174 inclusive and delete the “,” on line 157. Choose Save.

7.On the Basics page, provide the following information and choose Next.

8.Review the information presented and select Create.

9.After the deployment completes, choose Go to resource group.

Deploy a Linux web app
1.Ensure that you’re signed into the Azure Portal.
2.In your browser, open a new browser tab and navigate to https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/webapp-basic-linux/

3.On the GitHub page, choose Deploy to Azure.

4.On the Basics page, provide the following information and choose Next.

5.Review the information and choose Create.

This marks the end of Prepare your bring-your-own-subscription (BYOS)

Next>>>
Exercise 1: Deploy Log Analytics

Skilling tasks

Create a Log Analytics workspace
Configure Log Analytics data retention and archive policies
Enable access to a Log Analytics workspace

Exercise instructions

Create a Log Analytics workspace

1.In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.

2.On the Log Analytics workspaces page, choose Create.

3.On the Basics page of the Create Log Analytics workspace wizard, provide the following information and choose Review + Create.

4.Review the information and choose Create.

Install and configure the Log Analytics agent on Linux-VM2

1.In the Azure Portal Search Bar, enter Virtual Machines and select Virtual Machines from the list of results.
2.On the Virtual Machines page, select Linux-VM2.
3.On the Linux-VM2 page, choose Extensions + Applications under Settings.

4.Choose Add and select the Log Analytics agent for Linux (also known as OmsAgentForLinux). Choose Next.
5.For the Workspace ID and Workspace Key, navigate to LogAnalytics1 > Settings > Agents in a separate browser tab or window.
6.Copy the Workspace ID and Primary Key from the LogAnalytics1 workspace.
7.Return to the Linux-VM2 extension installation page and paste the Workspace ID and Workspace Key. Choose Review and Create, and then choose Create.
8.After the installation completes, on the Linux-VM2 Extensions + Applications page, select the AzureNetworkWatcherExtension.
9.On the extension details page, ensure that Enable automatic upgrade is set to Yes. If not, enable it and choose Save.
10.Return to the Extensions + Applications page and select the OmsAgentForLinux extension.
11.On the extension details page, ensure that Enable automatic upgrade is set to Yes. If not, enable it and choose Save.

[!NOTE] No 4 - 11 is currently not available on Azure Portal, I Could only see Network Watcher Agent for Linux.

Configure Log Analytics data retention and archive policies

1.In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.
2.On the Log Analytics workspaces page, choose LogAnalytics1.

3.On the Log Analytics workspace page for LogAnalytics1, choose Usage and estimated costs.

4.Select Data Retention and set the slider to 60 days. Choose OK.

5.On the Log Analytics workspace page for LogAnalytics1, choose Usage and estimated costs.

6.Select Daily cap. Choose On. Set the daily cap to 10 GB and choose OK.

Enable access to a **Log Analytics workspace**

1.In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.

2.On the Log Analytics workspaces page, choose LogAnalytics1.

3.Select Access control (IAM).

4.Choose Add and then choose Add role assignment.

5.On the list of roles, select Log Analytics Reader and choose Next.

6.On the Members page, choose Select Members and choose the App Log Examiners security group. Choose Select.

7.On the Members space, choose Review + Assign.

Next>>>
Exercise 2: Monitor web apps

Skilling tasks

Enable Application Insights
Disable logging for .NET core snapshot debugger
Configure web app HTTP logs to be written to a Log Analytics workspace
Configure SQL Insights data to be written to a Log Analytics workspace
Enable file and configuration change tracking for web apps

Exercise instructions

Enable Application Insights

4.On the Application Insights page, choose Turn On Application Insights.

5.On the Application Insights page, ensure that Create a new resource is selected and that the Log Analytics Workspace is set to LogAnalytics1 and choose Apply.
6.On the Apply monitoring settings dialog, choose Yes.

Disable logging for .NET core snapshot debugger

1.In the Azure Portal Search Bar, enter rg-alpha and select rg-alpha from the list of results.
2.From the list of items in the resource group, choose App Services for the Web App with an SQL Database.
3.Under Monitoring choose Application Insights**.
4.Under **Instrument your application, choose .NET Core and then set the Snapshot Debugger setting to Off. Choose Apply.
5.On the Apply Monitoring Settings dialog box, choose Yes.

.NET Core settings seem not to be available for the version of Azure Portal

Configure web app HTTP logs to be written to a Log Analytics workspace

4.On the Diagnostic settings page, select + Add diagnostic settings.

5.On the Diagnostic settings page, choose the following and select Save.

Configure SQL Insights data to be written to a Log Analytics workspace

1.In the Azure Portal Search Bar, enter rg-alpha and select rg-alpha from the list of results.
2.From the list of items in the resource group, choose the sample SQL database.
3.Under Monitoring, choose Diagnostic settings.
4.On the Diagnostic settings page, choose Add diagnostic setting.

5.On the Diagnostic setting page, provide the following information and choose Save.

Next>>>

Exercise 3: Monitoring compute and networking services.

Skilling tasks

Create a data collection endpoint
Create a data collection rule
Add an IIS log collection to an existing data collection rule
Configure Network Connection Monitor for a Linux IaaS virtual machine

Exercise instructions

Create a data collection endpoint

1.In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.

2.In the Monitor page, under Settings, choose Data Collection Endpoints.
3.On the Data Collection Endpoints page, choose Create.

4.On the Create Data Collection Endpoint page, provide the following settings and then choose Review + Create.

5.Review the settings and choose Create.

Create a data collection rule

1.In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.
2.In the Monitor page, under Settings, choose Data Collection Rules.
3.On the Data Collection Rules page, choose Create.

4.On the Create Data Collection Rule page, configure the following settings and choose Next.

5.On the Resources page, choose Add Resources.
6.On the Select a scope page, enable the WS-VM1 checkbox and choose Apply.
7.On the Create Data Collection Rule page, choose Next.

8.On the Collect and Deliver page, choose Add data source.
9.On the Add data source page, select Windows Event Logs. In the Application category enable the Critical and Error categories. In the Security category, choose the Audit Failure category. In the System category, enable the Critical and Error categories.
10.Choose Next.

11.On the Destination page, configure the following settings:

12.Choose Add data source.

13.Choose Review + Create and then choose Create.

Add an IIS log collection to an existing data collection rule

4.Under Configuration, choose Data Sources.
5.On the Data Sources page, choose Add.
6.On the Add Data Source page, select IIS Logs.
7.Choose Next.

8.On the Destination page, configure the following settings:

9.Choose Add data source.

Configure Network Connection Monitor for a Linux IaaS virtual machine

1.In the Azure Portal Search Bar, enter Network Watcher and select Network Watcher from the list of results.

2.Under Monitoring, choose Connection Monitor.
3.On the Connection Monitor page, choose Create.

4.On the Basics page of the Create Connection Monitor wizard, provide the following information and choose Next.

5.On the Add test group details page, enter the name LinuxIPTest and choose Add sources.

6.On the Add Sources page, select Azure Endpoints and set the type to Virtual machines. Select Subnet and then enable the Linux-VM checkbox. Choose Add Endpoints.

7.Choose Add Test Configuration.

8.On the Add Test Configuration page, enter the name DefaultHTTP and then choose Add Test Configuration.

9.Choose Add Destinations. Select Azure Endpoints and set the type to Virtual machines. Select Subnet and then enable the WS-VM1 checkbox. Select Add Endpoints.

10.Choose Add Test Group.

11.Choose Review and Create and then choose Create.

Next>>>

Exercise 4: Configuring alerts

Skilling tasks

Create an action group to send an email
Create an alert for virtual machine CPU utilization

Exercise instructions

Create an action group to send an email

1.In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.
2.Select Alerts in the navigation menu.
3.Choose Action Groups.

4.On the Action Groups page, choose Create.

5.On the Basics page of the Create Action Group wizard, configure the following settings and choose Next.

6.On the Notifications page, set the notification type to Email/SMS message/Push/Voice and the Name to NotificationEmail. Choose the Edit (pencil) icon.
7.On the Email/SMS message/Push/Voice enable the email checkbox and enter the address prime@fabrikam.com. Choose OK.

8.Choose Review and Create. Choose Create.

Create an alert for virtual machine CPU utilization

1.In the Azure Portal Search Bar, enter rg-alpha and select rg-alpha from the list of results.
2.From the list of items in the resource group, choose Linux-VM2.
3.On the Linux-VM2 properties page, choose Alerts under Monitoring.
4.On the Alerts page, choose Create and then choose Alert rule.

5.On the Condition page of the Create an Alert Rule wizard, set the Signal name to Percentage CPU. Use the default settings and choose Next.

6.On the Actions page, choose Select Action Group.
7.On the Select Action Groups page, choose NotifyCPU and choose Select.

8.On the Details page enter the Alert rule name HighCPU. Choose Review and Create and then choose Create.

Clean up subscription
To clean up the subscription, delete resource group rg-alpha and delete the App Log Examiners security group.

Conclusion

Azure Monitor isn’t just a tool, it’s your cloud’s command center. By deploying and configuring it properly, you unlock actionable insights, proactive alerts, and performance optimization that keep your applications resilient and your users happy. Ready to take your monitoring game to the next level? Start implementing Azure Monitor today and experience the power of intelligent observability.

Thanks for reading, see you in the next one

How to Deploy Your Web App with AWS Elastic Beanstalk

Samuel Ojo — Wed, 07 Jan 2026 23:30:19 +0000

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) that simplifies application deployment and management. It automatically handles capacity provisioning, allowing developers to focus on writing code rather than managing infrastructure.
You simply provide your code while Beanstalk handles:

EC2 instances
Load Balancing & Auto Scaling
Application health checks
Logs & Metrics
Rolling updates and blue/green deployments

Supported platforms include: Java, .NET, Node.js, Python, PHP, Ruby, Go, Docker.

Key benefits:

Scalability
Automation
Integration with AWS services

Step 1: Sign in to the AWS Management Console

Go to the AWS Management Console and sign in with your AWS account.
Navigate to Elastic Beanstalk
- In the AWS search bar, type Elastic Beanstalk
- Select Elastic Beanstalk from the services list

Step 2: Create a New Application

Click Create application
Enter an Application name (for example: getting-started-app)
(Optional) Add a description

Step 3: Choose Your Platform

Under Platform, select the programming language your app uses
Examples:
- Node.js, Java, Python, PHP, .NET, Ruby, etc.
For me, its Node.js. Choose the platform version (you can leave the default)

Step 4: Upload Your Application Code

Under Application code, choose:
- Sample application (recommended for first-time users),

Upload your code (if you already have an app)
- If uploading your code, select your file (ZIP format)

Step 5: Configure Application Settings (Service Role, Instance Profile, and Key Pair)

Configure security and access settings so Elastic Beanstalk can manage AWS resources so you can securely access your EC2 instances.

5.1: Configure the Elastic Beanstalk Service Role
The service role allows Elastic Beanstalk to interact with other AWS services on your behalf.

Configure service access
Next, you need two roles:

Service role
EC2 instance profile role

A service role allows Elastic Beanstalk to monitor your EC2 instances and upgrade your environment’s platform.
An EC2 instance profile role permits tasks such as writing logs and interacting with other services.

Create Service role
If you have previously created a Service role and would like to choose an existing one, select the value from the Service role drop-down. If not, proceed to create a new one.

For Service role, choose Create role.

For Trusted entity type, choose AWS service and leave the rest as default.

Verify that Permissions policies include the following, then choose Next:

Click Create role.

Return to the Configure service access tab, refresh the list, then select the newly created service role.

5.2 Create EC2 instance profile
The E*C2 instance profile* allows EC2 instances in your environment to access AWS services securely.
You can choose an existing one from the EC2 instance profile drop-down or create a new one.

Select Create role.

For Trusted entity type, choose AWS service and leave the rest as default and click Next.

Verify that Permissions policies include the following, then click Next.

Select Create role.

Return to the Configure service access tab, refresh the list, then select the newly created EC2 instance profile.

Now you need to configure and create your application

5.3: Select a Key Pair

A key pair allows you to securely connect to the EC2 instances created by Elastic Beanstalk.

Under EC2 key pair: Select an existing key pair, or Click Create a new key pair. I do have an existing key pair, but i will create a new one for the sake of this tutorial.

To create key pair, open your AWS console in another tab, type key pairs in the search bar and select key pairs.

Enter a key pair name

Ensure you Download and store the key file securely

Without a key pair, you will not be able to connect to the EC2 instance using SSH.

Optional steps: networking, databases, scaling parameters, advanced configuration for updates, monitoring, and logging.

On the Review page, which shows a summary of your choices, select Submit.

5.4: Review Other Settings (Optional)
You can either keep the default settings or adjust them if needed:

- Instance type (EC2 size)
- Auto scaling options
- Environment variables
- Security groups

Click Create.

Step 6: Creating the Environment for the application
AWS will automatically set up the required resources, including:

EC2 instances
Auto Scaling group
Load balancer
Monitoring and health checks

Please note that This process may take a few minutes. Once completed, your application will be live.

Evidence of Beanstalk being LIVE

To access the EC2 created
On the AWS Console, search for EC2

Check the dashboard to confirm the instance status is running

Select the App created and then connect.

The EC2 instance created while setting up the Elastic Beanstalk is shown below:

S3 Bucket created

Auto Scaling group created

Step 7: Cleaning up your Elastic Beanstalk environment and Terminate the Application

Terminate the environment when you’re done in order to stop billing.
To delete the application and all associated resources, ensure you delete all application versions.
Open the Elastic Beanstalk console, and in the Regions list, select your AWS Region.
In the navigation pane, choose Applications, and then choose your app (the name you gave your app) and choose Application versions.
On the Application versions page, select all application versions that you want to delete. Choose Actions, and then choose Delete.
Turn on Delete versions from Amazon S3. Choose Delete, and then choose Done.

Conclusion

AWS Elastic Beanstalk is an excellent choice for developers who want to deploy applications quickly without managing servers manually. It provides a balance between control and automation, making it ideal for small projects and enterprise applications alike. By leveraging Elastic Beanstalk, you can focus on building great software while AWS handles the heavy lifting of infrastructure management.

Ensure you continue building, learning and developing as many applications as possible :).

Thanks for reading, see you in the next one.

How to Launch an EC2 Instance in AWS

Samuel Ojo — Sat, 20 Dec 2025 18:10:55 +0000

Amazon EC2 (Elastic Compute Cloud) lets you spin up virtual servers in minutes. If you're new to AWS or just need a quick refresher, this guide walks you through the exact steps to launch your first EC2 instance with screenshots from the AWS console to make things even clearer.

Key Terms You Should Know:
Amazon EC2: A web service that provides resizable virtual servers in the cloud. You can run applications, host websites, or experiment with development environments without managing physical hardware.

Instance: A virtual machine running on AWS. It has its own CPU, memory, storage, and network configuration.

AMI (Amazon Machine Image): A preconfigured template used to launch an EC2 instance. It includes the operating system and optional software packages.

Instance Type: Defines the hardware resources for your instance — CPU, RAM, network performance, etc.
Examples: t2.micro, t3.medium, m5.large.

VPC (Virtual Private Cloud): A logically isolated network within AWS where your resources live. You control IP ranges, routing, and security.

Subnet: A segment of your VPC. Instances must be launched inside a subnet, which can be public (internet‑accessible) or private.

Security Group: A virtual firewall that controls inbound and outbound traffic for your instance.
Example: Allowing SSH on port 22.

Key Pair: A cryptographic key used to securely connect to your EC2 instance.
You download the private key (.pem file) and AWS stores the public key.

EBS (Elastic Block Store): Persistent storage attached to your EC2 instance. It behaves like a virtual hard drive.

Public IP Address: An internet‑reachable IP assigned to your instance. You use it to SSH or access hosted applications.

IAM (Identity and Access Management): AWS service for managing users, roles, and permissions. Controls who can access what.

Free Tier: This is AWS limited free usage offering for new accounts. Includes 750 hours/month of t2.micro or t3.micro EC2 usage.

Steps:
1.Open your AWS Console and type EC2 to the search bar and select the first option from the list of the options it displays.

2.Click launch instance.

3.In the Launch Instance Environment, in the name bar, type in a name and click Add additional tags.

4.In the Name and Tag Section, for the Key info and value info Bar, type in while for the Resource Types, click the drop-down arrow and select Instances.

6.In the Application and OS Images (Amazon Machine Images), select any of the Operating systems you want, though I will choose Windows Microsoft.

5.In the Key Pair (Login) section, click Create new key pair and fill in the necessary information on the new bar that pops up

7.In the Network Setting Section, tick the Allow RDP traffic from and Allow HTTP traffic from the Internet

8.Click Launch Instance.

9.Successfully initiated launch of instance will be displayed on your screen

10.Click Connect to Instance.

11.In the Connect Environment, click the RDP Client Tab

12.Scroll down and click get password and then Click upload private key file and select the key pair you downloaded

13.Click Decrypt Password.

Copy the password to your clipboard because it will be needed.

14.Click the download remote desktop file and copy the password.

15.In the Connection security environment, click Connect.

16.Insert the copied password into the security environment, click OK, and click Yes for the subsequent pop-up. The EC2 instance is then up and running.

Conclusion
Launching an EC2 instance is one of the foundational skills in AWS. Once you understand AMIs, instance types, key pairs, and security groups, the rest of the AWS ecosystem becomes much easier to navigate. With your instance now running, you can deploy apps, host websites, run scripts, or explore more advanced AWS services.

Thanks for reading, see you in the next one

Update and maintain azure resources

Samuel Ojo — Mon, 01 Dec 2025 02:59:02 +0000

Lab overview
In this guided lab, you perform a series of tasks and actions to manage Microsoft Azure resources. You have the opportunity to modify a network, move a virtual machine between subnets, manage access to storage containers and file shares, and work with resource locks and resource tags.

During the setup, you create a virtual network, a virtual machine, a storage account, and associated resources.

Learning objectives
In this module, you'll practice how to:

Update a virtual network and subnet.
Manage virtual machines.
Control storage access.
Manage resource tags and locks.
Clean up

First, we prepare the environment:

Login to Microsoft Azure

Create a resource group
In order to make clean-up easy at the end, start with creating a new resource group to hold the resources for this guided project.
Using resource groups to organize things is a quick way to ensure you can manage resources when a project is over.

1.From the Azure portal home page, in the search box, enter resource groups.
2.Select Resource groups under services.

3.Select Create

4.Enter guided-project-rg in the Resource group name field.
5.The Region field will automatically populate. Leave the default value.

6.Select Review + create.
7.Select Create.

8.Return to the home page of the Azure portal by selecting Home.

Create a virtual network with one subnet
1.From the Azure portal home page, in the search box, enter virtual networks.
2.Select virtual networks under services.

3.Select Create.

4.Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.

5.Select Review + create.

6.Select Create.
7.Wait for the screen to refresh and show Your deployment is complete.

8.Select Home to return to the Azure portal home page.

Create a virtual machine
1.From the Azure portal home page, in the search box, enter virtual machines.
2.Select virtual machines under services.

3.Select Create and then select Virtual machine.

4.Select guided-project-rg for the Resource group.
5.Enter guided-project-vm for the Virtual machine name.
6.For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)
7.Continue further on the Basics page to the Administrator account section.
8.Select Password for authentication type.
9.Enter guided-project-admin for the admin Username.
10.Enter a password for the admin account.
11.Confirm the password for the admin account.
12.Leave the rest of the settings as default settings. You can review the settings if you like, but shouldn’t change any.

Select Review + create. 14.Select Create to confirm the resource cost and create the virtual machine. 15.Select Home to return to the Azure portal home page.

Create a Storage account
1.From the Azure portal home page, in the search box, enter storage accounts.
2.Select Storage accounts under services.

3.Select Create.
4.Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.
5.Select Review + create.

6.Select Create.
7.Wait for the screen to refresh and show Your deployment is complete.
8.Select Home to return to the Azure portal home page.

Exercise – Update the virtual network
Scenario
You’re helping an Azure Admin maintain resources. While you won’t be responsible for maintaining the entire infrastructure, the Admin will ask you to help out by completing certain tasks. Currently, there’s a Linux virtual machine (VM) that’s underutilized, and a need for a new Linux machine to serve as an FTP server. However, the Azure admin wants to be able to track network flow and resource utilization for the needed FTP server, so has asked you to start out by provisioning a new subnet. The current subnet should be left alone, as there are future plans for using it for additional VMs.

Create a new subnet on an existing virtual network (vNet)
1.Login to Microsoft Azure at https://portal.azure.com
2.From the Azure portal home page, in the search box, enter virtual networks.
3.Select virtual networks under services.
4.Select the guided-project-vnet virtual network.

5.From the guided-project-vnet blade, under settings, select Subnets.

6.To add a subnet, select + Subnet.

7.For Subnet purpose leave it as Default.
8.For Name enter: `ftpSubnet`.
9.Leave the rest of the settings alone and select Add.

10.Select Home to return to the Azure portal home page.

Create a network security group
1.From the Azure portal home page, in the search box, enter virtual networks.
2.Select virtual networks under services.
3.Select Network security groups.

4.Select + Create.

5.Verify the subscription is correct.
6.Select the guided-project-rg resource group.
7.Enter ftpNSG for the network security group name.
8.Select Review + create.

1.Once the validation is complete, select Create.
2.Wait for the screen to refresh and display Your deployment is complete.
3.Select Go to resource.

Create an inbound security rule
1.Under settings, select Inbound security rules.
2.Select + Add.
3.Change the Destination port ranges from 8080 to 22.
4.Select TCP for the protocol.
5.Set the name to ftpInbound.
6.Select Add.
7.Select Home to return to the Azure portal home page.

Move the virtual machine network to the new subnet
1.Login to Microsoft Azure at https://portal.azure.com
2.From the Azure portal home page, in the search box, enter virtual machines.
3.Select virtual machines under services.
4.Select the guided-project-vm virtual machine.

5.If the virtual machine is running, select Stop.
6.Wait for the Status field to update and show Stopped (deallocated).
7.Within the Networking subsection of the menu, select Network settings.
8.Select the Network interface / IP configuration hyperlink for the VM.

9.On the IP Configurations page, update the Subnet to ftpSubnet.
10.Select Apply.

11.Select Home to return to the Azure portal home page.

Vertically scale the virtual machine
1.From the Azure portal home page, in the search box, enter virtual machines.
2.Select virtual machines under services.
3.Select the guided-project-vm virtual machine.
4.Locate the Availability + scale submenu and select Size.

5.Select a new VM size D2s_v5 for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)
6.Select Resize.

7.Select Home to return to the Azure portal home page.

Attach data disks to a virtual machine
1.From the Azure portal home page, in the search box, enter virtual machines.
2.Select virtual machines under services.
3.Select the guided-project-vm virtual machine.
4.Locate the settings submenu and select Disks.

5.Select Create and attach a new disk.
6.Leave LUN as default.
7.Enter ftp-data-disk for the Disk name.
8.Leave the Storage type as default.
9.Enter 20 for the Size.
10.Select Apply to create the new storage disk and attach the disk to the machine.

11.Select Home to return to the Azure portal home page.

Nice! Now the VM has enough storage to handle some uploads.

Configure automatic shutdown on a virtual machine
1.From the Azure portal home page, in the search box, enter virtual machines.
2.Select virtual machines under services.
3.Select the guided-project-vm virtual machine.
4.Under the Operations submenu, select Auto-shutdown.

5.In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.
6.Select Save.

7.Select Home to return to the Azure portal home page.

Congratulations! You’ve successfully completed all of the management tasks the Azure admin needed a hand with for the virtual machine.

Exercise – Control storage access
In this lab, you’ll complete several tasks related to managing a storage account and components of the storage account.

Scenario
The Azure admin wants you to get more familiar with storage accounts, containers, and file shares. They anticipate needing to share an increasing number of files and need someone who is skilled using these services. They’ve given you a task of creating a storage container and a file share and uploading files to both locations.

Create a storage container
1.Login to Microsoft Azure at https://portal.azure.com
2.From the Azure portal home page, in the search box, enter storage accounts.
3.Select storage accounts under services.

Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)

5.On the storage account blade, under the Data storage submenu, select Containers.
6.Select + Add container.

7.In the Name field, enter storage-container.
5.Select Create.

Great! With a storage container created, you can upload a blob to the container. Locate a picture that you can upload, either on your computer or from the internet, and save it locally to make uploading easier.

Upload a file to the storage container
1.Select the storage container you just created.

2.Select Upload and upload the file you prepared.

3.Once the file is ready for upload, select Upload.

With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file.

Change the access tier
1.Select the file you just uploaded (the file name is a hyperlink).
2.Select Change tier.

3.Select Cold.
4.Select Save.

5.Select Home to return to the Azure portal home page.

Good job! You’ve successfully uploaded a storage blob and changed the access tier from Hot to Cold. Next, you’ll work with file shares.

Create a file share
1.From the Azure portal home page, in the search box, enter storage accounts.
2.Select storage accounts under services.
3.Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)
4.On the storage account blade, under the Data storage submenu, select File shares.
5.Select + File share.

6.On the Basics tab, in the name field enter file-share.

7.On the Backup tab, uncheck Enable backup.

8.Select Review + create.
9.Select Create.

10.Once the file share is created, select Upload.
11.Upload the same file you uploaded to the blob storage or a different file, it’s up to you.

12.Select Home to return to the Azure portal home page.

The next piece of the puzzle is figuring one way to control access to the files that have been uploaded. Azure has many ways to control files, including things like role-based access control. In this scenario, the Azure admin wants you to use shared access tokens or keys.

Create a shared access signature token
1.From the Azure portal home page, in the search box, enter storage accounts.
2.Select storage accounts under services.
3.Select the storage account you created in the Prepare exercise.
4.On the storage account blade, select Storage browser.
5.Expand Blob containers.

Note: Blob container is another name for the storage containers. Items uploaded to a storage container are called blobs.

6.Select the storage container you created earlier, storage-container.

7.Select the ellipses (three dots) on the end of the line for the image you uploaded.

8.Select Generate SAS.
9.Set Signing method to Account key.
10.Set Signing key to Key 1
11.Set Stored access policy to None.
12.Set Permissions to Read.
13.Enter a custom start and expiry time or leave the defaults.

14.Set Allowed protocols to HTTPS only.
15.Select Generate SAS token and URI.
16.Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.

17.Select Home to return to the Azure portal home page.

With the SAS token created, anyone with that link can access the file for the duration that was set when you created the SAS token. However, controlling access to a resource or file is about more than just granting access. It’s also about being able to revoke access. To revoke access with a SAS token, you need to invalidate the token. You invalidate the token by rotating the key that was used.

Rotate access keys
1.From the Azure portal home page, in the search box, enter storage accounts.
2.Select storage accounts under services.
3.Select the storage account you created in the Prepare exercise.
4.Expand the Security + networking submenu.
5.Select Access keys.

6.For Key 1, select Rotate key.
7.Read and then acknowledge the warning about regenerating the access key by selecting Yes.

8.Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error.

Before:

*After: *

Exercise – Manage tags and locks
If you’ve completed the previous exercises, you’ve managed added a subnet to a virtual network, made changes to a virtual machine, and worked with an Azure storage account. The final set of tasks for this guided project focus around working with tags and resource locks to help manage and monitor your environment. During this exercise you’ll go back into each of the areas you’ve already worked to add tags, locks, or a combination of both.

Scenario
Pleased with your progress so far, the Azure admin hopes that you can wrap a few things up to help with monitoring and protecting resources. They want to know that someone can’t accidentally get rid of the virtual machine that’s running as an FTP server, and they want a quick way to see what department is using resources and the resource’s purpose.

Manage tags and locks on VMs
Adding tags to resources is a quick way to be able to group and organize resources. Tags can be added at different levels, giving you the ability to organize and group resources at a level that makes sense for you.

Add tags to a virtual machine
You’ll start by adding a pair of tags to the virtual machine. One tag will be to identify the purpose of the virtual machine and the other will be to indicate the department the machine supports.

1.Login to Microsoft Azure at https://portal.azure.com
2.From the Azure portal home page, in the search box, enter virtual machines.
3.Select virtual machines under services.
4.Select the guided-project-vm virtual machine.
5.From the menu pane, select Tags.

6.On one line for Name enter Department and for Value enter Customer Service
7.On the next line, for Name enter Purpose and for Value enter FTP Server.
8.Select Apply.

While you’re working on the virtual machine, it’s a great time to add a resource lock.

Add a resource lock to a VM
1.If necessary, expand the Settings submenu.
2.Select Locks.

3.Select + Add.
4.For the name, enter VM-delete-lock.
5.For the Lock type, select Delete.
6.You may enter a note to help remind you why you created the lock.
7.Select OK.

That’s it. Now the VM is protected from deletion and has tags assigned to help track use. Time to move onto the network.

1.Select Home to return to the Azure portal home page.

Add tags to network resources

1.From the Azure portal home page, in the search box, enter virtual networks.
2.Select virtual networks under services.
3.Select the `guided-project-vnet` network.
4.From the menu pane, select Tags.

Note: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and apply create something new in the other field.

5.For the Name select Department.
6.For the Value enter IT.
7.Select Apply.

Now both the VNet and VM have are organized.

Congratulations! You’ve completed this exercise.

Exercise – Clean up

Warning: Failure to complete this Clean up task could result in unexpected Azure costs. This task will remove resources created during this guided project.

Remove delete locks
If you attempt to delete a resource with a delete lock, you’ll receive a warning that the operation failed due to a delete lock being in place. To avoid that, it’s important to clear delete locks from resources you intend to delete before issuing the delete command.

1.Login to Microsoft Azure at https://portal.azure.com
2.From the Azure portal home page, in the search box, enter virtual machines.
3.Select virtual machines under services.
4.Select the `guided-project-vm` virtual machine.
5.If necessary, expand the Settings submenu.
6.Select Locks.
7.Select Delete on the line for the VM-delete-lock.

8.On the pop-up window, select Delete to confirm deletion of the lock.

Once the delete lock is removed, you’ll be able to delete the VM. While this was the only delete lock required by the exercise, if you applied other delete locks during the exercise, remove them now. When you’re done, select Home to return to the Azure portal home page.

Delete the project resource group

A key benefit of using resource groups is the ability to rapidly delete all of the resources assigned to a resource group at once.

1.From the Azure portal home page, in the search box, enter Resource groups.
2.Select resource groups under services.
3.Select the guided-project-rg resource group.
4.Select Delete resource group.

5.Select Apply force delete…
6.Enter guided-project-rg in the confirmation box.
7.Select Delete.

8.On the Delete confirmation pop-up, select Delete.

It will approximately 5 minutes before the resource group is fully deleted. You’ll need to refresh the resource group page every few minutes until the guided-project-rg is gone to confirm complete deletion.

Important: Recall at the beginning of the Guided Project you checked for a **NetworkWatcherRG **resource group. If there WAS a NetworkWatcherRG when you started, then you’re finished. However, if the NetworkWatcherRG was created for the guided project, you’ll need to delete the NetworkWatcherRG as well following a nearly identical process.

Delete the NetworkWatcherRG

1.From the Azure portal home page, in the search box, enter Resource groups.
2.Select resource groups under services.
3.Select the NetworkWatcherRG **resource group.
4.Select **Delete resource group.
5.Enter NetworkWatcherRG in the confirmation box.
6.Select Delete.
7.On the Delete confirmation pop-up, select Delete.

It will approximately 5 minutes before the resource group is fully deleted. You’ll need to refresh the resource group page every few minutes until the NetworkWatcherRG is gone to confirm complete deletion.

Congratulations – you’ve finished the Guided Project and the clean up task at the end. Now head back to Learn to finish the rest of the module.

Thanks for reading — see you in the next one

How to Add a Data Disk to a VM

Samuel Ojo — Thu, 27 Nov 2025 02:26:31 +0000

Introduction
When working with Azure Virtual Machines (VMs), you may need additional storage for application data, logs, or backups. Instead of resizing the OS disk, the best practice is to attach a data disk. This guide walks you through adding a data disk to an Azure VM using the Azure Portal and configuring it at the operating system level.

Key Terms & Definitions
Azure Virtual Machine (VM):
A scalable computing resource in Microsoft Azure that runs Windows or Linux operating systems, allowing you to deploy applications and workloads in the cloud.

Data Disk:
An additional disk attached to a VM for storing application data, logs, or backups. Unlike the OS disk, data disks are used for flexible storage expansion.

Managed Disk:
An Azure-managed storage resource that simplifies disk management by handling storage accounts and replication automatically.

Encryption:
A security feature that protects data on disks by converting it into a secure format that can only be accessed with proper keys.

Azure Portal:
A web-based interface for managing Azure resources, including VMs, disks, networking, and security settings.

Prerequisites
Before you begin:

You have an existing Azure VM (Linux or Windows).
You have Contributor or higher permissions in your Azure subscription.
Basic familiarity with Azure Portal navigation.

Create virtual machine
1.Navigate to https://portal.azure.com.- Sign in with your Azure account credentials.
Enter virtual machines in the search box.

2.Under Services, select Virtual machines.

3.In the Basics tab, under Project details, make sure the correct subscription is selected and then choose or Create new resource group. Mine is winserver10rg.

4.Under Instance details, enter winserver10Vm for the Virtual machine name, and choose choose Windows 10 Enterprise, version 22H2 - x64 Gen2 for the Image. The default size and pricing is only shown as an example. Size availability and pricing are dependent on your region and subscription.

5.Under Administrator account, select password.
6.In Username enter azureuser.
7.Enter password and confirm password.

8.Under Inbound port rules > Public inbound ports, choose Allow selected ports and then select HTTP (80) and RFDP(3389) from the drop-down.

9.Navigate to Monitoring tab > Diagnostics > select Disable.

Navigate to Tags tab. Create Tag (Name and value). Then select the Review + create button at the bottom of the page

10.On the Create a virtual machine page, you can see the details about the VM you are about to create. When you are ready, select Create.

11.When the deployment is finished, select Go to resource

12.On the page for your new VM, select the public IP address and copy it to your clipboard.

13.Increase the Idle timeout (minutes) to 30.

Step 2: Create data disk

Click on the virtual machine created to go to its overview page
On the overview go to settings
Click settings, then select disks
On Data disks page, click on + create and attach new disk
On the LUN: That is to assign a new identifier to the newly created disk.
choose disk name, storage type, and size, then click on apply

Step 3: Initialize and Format the Data Disk

Connect to virtual machine
Click on connect virtual machine

Click on download RDP file
Connect to the VM: Use Remote Desktop (RDP) to connect to your Windows VM.

On the virtual machine search bar, search Disk Management Click on create and format hard disk partitions.
Click on OK to initialize the new disk

Scroll down to new disk created (disk 1). (notice that the disk is showing unallocated)

Right-click on the unallocated space of the new disk. Select New Simple Volume.

Follow the wizard to assign a drive letter and format the disk

On the welcome to the new simple volume wizard: Click Next
On the specify volume size use the default and click on next (i.e. if you do not wish to modify the volume of the disk)

On the assign drive path click on next

On the format partition give it a name on the volume label and click on next.

Now Click on Finish to complete the process

Notice that the disk new disk is now showing Healthy and no longer unallocated.

Conclusion
Adding a data disk to your Azure VM is a simple yet powerful way to scale storage without impacting your OS disk. Whether you’re hosting databases, storing logs, or managing large files, this approach ensures flexibility and performance.

Thanks for reading, see you in the next one

Guided Lab: Azure Storage with Customer-Managed Keys, Retention Policies & Encryption Scopes

Samuel Ojo — Tue, 18 Nov 2025 01:50:54 +0000

Introduction
In this lab, I configured an Azure Storage account with advanced security and compliance features. The goal was to enable infrastructure encryption, assign a managed identity, secure access using a Key Vault with customer-managed keys, and enforce a time-based retention policy with encryption scopes. This setup is ideal for scenarios where data integrity, access control, and regulatory compliance are critical.

Skilling tasks

Create the storage account and managed identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer managed key in the key vault
Configure an time-based retention policy and an encryption scope.

Exercise instructions

Create the storage account and managed identity
1. Provide a storage account for the web app.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.
Select Review + Create.

Wait for the resource to deploy.

2. Provide a managed identity for the web app to use.

Search for and select Managed identities.

Select Create.
Select your resource group.
Give your managed identity a name.
Select Review and create, and then Create.

3. Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.
Select the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.
Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. Learn more about how to provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.
Select Select members.
Search for and select your user account. Your user account is shown in the top right of the portal.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

2. Create a key vault to store the access keys.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.
Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

3. Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.
Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.
Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

2. Configure the storage account to use the customer managed key in your key vault.

Return to your the storage account.
In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.
Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.
Select an identity.
Select your managed identity then select Add.
Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.
1. The developers require a storage container where files can’t be modified, even by the administrator.

Navigate to your storage account.
In the Data storage section, select the Containers blade.
Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.
For the Policy type, select time-based retention.
Set the Retention period to 5 days.
Be sure to Save your changes.

Try to delete the file in the container.

Verify you are notified failed to delete blobs due to policy.

n

2. The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.
Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.
Create the encryption scope.

Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Conclusion
This lab demonstrated how to build a secure and compliant Azure Storage setup using customer-managed keys, retention policies, and encryption scopes. These features are essential for protecting sensitive data and meeting enterprise or regulatory requirements. A great exercise for anyone preparing for real-world cloud security scenarios!

Thanks for reading — see you in the next one

Getting Started with Azure: Create and Configure a Windows 10 Virtual Machine

Samuel Ojo — Mon, 17 Nov 2025 06:47:17 +0000

Introduction
Creating a Windows 10 Virtual Machine (VM) in Microsoft Azure allows you to experience a modern desktop environment in the cloud. This is ideal for developers, testers, and IT professionals who need a secure, scalable, and easily accessible Windows environment without installing it locally. In this lab, you’ll learn how to create a Windows 10 VM, connect to it using Remote Desktop, and install IIS to host a simple web page.

Key Terms
Virtual Machine (VM): A software-based computer that runs an operating system and applications like a physical computer, but is hosted on a cloud or virtualization platform.

Azure: Microsoft’s cloud computing platform offering services like virtual machines, storage, networking, and more.

RDP (Remote Desktop Protocol): A protocol that allows you to connect and control a remote computer over a network.

IIS (Internet Information Services): A web server developed by Microsoft for hosting websites and web applications.

Availability Zone: A physically separate location within an Azure region that provides high availability and fault tolerance.

Create virtual machine
1.Navigate to https://portal.azure.com.- Sign in with your Azure account credentials.
Enter virtual machines in the search box.

2.Under Services, select Virtual machines.

3.In the Basics tab, under Project details, make sure the correct subscription is selected and then choose or Create new resource group. Mine is winserver10rg.

5.Under Administrator account, select password.
6.In Username enter azureuser.
7.Enter password and confirm password.

8.Under Inbound port rules > Public inbound ports, choose Allow selected ports and then select HTTP (80) and RFDP(3389) from the drop-down.

9.Navigate to Monitoring tab > Diagnostics > select Disable.

Navigate to Tags tab. Create Tag (Name **and **value). Then select the Review + create button at the bottom of the page

10.On the Create a virtual machine page, you can see the details about the VM you are about to create. When you are ready, select Create.

11.When the deployment is finished, select Go to resource

12.On the page for your new VM, select the public IP address and copy it to your clipboard.

13.Increase the Idle timeout (minutes) to 30.

End of step 1

Step 2: RDP into the VM
Once the VM is deployed, follow these steps to connect:

🔹 On Windows:

Open Remote Desktop Connection (RDP)
Enter the public IP address of the VM
Click Connect

Enter your Admin username & password

Click OK

🔹 On macOS/Linux:
Use an RDP client like Microsoft Remote Desktop.

Step 3: Open PowerShell as Administrator

Once connected to the VM, open PowerShell:
Click the Start menu

Type PowerShell
Right-click Windows PowerShell and select Run as administrator

4: Install IIS (Web Server)
Run the following command to install IIS and its management tools:

Install-WindowsFeature -name Web-Server -IncludeManagementTools

Step 5: Verify IIS Installation
After installation, verify that IIS is running:

📌 Method 1: Public IP Address
Copy your VM’s public IP address
Open a browser and enter:
http://your_vm_ip in this lab, mine is:
http://51.141.93.231

📌 Method 2: Localhost
Open a web browser
Go to http://localhost
You should see the default IIS welcome page

If IIS is installed correctly, you should see the IIS default page.

Conclusion
You’ve successfully created and configured a Windows 10 VM in Azure, connected via RDP, and installed IIS to serve a web page. This setup is perfect for testing desktop applications, building development environments, or exploring Windows 10 features in a secure cloud environment.

Next Steps:
Automate VM creation using Azure CLI or ARM templates.
Explore Azure Bastion for secure browser-based RDP.
Configure NSG rules for advanced security.

Thanks for reading, see you in the next one

Deploying a Web Server VM and Installing IIS on Windows

Samuel Ojo — Sun, 16 Nov 2025 17:54:11 +0000

Introduction
Windows Server 2022 is Microsoft’s latest server operating system, designed for enterprise workloads, enhanced security, and hybrid cloud integration. Deploying it on Azure provides a fast, scalable, and cost-effective way to run server-based applications without investing in physical infrastructure. In this lab, you’ll learn how to create a Windows Server 2022 Datacenter VM in Azure, configure remote access via RDP, and install IIS to host a simple web page. This hands-on exercise is perfect for IT professionals and developers looking to explore server roles and Azure’s capabilities.

Key Terms
Virtual Machine (VM): A software-based computer that runs an operating system and applications like a physical computer, but is hosted on a cloud or virtualization platform.

Azure: Microsoft’s cloud computing platform offering services like virtual machines, storage, networking, and more.

Windows Server 2022 Datacenter: A server operating system optimized for enterprise workloads, virtualization, and cloud integration.

RDP (Remote Desktop Protocol): A protocol that allows you to connect and control a remote computer over a network.

IIS (Internet Information Services): A web server developed by Microsoft for hosting websites and web applications.

Availability Zone: A physically separate location within an Azure region that provides high availability and fault tolerance.

What You’ll Learn
Step 1: Create a Web Server VM
Step 2: RDP into the VM
Step 3: Open PowerShell as Administrator
Step 4: Install IIS (Web Server)
Step 5: Verify IIS Installation

Create virtual machine
1.Navigate to https://portal.azure.com.- Sign in with your Azure account credentials.

Enter virtual machines in the search.

2.Under Services, select Virtual machines.
In the Virtual machines page, select Create and then Azure
virtual machine. Then Create a virtual machine page opens.

3.In the Basics tab, under Project details, make sure the correct subscription is selected and then choose or Create new resource group. Mine is storagerg.

4.Under Instance details, enter IISvm for the Virtual machine name, and choose choose Windows Server 2022 Datacenter - x64 Gen 2 for the Image. The default size and pricing is only shown as an example. Size availability and pricing are dependent on your region and subscription.

5.Under Administrator account, select password.
6.In Username enter azureuser.
7.Enter password and confirm password.

8.Under Inbound port rules > Public inbound ports, choose Allow selected ports and then select HTTP (80) and RFDP(3389) from the drop-down.

9.Navigate to Monitoring tab > Diagnostics > select Disable.

Navigate to Tags tab. Create Tag (Name **and **value). Then select the Review + create button at the bottom of the page

10.On the Create a virtual machine page, you can see the details about the VM you are about to create. When you are ready, select Create.

11.When the deployment is finished, select Go to resource

12.On the page for your new VM, select the public IP address and copy it to your clipboard.

13.Increase the Idle timeout (minutes) to 30.

End of step 1

Step 2: RDP into the VM
Once the VM is deployed, follow these steps to connect:

🔹 On Windows:

Open Remote Desktop Connection (RDP)
Enter the public IP address of the VM
Click Connect

Enter your Admin username & password

Click OK

🔹 On macOS/Linux:
Use an RDP client like Microsoft Remote Desktop.

Step 3: Open PowerShell as Administrator

Once connected to the VM, open PowerShell:
Click the Start menu

Type PowerShell
Right-click Windows PowerShell and select Run as administrator

4: Install IIS (Web Server)
Run the following command to install IIS and its management tools:

Install-WindowsFeature -name Web-Server -IncludeManagementTools

Step 5: Verify IIS Installation
After installation, verify that IIS is running:

📌 Method 1: Public IP Address
Copy your VM’s public IP address
Open a browser and enter:
http://your_vm_ip in this lab, mine is:
http://20.187.54.47

📌 Method 2: Localhost
Open a web browser
Go to http://localhost
You should see the default IIS welcome page

If IIS is installed correctly, you should see the IIS default page.

Thanks for reading — see you in the next one

Create a Linux virtual machine in the Azure portal

Samuel Ojo — Fri, 14 Nov 2025 01:17:26 +0000

Azure virtual machines (VMs) can be created through the Azure portal. The Azure portal is a browser-based user interface to create Azure resources. This lab show you how to use the Azure portal to deploy a Linux virtual machine (VM) running Ubuntu Server 22.04 LTS. To see your VM in action, you also SSH to the VM and install the NGINX web server.

Create virtual machine
1.Navigate to https://portal.azure.com.- Sign in with your Azure account credentials.

Enter virtual machines in the search.

2.Under Services, select Virtual machines.
In the Virtual machines page, select Create and then Azure
virtual machine. The Create a virtual machine page opens.

3.In the Basics tab, under Project details, make sure the correct subscription is selected and then choose or Create new resource group. Mine is myResourceGroup.

4.Under Instance details, enter myVM for the Virtual machine name, and choose Ubuntu Server 22.04 LTS - Gen2 for your Image. The default size and pricing is only shown as an example. Size availability and pricing are dependent on your region and subscription.

5.Under Administrator account, select password.
6.In Username enter azureuser.

7.Enter password and confirm password.

8.Under Inbound port rules > Public inbound ports, choose Allow selected ports and then select SSH (22) and HTTP (80) from the drop-down.

9.Navigate to Monitoring tab > Diagnostics > select Disable.

Navigate to Tags tab. Create Tag (Name **and **value). Then select the Review + create button at the bottom of the page.

10.On the Create a virtual machine page, you can see the details about the VM you are about to create. When you are ready, select Create.

11.When the deployment is finished, select Go to resource.

12.On the page for your new VM, select the public IP address and copy it to your clipboard.

13.Increase the Idle timeout (minutes) to 30.

Connect to virtual machine

Step 1: Connect to the Linux VM Using SSH

Use password authentication to log in to the server:

ssh username@hostname_or_ip

After running this command, enter the password when prompted.

Step 2: Switch to Root User

Ensure you have root privileges by switching to the root user:

sudo su

This allows you to install software without permission issues.

Step 3: Install Nginx on the Server
Run the following command to install Nginx:

apt update

Then

apt install nginx -y

🔹 apt → The package manager for Ubuntu/Debian-based systems.
🔹 install → The action to install a package.
🔹 nginx → The software package to install.
🔹 -y → Automatically confirms the installation without prompting.

Step 4: Verify the Installation

Once the installation is complete, verify that Nginx is running by checking its status:

systemctl status nginx

If the service is active, it should show active (running).

Step 5: Test in a Web Browser

Copy the public IP address of the VM and paste it into a browser:

http://<your_vm_ip>

If Nginx is installed correctly, you should see the default Nginx welcome page.

Conclusion
Creating a Linux virtual machine in the Azure Portal is a straightforward process that gives you a powerful and flexible environment for hosting applications, running workloads, or experimenting with cloud technologies. By following these steps, you’ve learned how to select an image, configure size and networking, and deploy a VM in minutes.
This is just the beginning, once your VM is up and running, you can:

Secure it with Network Security Groups and Azure Firewall.
Automate deployments using Azure CLI, PowerShell, or ARM templates.
Scale resources based on demand and integrate with other Azure services like Storage, Monitoring, and Backup.

Mastering VM creation is a key skill for cloud professionals, and Azure makes it easy to get started. Keep exploring and building!

Thanks for reading — see you in the next one

Step-by-Step Lab: How to Create a Resource Group in Azure Portal

Samuel Ojo — Thu, 13 Nov 2025 00:33:04 +0000

Introduction
In today’s cloud-first world, organizing resources efficiently is critical for managing costs, security, and scalability. Microsoft Azure uses Resource Groups as a fundamental building block for resource management. A Resource Group acts as a logical container that holds related resources for an Azure solution, making it easier to deploy, monitor, and manage them collectively.

In this lab, you’ll learn how to create a Resource Group using the Azure Portal, step by step. By the end, you’ll understand why Resource Groups are essential and how they fit into Azure’s resource hierarchy.

Objectives

Understand what a Resource Group is.
Create a Resource Group using the Azure Portal.
Verify the Resource Group deployment.
Learn optional automation using Azure CLI and PowerShell.

Prerequisites

Active Azure subscription.
Access to https://portal.azure.com.
Basic understanding of Azure concepts.

Key Terms
Resource Group: A container that holds related Azure resources, such as virtual machines, storage accounts, and databases, allowing you to manage them as a single unit.
Azure Portal: A web-based interface for managing Azure resources visually.
Subscription: A billing and management boundary in Azure that groups resources and services under a single account.
Region: A geographical location where Azure resources are hosted. Choosing the right region impacts latency, compliance, and availability.
Tags: Key-value pairs used to organize and classify resources for cost management and governance.

Lab Steps
✅ Step 1: Sign in to Azure Portal

Navigate to https://portal.azure.com.
Sign in with your Azure account credentials.

✅ Step 2: Search for Resource Groups at the search bar

click Resource groups.

✅ Step 3: Create a New Resource Group

Click + Create (or Create resource group).

Fill in the required details:
Subscription: Select the subscription you want to use.
Resource group name: Enter a unique name (e.g., MyResourceGroup).
Region: Choose the Azure region where you want the resources to reside (e.g., (UK) UK South).

✅ Step 4: Review and Create

Click Review + Create.

Validate the settings.
Click Create.

✅ Step 5: Verify

After deployment completes, you’ll see the new resource group in the Resource groups list.

Verification

Go to Resource groups in the Azure Portal.
Confirm the resource group name, region, and subscription.

Conclusion
Resource Groups are the foundation of resource organization in Azure. By creating a Resource Group, you establish a logical structure that simplifies deployment, monitoring, and lifecycle management. Whether you’re working on a small project or a large enterprise solution, proper resource grouping ensures better governance and cost control.

Next steps:
Add resources to your Resource Group.
Apply **tags **for better organization.

Thanks for reading — see you in the next one

Hands-On with Azure Files: Storage, Snapshots & Network Security

Samuel Ojo — Tue, 11 Nov 2025 21:58:26 +0000

Introduction:
In this lab, I set up a secure Azure Files environment tailored for a finance department. The goal was to create a premium storage account, configure file shares and directories, enable snapshots for recovery, and restrict access using virtual networks. This walkthrough is ideal for anyone looking to build enterprise-grade file storage with layered security and recovery options.

Skilling tasks

Create a storage account specifically for file shares.
Configure a file share and directory.
Configure snapshots and practice restoring files.
Restrict access to a specific virtual network and subnet.

Create and configure a storage account for Azure Files.

1. Create a storage account for the finance department’s shared files.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.
Set the Performance to Premium.
Set the Premium account type to File shares.
Set the Redundancy to Zone-redundant storage.
Select Review and then Create the storage account.

Wait for the resource to deploy.
Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.
Review the other options, but take the defaults.
Select Create

2. Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.
Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.

Upload a file of your choosing.

Configure and test snapshots.

1. Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Select your file share.
In the Operations section, select the Snapshots blade.
Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.
Browse to your file directory.
Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore,
Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.
Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.
Select Go to resource.

In the Settings section, select the Subnets blade.
Select the default subnet.
In the Service endpoints section choose Microsoft.Storage in the Services drop-down.
Do not make any other changes.
Be sure to Save your changes.

2. The storage account should only be accessed from the virtual network you just created.

Return to your files storage account.
In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.
Select your virtual network and subnet, select Add.
Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

🧠 Key Terms Explained for Beginners
If you're new to Azure, here are some important terms used in this lab and what they mean:

Azure Portal: The web-based dashboard where you manage all your Azure services. Think of it as your cloud control center.

Resource Group: A container that holds related Azure resources like storage accounts, virtual networks, and more. It helps you organize and manage them together.

Storage Account: A secure space in Azure where you store data—files, blobs, queues, and tables. It’s the foundation for using Azure Files.

Azure Files: A cloud-based file sharing service that works like a traditional file server. You can access it using standard file protocols.

File Share: A folder-like structure inside Azure Files where you store and organize files. You can create directories within it.

Directory: A subfolder within a file share. In this lab, we created one called finance to organize departmental files.

Snapshot: A read-only backup of your file share at a specific point in time. It’s useful for restoring deleted or changed files.

Restore: The process of bringing back a deleted or previous version of a file using a snapshot.

Virtual Network (VNet): A private network in Azure that lets your resources communicate securely. It’s like your own cloud-based LAN.

Subnet: A smaller segment within a virtual network that helps organize and isolate resources.

Service Endpoint: A way to securely connect your virtual network to Azure services like Storage without going over the public internet.

Zone-Redundant Storage (ZRS): A storage option that keeps your data safe by replicating it across multiple zones in a region.

Premium Performance Tier: A high-speed storage option optimized for low-latency and high-throughput workloads.

Public Network Access: A setting that controls whether your storage account can be accessed from the internet or only from specific networks.

✅ Conclusion
This lab covered the full lifecycle of setting up Azure Files for secure departmental use. From premium storage configuration to snapshots and network restrictions, each step reinforced best practices for enterprise-grade file sharing. These skills are directly applicable to production environments where data protection and access control are critical.

Thanks for reading — see you in the next one