DEV Community: Oladimeji Zainab

Step-by-Step Guide to Configuring Monitoring for Azure Compute Services Using Azure Monitor.

Oladimeji Zainab — Sat, 11 Jul 2026 14:31:55 +0000

Introduction

Effective monitoring is a critical component of maintaining secure, reliable, and high-performing Azure environments. Azure Monitor provides powerful capabilities for collecting telemetry, analyzing performance metrics, monitoring network connectivity, and identifying issues before they impact workloads.

In this guide, you'll learn how to configure Azure Monitor by creating a Data Collection Endpoint (DCE), setting up a Data Collection Rule (DCR) to collect Windows Event Logs, and configuring Network Connection Monitor for a Linux Infrastructure-as-a-Service (IaaS) virtual machine. By completing these steps, you'll establish a centralized monitoring solution that improves operational visibility, streamlines troubleshooting, and strengthens the overall health of your Azure infrastructure.

Create a data collection endpoint.

In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.

In the Monitor page, under Settings, choose Data Collection Endpoints.

On the Data Collection Endpoints page, choose Create.

On the Create Data Collection Endpoint page, provide the following settings and then choose Review + Create.

Review the settings and choose Create.

Create a data collection rule

In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.

In the Monitor page, under Settings, choose Data Collection Rules.

format](https://dev-to-uploads.s3.us-east-2.amazonaws.com/uploads/articles/fo2a6pdf627iwkicvwze.png)

On the Data Collection Rules page, choose Create.

On the Create Data Collection Rule page, configure the following settings and choose Next.

On the Resources page, choose Add Resources.

On the Select a scope page, enable the WS-VM1 checkbox and choose Apply.

On the Create Data Collection Rule page, choose Next.

On the Collect and Deliver page, choose Add data source.

On the Add data source page, select Windows Event Logs. In the Application category enable the Critical and Error categories. In the Security category, choose the Audit Failure category. In the System category, enable the Critical and Error categories.

Choose Next.

On the Destination page, configure the following settings:

Choose Apply

Then click save.

Configure Network Connection Monitor for a Linux IaaS virtual machine

In the Azure Portal Search Bar, enter Network Watcher and select Network Watcher from the list of results.
Under Monitoring, choose Connection Monitor.

On the Connection Monitor page, choose Create.

On the Basics page of the Create Connection Monitor wizard, provide the following information and choose Next.

On the Add test group details page, enter the name LinuxIPTest001 and choose Add sources and On the Add Sources page, select Azure Endpoints and set the type to Virtual machines. Select Subnet and then enable the Linux-VM checkbox. Choose Add Endpoints.

Choose Add Test Configuration.

On the Add Test Configuration page, enter the name DefaultHTTP and then choose Add Test Configuration.

Choose Add Destinations. Select Azure Endpoints and set the type to Virtual machines. Select Subnet and then enable the WS-VM1 checkbox. Select Add Endpoints.

Choose Add Test Group.

Click Next>workspace

Add workspace

Choose Review and Create and then choose Create.

Conclusion

Successfully configuring Azure Monitor with Data Collection Endpoints, Data Collection Rules, and Network Connection Monitor provides a strong foundation for proactive infrastructure monitoring. These components work together to centralize log collection, monitor critical system events, and verify network connectivity between Azure resources.

With these monitoring capabilities in place, administrators can quickly detect issues, investigate performance bottlenecks, enhance security monitoring, and respond to incidents more efficiently. Implementing these best practices not only improves operational reliability but also supports better governance and informed decision-making across Azure environments.

Configuring Azure Monitor Alerts and Action Groups for Virtual Machine Monitoring

Oladimeji Zainab — Sat, 11 Jul 2026 13:15:38 +0000

Introduction.

Monitoring is a critical component of maintaining secure, reliable, and highly available cloud environments. Azure Monitor enables administrators to detect performance issues, resource health changes, and operational anomalies before they impact users or business operations.

In this guide, you'll learn how to configure an Azure Monitor Action Group to send email notifications and create an alert rule that monitors CPU utilization for an Azure Virtual Machine. By completing these steps, you'll establish an automated notification system that promptly informs administrators whenever CPU usage exceeds the configured threshold, enabling faster response times and improved operational efficiency.

Create an action group to send an email.

In the Azure Portal Search Bar, enter Monitor and select Monitor from the list of results.

Select Alerts in the navigation menu.

Choose Action Groups.

On the Action Groups page, choose Create.

On the Basics page of the Create Action Group wizard, configure the following settings and choose Next

On the Notifications page, set the notification type to Email/SMS message/Push/Voice and the Name to NotificationEmail. Choose the Edit (pencil) icon.

On the Email/SMS message/Push/Voice enable the email checkbox and enter the address prime@fabrikam.com. Choose OK.

Choose Review and Create. Choose Create.

Create an alert for virtual machine CPU utilization.

In the Azure Portal Search Bar, enter rg-alpha and select rg-alpha from the list of results.

From the list of items in the resource group, choose Linux-VM2.

On the Linux-VM2 properties page, choose Alerts under Monitoring.

On the Alerts page, choose Create and then choose Alert rule.

On the Condition page of the Create an Alert Rule wizard, set the Signal name to Percentage CPU. Use the default settings and choose Next.

On the Actions page, choose Select Action Group.

On the Select Action Groups page, choose NotifyCPU and choose Select.

On the Details page enter the Alert rule name HighCPU. Choose Review and Create and then choose Create.

Conclusion

Configuring Action Groups and Alert Rules in Azure Monitor is an essential step toward implementing proactive monitoring for cloud resources. By creating an email notification action group and associating it with a CPU utilization alert, you can automatically notify administrators whenever a virtual machine experiences unusually high CPU usage.

This automated monitoring approach reduces the need for constant manual checks, enables quicker incident response, minimizes potential downtime, and helps maintain the performance and reliability of Azure workloads. Incorporating alerts into your monitoring strategy is a best practice for ensuring operational excellence in any Azure environment.

Azure Monitor for Web Apps: A Step-by-Step Guide to Configuring Application Insights, Log Analytics, and SQL Insights

Oladimeji Zainab — Sat, 11 Jul 2026 00:22:05 +0000

Introduction

Monitoring is a critical aspect of managing cloud-based applications, as it provides visibility into application performance, user activity, and overall resource health. Azure Monitor, together with Application Insights and Log Analytics, enables organizations to collect, analyze, and act on telemetry data from their applications and infrastructure. In this exercise, I configured Application Insights for an Azure Web App, disabled the .NET Core Snapshot Debugger, enabled HTTP logging, and configured SQL Insights to send diagnostic data to a Log Analytics workspace. These configurations establish a centralized monitoring solution that supports proactive performance monitoring, troubleshooting, and operational efficiency.

In the Azure Portal Search Bar, enter rg-alpha-Central and select rg-alpha-central from the list of results.

From the list of items in the resource group, choose App Services for the Web App with an SQL Database.

Under Monitoring choose Application Insights.

On the Application Insights page, choose Turn On Application Insights.

On the Application Insights page, ensure that Create a new resource is selected and that the Log Analytics Workspace is set to LogAnalytics1 and choose Apply.

On the Apply monitoring settings dialog, choose Yes.

Disable logging for .NET core snapshot debugger

In the Azure Portal Search Bar, enter rg-alpha-central and select rg-alpha-central from the list of results.

From the list of items in the resource group, choose App Services for the Web App with an SQL Database.

Under Monitoring choose Application Insights.

Under Instrument your application, choose .NET Core and then set the Snapshot Debugger setting to Off. Choose Apply.

On the Apply Monitoring Settings dialog box, choose Yes.

Configure web app HTTP logs to be written to a Log Analytics workspace.

In the Azure Portal Search Bar, enter rg-alpha-central and select rg-alpha-central from the list of results.

From the list of items in the resource group, choose App Services for the Web App with an SQL Database.

Under Monitoring, choose Diagnostic settings.

On the Diagnostic settings page, select + Add diagnostic settings.

On the Diagnostic settings page, choose the following and select Save.

Configure SQL Insights data to be written to a Log Analytics workspace

In the Azure Portal Search Bar, enter rg-alpha-central and select rg-alpha-central from the list of results.

From the list of items in the resource group, choose the sample SQL database.

Under Monitoring, choose Diagnostic settings.

On the Diagnostic settings page, choose Add diagnostic setting.

On the Diagnostic setting page, provide the following information and choose Save.

Conclusion

By completing this exercise, I successfully configured comprehensive monitoring for both an Azure Web App and its associated SQL Database. I enabled Application Insights to collect application telemetry, disabled the .NET Core Snapshot Debugger to minimize unnecessary diagnostic overhead, configured HTTP logs for the Web App, and directed SQL diagnostic data to a Log Analytics workspace. These configurations provide a centralized platform for monitoring application performance, analyzing logs, and diagnosing issues, ensuring greater visibility, improved reliability, and more effective management of Azure resources.

Step-by-Step Guide: Configuring Azure Monitor Log Analytics Workspace and Monitoring Linux Virtual Machines.

Oladimeji Zainab — Fri, 10 Jul 2026 22:04:29 +0000

Introduction.

Effective monitoring is a critical aspect of managing cloud resources, enabling administrators to gain visibility into system performance, troubleshoot issues proactively, and optimize resource utilization. Azure Monitor, together with Log Analytics, provides a centralized platform for collecting, analyzing, and visualizing telemetry data from Azure resources. By leveraging the Azure Monitor Agent (AMA) and Data Collection Rules (DCRs), organizations can efficiently collect performance data while maintaining flexibility and scalability in their monitoring strategy.

In this exercise, I created a Log Analytics workspace, configured and deployed the Azure Monitor Agent to a Linux virtual machine using a Data Collection Rule, verified successful data ingestion through Kusto Query Language (KQL), configured data retention and daily ingestion limits, and implemented role-based access control (RBAC) to securely manage access to the Log Analytics workspace.

Create a Log Analytics workspace

In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.

On the Log Analytics workspaces page, choose Create.

On the Basics page of the Create Log Analytics workspace wizard, provide the following information and choose Review + Create.

Choose Review + Create.

Review the information and choose Create.

Install and configure the Azure Monitor Agent on Linux-VM using a Data Collection Rule.

In the Azure Portal, enter Data Collection Rules in the search bar and select Data Collection Rules from the results.

Select + Create to start a new data collection rule.

On the Basics page, provide the following:

Under Resources, select + Add resources

Search for and select Linux-VM.

Select Apply.

Select Next: Collect and deliver >

In the Collect and deliver tab:

Select + Add data source.

For Data source type, choose Performance Counters.

Select Next: Destination >.

Select + Add destination.

Under Destination type choose Azure Monitor Logs.(In the newer Azure Portal UI, Microsoft renamed the destination from Azure Monitor Logs to Log Analytics Workspaces.)

Under Destination Details choose LogAnalytics1 (rg-alpha)

Select Add data source.

Select Next: Review + create

Verify agent installation and data ingestion:

In the Azure Portal, use the search bar to search for Log Analytics workspaces and select it from the results.

In the list of workspaces, select LogAnalytics1.

In the left-hand menu of the LogAnalytics1 workspace, select Logs.

Use the mode drop-down to change from Simple mode to KQL mode.

In the query window, enter the following query

Select Run or press Shift + Enter to execute the query.

If results are returned, data is flowing and the Azure Monitor Agent is working.

Configure Log Analytics data retention and archive policies.

In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.

On the Log Analytics workspaces page, choose LogAnalytics1.

On the Log Analytics workspace page for LogAnalytics1, under Settings, choose Usage and estimated costs.

Select Data Retention and set the slider to 60 days. Select OK.

On the Log Analytics workspace page for LogAnalytics1, choose Usage and estimated costs.

Select Daily cap. Select On. Set the daily cap to 10 GB and select OK.

Enable access to a Log Analytics workspace.

In the Azure Portal Search Bar, enter Log Analytics and select Log Analytics workspaces from the list of results.

On the Log Analytics workspaces page, choose LogAnalytics1.

Select Access control (IAM).

Choose Add and then choose Add role assignment.

On the list of roles, select Log Analytics Reader and choose Next.

On the Members page, choose Select Members and choose the App Log Examiners security group. Choose Select.

On the Members step, choose Review + Assign.

Conclusion.

This exercise demonstrated the complete process of implementing centralized monitoring for Azure resources using Azure Monitor and Log Analytics. By successfully deploying the Azure Monitor Agent, configuring a Data Collection Rule, and verifying data ingestion through KQL queries, I confirmed that monitoring data was flowing correctly into the Log Analytics workspace. Additionally, configuring data retention policies, setting daily ingestion limits, and assigning appropriate RBAC permissions ensured that the monitoring solution was both cost-effective and secure. These configurations provide a strong foundation for proactive monitoring, operational visibility, and effective cloud resource management within Azure environments.

Preparing an Azure Lab Environment: Deploying Virtual Machines, Web Apps, and SQL Resources

Oladimeji Zainab — Fri, 10 Jul 2026 00:41:03 +0000

Introduction.

Cloud infrastructure management is a critical skill for modern IT professionals and cloud engineers. In this hands-on guide, I'll walk you through the end-to-end deployment and configuration of key Microsoft Azure resources, including Virtual Machines, Microsoft Entra ID security groups, Azure App Services, and SQL Database. Whether you're preparing for the AZ-500 certification, building practical Azure experience, or strengthening your cloud security knowledge, this tutorial provides a structured, step-by-step approach to help you confidently replicate the entire lab in your own Azure environment.

Prepare your bring-your-own-subscription (BYOS)

In the Azure Portal Search Bar, enter Resource Groups and select Resource groups from the list of results.

On the Resource Groups page, select Create.

On the Create a Resource Group page, select your subscription and enter the name rg-alpha. Set the region to East US, choose Review + Create, and then choose Create.

Create App Log Examiners security group

In the Azure Portal Search Bar, enter Azure Active Directory (or Entra ID) from the list of results.

On the Default Directory page, select Groups.

On the Groups page, choose New Group.

On the New Group page, provide the values in the following table and choose Create.

Deploy and configure WS-VM1

In the Azure Portal Search Bar, enter Virtual Machines and select Virtual Machines from the list of results.

On the Virtual Machines page, choose Create and select Azure Virtual Machine.

On the Basics page of the Create A Virtual Machine wizard, select the following settings and then choose Review + Create.

Review the settings and select Create.

Wait for the deployment to complete. Once deployment completes choose Go to resource.

On the WS-VM1 properties page, choose Networking.

On the Networking page, select the RDP rule.

On the RDP rule space, change the Source to My IP address and choose Save.

This restricts incoming RDP connections to the IP address you’re currently using.

On the Networking page, choose Add inbound port rule.

On the Add inbound security rule page, configure the following settings and choose Add.

On the WS-VM1 page, choose Connect.

On the Native RDP page, choose Download RDP file and then open the file. Opening the RDP file opens the Remote Desktop Connection dialog box.

On the Windows Security dialog box, choose More Choices and then choose Use a different account.

Enter the username as .\prime and the password as the secure password you chose in Step 3, and choose OK.

When signed into the Windows Server virtual machine, right-click on the Start hint and then choose Windows PowerShell (Admin).

At the elevated command prompt, type the following command and press Enter. Install-WindowsFeature Web-Server -IncludeAllSubFeature -IncludeManagementTools

When the installation completes run the following command to change to the web server root directory. cd c:\inetpub\wwwroot\

Run the following command. Wget https://raw.githubusercontent.com/Azure-Samples/html-docs-hello-world/master/index.html -OutFile index.html

Deploy and configure LX-VM2

In the Azure Portal Search Bar, enter Virtual Machines and select Virtual Machines from the list of results.

On the Virtual Machines page, choose Create and select Azure Virtual Machine.

On the Basics page of the Create A Virtual Machine wizard, select the following settings and then choose Review + Create.

Review the information and choose Create.

After the VM deploys, open the VM properties page and choose Extensions + Applications under Settings.

Choose Add and select the Network Watcher Agent for Linux. Choose Next and then choose Review and Create. Choose Create.

Deploy a web app with an SQL Database

Ensure that you’re signed into the Azure Portal.

In your browser, open a new browser tab and navigate to https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.web/web-app-sql-database

On the GitHub page, choose Deploy to Azure.

A new tab opens. If necessary, re-sign into Azure with the account that has Global Administrator privileges.

On the Basics page, select Edit template.

In the template editor, delete the contents of lines 158 to 174 inclusive and delete the “,” on line 157. Choose Save.

On the Basics page, provide the following information and choose Next. Please note that a new resource group in Central US region to ensure successful deployment

Review the information presented and select Create.

After the deployment completes, choose Go to resource group.

Ensure that you’re signed into the Azure Portal.

In your browser, open a new browser tab and navigate to https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/webapp-basic-linux/

On the GitHub page, choose Deploy to Azure.

On the Basics page, provide the following information and choose Next. Please note that the new resource group created in the Central US region was used to ensure successful deplyoment

Review the information and choose Create.

format

Closing.

Successfully completing this lab demonstrates how Azure's compute, identity, networking, and application services work together to build secure and scalable cloud environments. Beyond simply deploying resources, these exercises reinforce best practices in infrastructure provisioning, access management, virtual machine configuration, and application deployment.

I hope this guide helps you gain practical Azure experience and serves as a valuable reference throughout your cloud learning journey. If you found this tutorial helpful, consider leaving a comment, sharing it with others in the cloud community, and following me for more hands-on Azure, DevOps, and cloud engineering guides.

Azure Resource Cleanup: A Hands-On Guide to Managing and Deleting Resources Efficiently

Oladimeji Zainab — Fri, 03 Jul 2026 13:11:37 +0000

Introduction.

Cleaning up Azure resources is a critical part of responsible cloud administration. While creating and configuring infrastructure often receives the most attention, properly removing resources helps maintain a secure environment, prevents unnecessary costs, and ensures that cloud subscriptions remain organized.

In this guide, I walk through the process of removing resource locks and deleting Azure resources after completing a hands-on lab. The walkthrough covers verifying and removing delete locks from a virtual machine, deleting the associated resource group, and cleaning up additional resources such as the Network Watcher resource group. These are essential operational tasks that support effective Azure governance and cost management in both learning and production environments.

Remove delete locks.

From the Azure portal home page, in the search box, enter virtual machines.

Select the guided-project-vm virtual machine.

If necessary, expand the Settings submenu.

Select Locks.

Select Delete on the line for the VM-delete-lock.

The virtual doesnt conatain a lock so we can go ahead to delete our resources

Delete the project resource group

From the Azure portal home page, in the search box, enter Resource groups.

Select the guided-project-rg resource group.

Select Delete resource group.

Replicate same process to delete the Networkwatcher.

Conclusion

Resource cleanup is an often-overlooked but essential aspect of Azure administration. By verifying resource locks before deletion and removing resource groups that are no longer needed, administrators can avoid unnecessary cloud costs while maintaining a well-managed Azure environment.

Following a structured cleanup process not only improves operational efficiency but also reinforces good cloud governance practices. Whether you're completing a lab, testing a proof of concept, or decommissioning production resources, making cleanup a standard part of your workflow helps ensure that your Azure subscription remains secure, organized, and cost-effective.

I hope this walkthrough provides a practical reference for safely decommissioning Azure resources. If you have additional recommendations or preferred strategies for Azure resource lifecycle management, feel free to share them in the discussion.

Mastering Azure Storage Security: A Hands-On Guide to Controlling Storage Access

Oladimeji Zainab — Fri, 03 Jul 2026 12:37:35 +0000

Introduction.

Effective Azure Virtual Machine administration extends beyond deployment. As workloads evolve, administrators must be able to manage VM security, optimize resource utilization, maintain storage, and implement operational controls that improve both performance and cost efficiency.

In this guide, I demonstrate several essential Azure VM management tasks using the Azure portal. The walkthrough covers moving a virtual machine to a different subnet, vertically scaling the VM to accommodate changing compute requirements, attaching a managed data disk to expand storage capacity, and configuring automatic shutdown to minimize unnecessary Azure costs. These are practical operations that reflect common administrative responsibilities in enterprise Azure environments and are valuable skills for both cloud practitioners and Azure certification candidates.

Create a storage container.

From the Azure portal home page, in the search box, enter storage accounts.

Select the storage account you created in the Previous exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)

On the storage account blade, under the Data storage submenu, select Containers.

Select + Add container.

In the Name field, enter storage-container.

Select Create.

Upload a file to the storage container

Select the storage container you just created.

Select Upload and upload the file you prepared.

Once the file is ready for upload, select Upload.

Change the access tier

Select the file you just uploaded (the file name is a hyperlink).

Select Change tier.

Select Cold.

Select Save.

Create a file share

From the Azure portal home page, in the search box, enter storage accounts.

Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)

On the storage account blade, under the Data storage submenu, select File shares.

Select + File share.

On the Basics tab, in the name field enter file-share

On the Backup tab, uncheck Enable backup.

Select Review + create.

Select Create.

Once the file share is created, select Upload.

Upload the same file you uploaded to the blob storage or a different file, it’s up to you.

Create a shared access signature token

From the Azure portal home page, in the search box, enter storage accounts.

Select the storage account you created in the Prepare exercise.

On the storage account blade, select Storage browser.

Expand Blob containers.

Select the storage container you created earlier, storage-container.

Select the ellipses (three dots) on the end of the line for the image you uploaded.

Select Generate SAS

Set Signing method to Account key.

Set Signing key to Key 1.

Set Stored access policy to None.

Set Permissions to Read.

Enter a custom start and expiry time or leave the defaults.

Set Allowed protocols to HTTPS only.

Select Generate SAS token and URI.

Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.

Rotate access keys

From the Azure portal home page, in the search box, enter storage accounts.

Select the storage account you created in the Prepare exercise.

Expand the Security + networking submenu and Select Access keys.

For Key 1, select Rotate key.

Read and then acknowledge the warning about regenerating the access key by selecting Yes.

Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error.

Conclusion.

Managing Azure Virtual Machines effectively requires a balance between performance, scalability, and operational efficiency. By completing the tasks in this guide, we've explored how to reconfigure a VM's network placement, increase its compute capacity through vertical scaling, extend its storage with managed disks, and automate shutdown schedules to optimize cloud spending.

These capabilities form part of the day-to-day responsibilities of Azure administrators and cloud engineers, making them fundamental skills for maintaining reliable and cost-effective cloud infrastructure. As you continue working with Azure, incorporating these management practices into your workflow will help you build more resilient, scalable, and efficient environments.

Thank you for taking the time to read this walkthrough. If you've implemented similar VM management strategies or have additional recommendations for optimizing Azure workloads, I'd be glad to hear your thoughts in the discussion below.

Managing Azure Virtual Machines: A Hands-On Guide to Networking, Scaling, Storage, and Auto-Shutdown

Oladimeji Zainab — Fri, 03 Jul 2026 12:15:15 +0000

Introduction.

Managing virtual machines efficiently is an essential skill for anyone working with Microsoft Azure. Beyond simply creating a VM, administrators often need to modify its network configuration, scale its compute resources to meet changing workloads, expand storage capacity, and implement cost-saving measures such as automatic shutdown.

In this hands-on guide, I'll walk through the practical steps I performed to manage an Azure Virtual Machine using the Azure portal. Specifically, you'll learn how to move a VM to a different subnet, vertically scale the VM to a larger size, attach a new data disk for additional storage, and configure automatic shutdown to help reduce unnecessary Azure costs. Whether you're preparing for the AZ-104 certification or building your Azure administration skills, these tasks represent common real-world VM management operations you'll encounter in cloud environments.

Move the virtual machine network to the new subnet

From the Azure portal home page, in the search box, enter virtual machines and Select virtual machines under services.

Select the guided-project-vm virtual machine.

If the virtual machine is running, select Stop.

Wait for the Status field to update and show Stopped (deallocated).

Within the Networking subsection of the menu, select Network settings.

Select the Network interface / IP configuration hyperlink for the VM.

On the IP Configurations page, update the Subnet to ftpSubnet.

Select Apply.

Select Home to return to the Azure portal home page.

Vertically scale the virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.

Select the guided-project-vm virtual machine.

Locate the Availability + scale submenu and select Size.

Select a new VM size D2s_v3 for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)

Select Resize

Attach data disks to a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.

Select the guided-project-vm virtual machine.

Locate the settings submenu and select Disks.

Select Create and attach a new disk.

Leave LUN as default.

Enter ftp-data-disk for the Disk name.

Leave the Storage type as default.

Enter 20 for the Size

Select Apply to create the new storage disk and attach the disk to the machine.

Configure automatic shutdown on a virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.

Select the guided-project-vm virtual machine.

Under the Operations submenu, select Auto-shutdown.

In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.

![format(https://dev-to-uploads.s3.us-east-2.amazonaws.com/uploads/articles/iv6apbtk2ah284fntbvt.png)

Select Save.

Conclusion.

Successfully managing Azure Virtual Machines goes far beyond deployment—it involves continuously optimizing networking, performance, storage, and operational costs. In this walkthrough, we covered how to migrate a VM to a new subnet, resize it to accommodate increased workloads, attach additional storage using a managed data disk, and configure automatic shutdown to avoid unnecessary compute charges.

These are fundamental Azure administration tasks that every cloud engineer should be comfortable performing. Mastering them not only improves your understanding of Azure infrastructure but also prepares you for real-world production environments where virtual machines must be maintained efficiently and cost-effectively.

I hope this guide helps you follow along with your own Azure lab or learning journey. If you found it useful, feel free to leave a comment, share your experience, or connect with me here on Dev.to. Happy learning and happy building!

Azure Networking Fundamentals: How to Create and Secure Subnets with Network Security Groups

Oladimeji Zainab — Thu, 18 Jun 2026 06:05:17 +0000

Introduction

Network segmentation and access control are critical components of a secure cloud environment. In Microsoft Azure, subnets help organize resources within a virtual network, while Network Security Groups (NSGs) provide granular control over inbound and outbound traffic.

In this guide, I will walk through the process of creating a dedicated subnet, configuring a Network Security Group, defining an inbound security rule, and associating the NSG with the subnet. These steps demonstrate how to strengthen network security and establish controlled access to resources within an Azure Virtual Network.

From the Azure portal home page, in the search box, enter virtual networks.

Select the guided-project-vnet virtual network.

From the guided-project-vnet blade, under settings, select Subnets.

For Subnet purpose leave it as Default.
For Name enter: ftpSubnet

Leave the rest of the settings alone and select Add.

Create a network security group

From the Azure portal home page, in the search box, enter virtual networks.

Select virtual networks under services

Select Network security groups.

Select + Create.

Verify the subscription is correct.

Select the guided-project-rg resource group.

Enter ftpNSG for the network security group name.

Select Review + create.

Once the validation is complete, select Create.

Wait for the screen to refresh and display Your deployment is complete.

Select Go to resource.

Create an inbound security rule

Under settings, select Inbound security rules.

Select + Add.

Change the Destination port ranges from 8080 to 22.

Select TCP for the protocol.

Set the name to ftpInbound.

Select Add.

Associate a network security group to a subnet

From the Azure portal home page, in the search box, enter virtual networks.

Select virtual networks under services.

Select the guided-project-vnet virtual network.

Under settings, select Subnets.

Select the ftpSubnet you created.

On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.

Select Save.

Conclusion

By completing these configurations, you have successfully created a dedicated subnet, deployed a Network Security Group, configured an inbound security rule, and associated the NSG with the subnet. This setup enhances the security posture of your Azure environment by allowing only authorized traffic to reach resources within the network.

Understanding and implementing network segmentation and security controls are essential cloud administration skills. As you continue your Azure journey, these foundational concepts will help you design more secure, scalable, and resilient cloud infrastructures.

Azure Infrastructure Setup Guide: Creating Resource Groups, Virtual Networks, Virtual Machines, and Storage Accounts

Oladimeji Zainab — Thu, 18 Jun 2026 01:32:00 +0000

Introduction

In this guide, we will walk through the process of setting up essential Azure resources required for a cloud infrastructure environment. The setup includes creating a Resource Group, Virtual Network, Virtual Machine, and Storage Account using the Microsoft Azure Portal.

These foundational resources are critical building blocks for deploying, managing, and scaling cloud workloads effectively. By following the step-by-step instructions outlined in this guide, you will gain hands-on experience with Azure resource provisioning and develop a solid understanding of core cloud infrastructure components.

Create a resource group

Select Create.

Enter guided-project-rg in the Resource group name field.

The Region field will automatically populate. Leave the default value.

Select Review + create.

Select Create.

Return to the home page of the Azure portal by selecting Home.

Create a virtual network with one subnet

From the Azure portal home page, in the search box, enter virtual networks.

Select Create

Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.

Select Review + create.

Select Create.

Wait for the screen to refresh and show Your deployment is complete.

Create a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.

Select Create and then select Virtual machine

Select guided-project-rg for the Resource group.

Enter guided-project-vm for the Virtual machine name.

For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)

Continue further on the Basics page to the Administrator account section and Select Password for authentication type.

Enter guided-project-admin for the admin Username.

Enter a password for the admin account.

Confirm the password for the admin account.

Leave the rest of the settings as default settings. You can review the settings if you like, but shouldn’t change any.

Select Review + create

Select Create to confirm the resource cost and create the virtual machine.

Create a Storage account

From the Azure portal home page, in the search box, enter storage accounts.

Select Create

Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.

Select Review + create.

Select Create.

Wait for the screen to refresh and show Your deployment is complete.

Conclusion

Congratulations on successfully completing the setup process. In this exercise, you provisioned key Azure resources, including a Resource Group, Virtual Network, Virtual Machine, and Storage Account. These services form the foundation of many cloud-based solutions and are essential for deploying, managing, and securing applications in Microsoft Azure.

Through this practical implementation, you have gained valuable experience navigating the Azure Portal and creating core infrastructure components. This knowledge serves as a strong foundation for more advanced cloud engineering, DevOps, and infrastructure management tasks as you continue your Azure learning journey.

Provision of Storage for a new Company App

Oladimeji Zainab — Mon, 25 May 2026 09:40:23 +0000

Introduction

In today’s cloud-driven environments, securing data at rest and ensuring controlled access are critical components of any robust architecture. Microsoft Azure provides a comprehensive set of tools that enable organizations to build secure, scalable, and compliant storage solutions.

In this guide, we walk through the end-to-end process of provisioning a storage account and enhancing its security using managed identities, role-based access control (RBAC), and customer-managed encryption keys. Beyond basic configuration, this setup demonstrates how to enforce least-privilege access, integrate secure key management with Azure Key Vault, and apply advanced data protection features such as immutable storage and encryption scopes.

By the end of this walkthrough, you will have a secure and production-ready storage configuration that aligns with modern cloud security best practices.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.

Check the box for Enable infrastructure encryption.

Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create

Wait for the resource to deploy.

Provide a managed identity for the web app to use.

Search for and select Managed identities.

Select Create

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

Create a key vault to store the access keys.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page)

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault.

Return to your the storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

Navigate to your storage account.

In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.

Be sure to Save your changes.

Try to delete the file in the container and Verify you are notified failed to delete blobs due to policy.

The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.

In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.

Create the encryption scope.

Return to your storage account and create a new container and in the advanced section select the Encryption scope you created and apply it to all blobs in the container.

Conclusion

This implementation goes beyond simply creating a storage account—it establishes a strong security foundation for managing sensitive data in the cloud. By leveraging managed identities, assigning precise RBAC roles like Storage Blob Data Reader, and integrating with Azure Key Vault for customer-managed keys, you ensure that access to your storage resources is both controlled and auditable.

Additionally, the use of infrastructure encryption, immutable blob storage policies, and encryption scopes demonstrates how to meet higher compliance and data protection requirements. These practices are essential for organizations operating in regulated environments or handling critical business data.

Adopting these configurations not only improves security posture but also aligns your architecture with industry standards for cloud governance, making your solutions more resilient, scalable, and enterprise-ready.

Provision of shared file storage for the company offices

Oladimeji Zainab — Fri, 22 May 2026 05:43:28 +0000

Introduction

In today’s data-driven enterprise environment, the need for secure, scalable, and highly available file storage solutions is critical to supporting business operations across distributed teams. Microsoft Azure provides a robust platform for building such solutions through its managed storage services.

This guide walks through the end-to-end process of provisioning a premium file storage solution using Azure Storage Accounts, configuring file shares for organizational use, and implementing data protection through snapshots. It also demonstrates how to enhance security by restricting access to selected virtual networks, ensuring that corporate data remains protected while still being accessible to authorized resources.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements(It must be globally unique).

Set the Performance to Premium.

Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to resource.

Create a file share for the corporate office.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.

Upload a file of your choosing.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Select your file share.

In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.

Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore

Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.:This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.

Select Go to resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section choose Microsoft.Storage in the Services drop-down.

Do not make any other changes.

Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints..

Return to your files storage account.

In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.

Select your virtual network and subnet, select Add.

Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Conclusion

By completing this deployment, a secure and enterprise-grade file storage infrastructure has been successfully established using Azure’s native capabilities. The implementation not only enables centralized file sharing for departments such as finance but also incorporates critical safeguards including snapshot-based recovery and network-level access controls.

This approach reflects best practices in cloud storage architecture—balancing performance, resilience, and security. As organizations continue to scale in the cloud, leveraging these capabilities within Azure ensures operational efficiency, data integrity, and controlled access across business units.