Top 8 Azure Cloud Services Every Java Developer Should Know

Azure offers hundreds of services, and most of them will never matter to a typical Java team. A small set covers the majority of enterprise workloads: running the application, storing data, handling messages, managing secrets, and seeing what happens in production. This article walks through eight services that appear again and again in Java architectures on Azure, explains what each one is for, and shows how a Spring Boot application uses several of them together.

The services are grouped by the job they do in a system: where code runs, where data lives, how components communicate, and how you operate them safely. Code examples use the official Azure SDK for Java, which follows a consistent pattern: a builder creates a client, and the client authenticates with DefaultAzureCredential, which works locally with your developer login and in Azure with a managed identity.

1. Azure App Service

App Service is a managed platform for web applications and APIs. You deploy a Spring Boot JAR or WAR, and Azure handles the operating system, patching, load balancing, TLS certificates, and scaling. For many Java teams, it is the simplest production target: no containers to build, no cluster to manage.

App Service supports deployment slots, which let you deploy a new version to a staging slot, verify it, and swap it into production with minimal downtime. It also integrates with managed identities, so the application can call other Azure services without storing credentials.

Use App Service when you have one or a few web services with straightforward scaling needs and your team prefers to focus on application code rather than platform operations.

2. Azure Kubernetes Service (AKS)

AKS is managed Kubernetes. When you have many services, custom networking needs, sidecars, or a platform team that already standardizes on Kubernetes, AKS gives you the control you need without operating the control plane yourself. Azure manages the API server and upgrades, while you manage node pools, deployments, and ingress.

AKS is powerful, and it brings real operational responsibility. Many teams adopt it too early. A good rule is to choose AKS when your workload genuinely needs Kubernetes features, not because microservices sound like they require it.

For smaller container workloads that do not need full Kubernetes, Azure Container Apps offers a simpler serverless container platform built on Kubernetes concepts, and is worth evaluating first.

3. Azure Functions

Azure Functions runs small units of code triggered by events: an HTTP request, a message on a queue, a file uploaded to storage, a timer. You pay for execution rather than for idle servers, and scaling happens automatically.

Java support is available through the Azure Functions Java worker and annotations such as @HttpTrigger. A minimal HTTP function looks like this:

import com.microsoft.azure.functions.*;
import com.microsoft.azure.functions.annotation.*;

public class InvoiceFunctions {

    @FunctionName("getInvoiceStatus")
    public HttpResponseMessage run(
            @HttpTrigger(name = "req", methods = {HttpMethod.GET},
                    authLevel = AuthorizationLevel.FUNCTION,
                    route = "invoices/{id}") HttpRequestMessage<java.util.Optional<String>> request,
            @BindingName("id") String id,
            final ExecutionContext context) {

        context.getLogger().info("Checking status for invoice " + id);
        return request.createResponseBuilder(HttpStatus.OK)
                .body("{\"id\":\"" + id + "\",\"status\":\"PAID\"}")
                .build();
    }
}

Functions work well for event-driven integration, scheduled jobs, and lightweight APIs. Keep in mind that Java functions have cold-start characteristics, so latency-sensitive endpoints may need a premium plan or a different host.

4. Azure Cosmos DB

Cosmos DB is a globally distributed, multi-model database with single-digit millisecond latency at the 99th percentile, according to Microsoft's published service-level targets for reads and writes within a region. It offers several APIs, including NoSQL, MongoDB, Cassandra, Gremlin, and Table. For Java, the NoSQL API with the azure-cosmos SDK is the most common choice.

Cosmos DB works best when you design around partition keys from the start. Choosing a poor partition key creates hot partitions, which limit throughput no matter how many resources you buy. Consistency levels are another decision point: strong consistency protects correctness, while session consistency is usually the default balance for user-facing applications.

import com.azure.cosmos.CosmosClient;
import com.azure.cosmos.CosmosClientBuilder;
import com.azure.cosmos.CosmosContainer;
import com.azure.identity.DefaultAzureCredentialBuilder;

public class CosmosSetup {

    public static CosmosContainer orders(String endpoint, String databaseName, String containerName) {
        CosmosClient client = new CosmosClientBuilder()
                .endpoint(endpoint)
                .credential(new DefaultAzureCredentialBuilder().build())
                .buildClient();

        return client.getDatabase(databaseName).getContainer(containerName);
    }
}

Using DefaultAzureCredential here means no account keys are stored in configuration files, which is a good default for any service that supports Microsoft Entra ID authentication.

5. Azure Database for PostgreSQL (Flexible Server)

Many Java applications are relational at heart, and PostgreSQL is a popular choice. Azure Database for PostgreSQL Flexible Server provides a managed PostgreSQL instance with automated backups, high availability options, maintenance windows, and monitoring. You still write standard JDBC or JPA code, and Spring Boot connects with its usual configuration.

A practical setting for Spring Boot is to store the connection details in configuration, and let Azure handle the lifecycle of the server. Enable zone-redundant high availability for production workloads that cannot tolerate long outages, and enforce SSL connections in the connection string.

spring:
  datasource:
    url: jdbc:postgresql://myserver.postgres.database.azure.com:5432/orders?sslmode=require
    username: ${DB_USER}
    password: ${DB_PASSWORD}
  jpa:
    hibernate:
      ddl-auto: validate

For passwordless access, Azure also supports Microsoft Entra authentication with managed identities, which removes the password from configuration entirely. That is worth adopting once your team is comfortable with the setup.

6. Azure Service Bus

Service Bus is a managed enterprise messaging service with queues and topics. It guarantees delivery with at-least-once semantics, supports sessions for ordered processing, dead-letter queues for messages that cannot be processed, and scheduled delivery. It is the right tool when you need reliable asynchronous communication between services, especially for business workflows where losing a message is unacceptable.

Sending a message from Java uses the azure-messaging-servicebus SDK:

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.messaging.servicebus.ServiceBusClientBuilder;
import com.azure.messaging.servicebus.ServiceBusMessage;
import com.azure.messaging.servicebus.ServiceBusSenderClient;

public class OrderPublisher {

    private final ServiceBusSenderClient sender;

    public OrderPublisher(String namespace) {
        this.sender = new ServiceBusClientBuilder()
                .fullyQualifiedNamespace(namespace + ".servicebus.windows.net")
                .credential(new DefaultAzureCredentialBuilder().build())
                .sender()
                .queueName("orders")
                .buildClient();
    }

    public void publish(String orderId, String payloadJson) {
        ServiceBusMessage message = new ServiceBusMessage(payloadJson);
        message.setMessageId(orderId);      // enables duplicate detection when configured
        message.setSubject("OrderPlaced");
        sender.sendMessage(message);
    }
}

Because delivery is at least once, consumers must be idempotent. Setting a message ID and enabling duplicate detection on the queue catches many accidental duplicates on the send side, but the consumer still needs to handle redelivery safely.

7. Azure Key Vault

Key Vault stores secrets, keys, and certificates, and controls access to them with Microsoft Entra ID. It removes secrets from source code, configuration files, and container images. It also provides audit logs of who accessed what, and supports rotation.

With Spring Cloud Azure, a Spring Boot application can load secrets from Key Vault as properties, which keeps application code clean. Alternatively, the SDK gives direct access:

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;

public class SecretReader {

    private final SecretClient client;

    public SecretReader(String vaultUrl) {
        this.client = new SecretClientBuilder()
                .vaultUrl(vaultUrl)
                .credential(new DefaultAzureCredentialBuilder().build())
                .buildClient();
    }

    public String read(String name) {
        return client.getSecret(name).getValue();
    }
}

Grant the application's managed identity only the permissions it needs, such as "get" on specific secrets, rather than broad access to the whole vault. Least privilege applies to secrets as much as to code.

8. Azure Monitor and Application Insights

Production systems fail in ways that are hard to predict. Azure Monitor collects metrics and logs across your resources, and Application Insights adds application-level telemetry: request rates, dependency calls, exceptions, and distributed traces. For Java, the simplest start is the Application Insights Java agent, which instruments common frameworks such as Spring Boot, JDBC, and HTTP clients without code changes.

Attaching the agent requires only a JVM argument and a connection string:

java -javaagent:/opt/agents/applicationinsights-agent.jar \
     -jar orders-service.jar

The connection string is set through an environment variable or configuration, not hard-coded. Once telemetry flows, build alerts on the signals that matter to users, such as failed requests, slow dependencies, and rising queue depth in Service Bus. Dashboards are useful, but alerts that wake the right person are what keep incidents short.

How the services fit together

A common Java architecture on Azure looks like this. A Spring Boot service runs on App Service or AKS and handles HTTP requests. It stores transactional data in PostgreSQL and product catalog documents in Cosmos DB. When an order is placed, it publishes an event to Service Bus. An Azure Function consumes that event to send a notification. Secrets such as database passwords and API keys are read from Key Vault through managed identities. Application Insights traces a request from the HTTP call through the database query and the message publication.

Notice what the design avoids: no shared credentials in code, no direct coupling between the order service and the notification logic, and full visibility into what happened. Each service does one job, and the platform handles the undifferentiated work.

Common mistakes

• Storing connection strings and keys in source control. Use managed identities and Key Vault from the start. Retrofitting this later is painful.
• Choosing AKS by default. Many workloads run more simply on App Service or Container Apps.
• Ignoring partition keys in Cosmos DB. A poor choice is expensive to fix after data has grown.
• Assuming messages arrive once. Design consumers to tolerate duplicates.
• Skipping observability until production. Enable telemetry in the first deployment, not the first incident.

A roadmap for adopting Azure as a Java team

Weeks 1 to 2: Deploy one existing Spring Boot service to App Service with a managed identity. Move its secrets to Key Vault and confirm the application starts without any stored credentials.

Weeks 3 to 4: Enable Application Insights with the Java agent, and build a dashboard and alerts for error rate and latency. Move the database to Azure Database for PostgreSQL Flexible Server with Entra authentication if it is not already there.

Weeks 5 to 6: Introduce Service Bus for one asynchronous workflow, with idempotent consumers and a dead-letter monitoring process. Add an Azure Function for one event-driven task.

Weeks 7 and beyond: Evaluate whether any workload truly needs AKS or Cosmos DB, based on measured requirements rather than preference, and adopt them where the case is clear.

Key takeaways

• App Service is the simplest path for Java web services; choose AKS only when you need Kubernetes features.
• Azure Functions suits event-driven and lightweight workloads, with attention to cold starts.
• Cosmos DB rewards careful partition key design and a deliberate consistency choice.
• PostgreSQL Flexible Server gives you a managed relational database that works with standard JDBC and JPA.
• Service Bus provides reliable messaging, and consumers must be idempotent.
• Key Vault and managed identities remove secrets from code and configuration.
• Application Insights with the Java agent gives you production visibility with minimal code changes.

Azure is broad, but a Java team can be productive with a focused set of services. Start with the ones that solve a problem you have today, apply security and observability from the first deployment, and expand only when the requirements call for it.