Azure in Practice: Where It Fits and What to Get Right Early

Azure's strongest argument is rarely a specific service. It is that your organisation probably already runs on Microsoft identity, and Azure is built around it.

If your staff sign in with a Microsoft work account, your devices are managed through Intune, and your documents live in Microsoft 365, then Azure is not a new platform — it is the same identity and management model extended to infrastructure. That is a genuine advantage, and it is the thing to weigh most heavily.

The services that cover most needs#

App Service deserves particular attention: for a straightforward web application it removes most infrastructure work, and many organisations reach for virtual machines out of habit when App Service would be simpler and cheaper to operate.

Identity is the centre#

Get this right and much of Azure becomes straightforward. Get it wrong and you will fight it continuously.

Use managed identities for applications. An application authenticating to a database or storage account should do so with an identity Azure manages — no connection string, no secret to rotate, no credential to leak. This is one of Azure's genuinely strong features and it is under-used.

Role-based access, assigned to groups. Assign roles to groups rather than individuals, and keep the number of custom roles small. Access that accumulates per-person becomes impossible to review.

Conditional access. Require MFA, restrict by device compliance or location. This is where the existing Microsoft estate pays off — the same policies covering email extend to infrastructure.

Separate privileged accounts. Administrative work from a dedicated account, not the one used for email.

Decisions that are painful later#

Subscription and management group structure. Separate subscriptions for production and non-production, organised under management groups. This gives a hard blast radius and clean cost separation. Retrofitting it after everything lives in one subscription is a migration project.

Region. Data residency, latency and price vary. Moving later means moving data.

Naming and tagging conventions. Decide once, enforce with policy. Owner, environment, cost centre on every resource. Untagged resources are never deleted, because nobody dares.

Azure Policy from the start. Policy can prevent non-compliant resources being created at all — requiring tags, restricting regions, blocking public storage access. Preventing is far cheaper than finding and fixing.

Infrastructure as code. Portal-created resources are invisible, unreviewable and unreproducible. Bicep or Terraform, in version control.

The licensing question#

This is where Azure's commercial case is genuinely differentiated, and it is worth doing the arithmetic properly rather than assuming.

Azure Hybrid Benefit lets you apply existing Windows Server and SQL Server licences with Software Assurance to Azure compute, which can reduce cost substantially for Windows-heavy estates. Reserved instances and savings plans discount committed baseline usage. Dev/Test pricing is meaningfully cheaper for non-production subscriptions and is frequently left unclaimed.

For an organisation already holding Microsoft licences, these can change the comparison against other providers materially. For an organisation running entirely Linux and open-source, they are irrelevant — and the comparison should be made on other grounds.

Cost control#

The mechanics resemble every cloud, with Azure-specific names:

• Budgets and alerts on day one, per subscription
• Azure Advisor genuinely does surface unused and undersized resources — read it monthly
• Turn off non-production outside working hours; auto-shutdown is built in for VMs and often unused
• Watch orphaned resources — unattached disks and public IP addresses bill indefinitely and are the classic long tail
• Data egress and cross-region traffic, as everywhere
• Reserve only your provable baseline, never hoped-for growth

Where people get stuck#

Networking. Virtual networks, subnets, network security groups, private endpoints and DNS resolution are the single biggest source of "why can this not reach that". Private endpoints in particular have DNS implications that catch nearly everyone the first time.

Assuming managed means maintenance-free. Azure SQL still needs performance tuning, storage monitoring and someone watching for a database approaching its size limit.

Portal-driven changes. Convenient, and then nobody can reproduce the environment or explain why a setting differs. Use it to explore, then codify.

FAQ#

Azure or AWS?#

If your organisation is already Microsoft-centric — Entra ID, Microsoft 365, Windows Server, SQL Server — Azure's identity integration and licensing benefits are real and often decisive. Otherwise the platforms are broadly comparable for common workloads, and existing team skills matter more than feature comparisons.

Is Azure cheaper?#

For Windows and SQL Server workloads where you hold licences with Software Assurance, frequently yes. For Linux and open-source workloads, it is competitive rather than cheaper. Do the arithmetic with your actual licence position, not the list price.

What is Entra ID?#

Microsoft's identity service, previously called Azure Active Directory. It is what your staff sign in to for Microsoft 365, and it is the same directory that controls Azure access. Note it is not the same thing as traditional on-premises Active Directory, though the two are usually synchronised.

Do we need Azure if we use Microsoft 365?#

No — they are separate services. But you already have Entra ID, which means adopting Azure later starts with identity already in place, and single sign-on is not a project.

How should we structure subscriptions?#

At minimum, separate production from non-production. Beyond that, split by business unit or by application where cost ownership or access control genuinely differs. Management groups let you apply policy consistently across them.

What is the most common expensive mistake?#

Running virtual machines where a managed service would do — lifting servers into Azure unchanged, then paying rental rates for infrastructure you still have to patch. That captures almost none of the benefit and adds the margin.

How do we secure it properly?#

MFA everywhere, managed identities instead of connection strings, secrets in Key Vault, private endpoints for data services, Azure Policy preventing non-compliant resources, and Defender for Cloud turned on so you can see your posture. Most of that is configuration rather than cost.

What else is coming for Azure