Short, honest write-ups of the ideas that come up in interviews and on the job. Each one teaches the concept properly, cites the Microsoft documentation, and points back to the class that drills it until it sticks.
A sequenced learning path, not another glossary: what transfers instantly from VPC-land, the behavior differences that break AWS reflexes — subnet scope, NSGs, private endpoints and the DNS dance — and the labs to run in order.
All three are private software-defined networks you carve into subnets — but the regional model is genuinely different: Azure regional, AWS subnets pinned per-AZ, GCP global. Here's where that difference bites.
UDRs override Azure's default routing. System routes, next-hop types, forcing traffic through a firewall, and route precedence.
The NSG is the firewall; an ASG is a label on VMs for cleaner rules. A web-tier to app-tier example without hard-coded IPs.
Connecting Azure VNets? Peering is the default — Microsoft's backbone, low latency, no gateway. Reach for a VPN gateway only when you must.
Both spread traffic across your backends, but one moves packets without ever looking inside them and the other reads the HTTP request to decide where it goes — and that single difference decides which one you reach for.
A private endpoint is how you consume a service privately; Private Link Service is the mirror image — how you publish yours, behind a Standard Load Balancer, so customers connect over a private endpoint instead of a public IP. The pattern behind private SaaS on Azure.
Both route users to the nearest healthy region — but Front Door stands in the traffic path with a CDN, TLS offload, and a WAF, while Traffic Manager just answers a DNS query and vanishes. Which one you need depends entirely on where it sits.
Give a VM a public IP and open port 3389, and the internet's bots start guessing passwords within minutes. Bastion is how you get a shell on a private VM over TLS from the portal — no public IP, no open management port, no jump box to patch.
Your VMs need to reach the internet without wearing a target. One managed resource gives a whole subnet a clean, private way out through static IPs — and quietly fixes the SNAT-port-exhaustion bug most people only meet at 2am.
Every connection starts with one question: what IP is this name? Public zones answer the internet, private zones answer your virtual network, and a surprising amount of "the network is down" turns out to be DNS in a trench coat.
It does not read your requests — it reads your connections. A layer-4 look at how Azure spreads TCP and UDP across a backend pool, skips the sick instances with health probes, and where Application Gateway takes over.
Your datacenter needs to talk to Azure. You can send that traffic through an encrypted tunnel over the public internet, or over a private circuit that never touches it — shared road or private rail.
Sooner or later two Azure networks need to talk. Peering lets them — privately, over Microsoft's backbone, no gateway, no public internet. There is just one rule (non-transitivity) that surprises everyone.
Two features with confusingly similar names both keep a service off the open internet — in opposite ways. One locks the public door to your subnet; the other gives the service a private IP. The difference decides which is right.
Both are layer-7, both route by URL, both bolt on a WAF — so people pick wrong. The difference is one word: where. One lives inside a single region; the other lives at Microsoft's global edge.
A network security group is a free packet filter that reasons about IP addresses and ports. Azure Firewall is a managed service that reasons about names and threats. They work at different altitudes — mature networks run both.
A private endpoint drops a real network card, with a private IP from your own subnet, in front of a public Azure service. Here is what that actually means, how it differs from a service endpoint, and the one DNS gotcha that trips everyone.
One short, honest Azure note at a time — plus the occasional hiring signal. No spam, no card, unsubscribe in one click.