LOCKEDIN / FORWARD-DEPLOYED ENGINEERING 101
Understand it.
Then build it.
You can be an experienced engineer and still be new to agents. Start with what each thing is and how it helps a person do useful work. Explore 58 original introductions across software, agents, cloud, security and delivery. Start here without a model key; each topic connects to deeper instruction and practice.
A place to start.
Choose a short reading route, or look up a concept below.
- 101UnderstandPlain language, visual walkthrough, vocabulary
- 102Build with guidanceOriginal lessons, examples and knowledge checks
- 103Practise and explainRunnable labs, failure cases and handover
Plan a cloud deployment
Compare how Azure subscriptions, resource groups and networks organize the same workload.
See the 7-concept route
For engineers moving an application into a customer environment. This route introduces the concepts before provider setup and deeper labs.
- 01The environmentLocate the application, its data and the responsibilities shared with a cloud provider.
- 02NetworkingTrace how a request reaches a service before choosing public or private access.
- 03IdentityDistinguish reaching a service from being allowed to use its data or actions.
- 04Google CloudApply those boundaries to Google Cloud projects, regions and instances.
- 05AzureYou are here
- 06AWSCompare AWS accounts, regions, Availability Zones and instances without assuming the services are interchangeable.
- 07Private inferenceDecide which model-serving responsibilities become yours when you operate the runtime.
Bookmark this page to return to this concept. The number shows your place in the reading route; it is not an assessment result.
Microsoft Azure101 / LEARNING STUDIOA cloud platform · subscriptions, servers and services
What is Microsoft Azure?
Microsoft Azure is a collection of computing services you use over a network. Azure Virtual Machines runs servers, Blob Storage holds objects such as files, and other services provide databases, networking and AI capabilities. Microsoft operates the physical infrastructure; your team chooses how the application uses it and configures access, locations and cost controls.
Before an FDE adds an AI model, the customer needs a clear answer to which tenant, subscription and resource group will own and govern the delivered work.
UNDERSTAND THE SYSTEM
Azure: identity, ownership and location have separate layers
Follow the tenant, subscription and resource group, then inspect where the VM actually runs. These are management relationships, not a network route.
Read the connections in plain English
- 01Entra tenant → Subscription
The subscription is associated with this directory. Authorization still determines what each identity may do.
- 02Subscription → Resource group
Choose the intended subscription before managing the resource group.
- 03Resource group → Azure VM
The VM is managed in this resource group in the fictional example.
- 04Resource group → Storage account
The storage account is also in the group. A shared group does not grant data access.
- 05Azure VM → VM region
Inspect the VM's location rather than inferring it from the group's location or name.
- 06Azure VM → Storage account
The app needs the appropriate data permission and network path, even when both resources share a group.
Check your understanding: Does a resource group's location prove where its VM runs?
No. The group's metadata location and the VM's region can differ. Inspect the VM resource and the storage account themselves before making a location claim.
CONNECT IT TO WHAT YOU KNOW
Start with something familiar.
An identity directory is like the company's staff and service-identity register. A subscription is an administrative and spending scope. A resource group is a project folder for related equipment; the individual resources do the actual work.
The folder comparison is about management, not geography or network reachability. Resources in one group can have different locations. A group's location does not prove where its server or stored documents live.
Words worth knowing
- Microsoft Entra tenant
- The identity directory containing identities used to authenticate and access resources.
- Subscription
- An Azure resource-management and billing scope associated with one tenant.
- Resource group
- An administrative container for related resources within a subscription.
- Azure Virtual Machine
- A software-defined server with an operating system and allocated compute.
- Blob Storage
- Object storage accessed through a storage account and containers, separate from VM memory.
ONE EXAMPLE / FICTIONAL CASE
Follow the connections.
A fictional maintenance team plans a document assistant. Its training subscription contains a resource group for the server and storage. The team's identity directory is separate from those running resources.
UNDERSTAND THE SYSTEM
Azure: identity, ownership and location have separate layers
Follow the tenant, subscription and resource group, then inspect where the VM actually runs. These are management relationships, not a network route.
See what moves and why.
Read the connections in plain English
- 01Entra tenant → Subscription
The subscription is associated with this directory. Authorization still determines what each identity may do.
- 02Subscription → Resource group
Choose the intended subscription before managing the resource group.
- 03Resource group → Azure VM
The VM is managed in this resource group in the fictional example.
- 04Resource group → Storage account
The storage account is also in the group. A shared group does not grant data access.
- 05Azure VM → VM region
Inspect the VM's location rather than inferring it from the group's location or name.
- 06Azure VM → Storage account
The app needs the appropriate data permission and network path, even when both resources share a group.
Check your understanding: Does a resource group's location prove where its VM runs?
No. The group's metadata location and the VM's region can differ. Inspect the VM resource and the storage account themselves before making a location claim.
Work through it, step by step.
Separate identity from ownership
A Microsoft Entra tenant is an identity directory. An Azure subscription is a resource-management and billing scope associated with a tenant. Signing in to the correct tenant does not tell you which subscription a command will use.
What you have now: A confirmed tenant and approved subscription.
Group related resources
A resource group organizes related resources within a subscription, often around a shared lifecycle. A virtual machine and a storage account can belong to that group. The group is an administrative container, not a server or a network.
What you have now: A named resource group and the resources it manages.
Choose location and access
A VM runs in a selected Azure region, with availability options supported there. A resource group's location stores its metadata; it does not force all member resources into that region. Configure the app's identity and data access before adding a model endpoint.
What you have now: Resource-specific locations and an explicit permission plan.
FROM RECOGNITION TO REASONING
Explain Azure's layers before provisioning a server.
- 01
Draw a tenant, a training subscription and a resource group, then place a VM and storage account in the group.
- 02
Label the VM's region separately from the resource group's metadata location.
- 03
Imagine the group was created in one region and the VM in another. Decide which setting you must inspect to find where the server runs.
A labeled environment map with separate ownership, identity and location evidence.
Compare your reasoning when you are ready
Inspect the VM's actual location. The resource group's location concerns its metadata and does not relocate a member VM. Likewise, the tenant confirms the identity directory, while the subscription identifies the selected resource-management scope.
Keep notes in your own working copy. Moving through these cards does not record completion.
TURN THE IDEA INTO USEFUL WORK
You can now go deeper.
Keep the identity directory, subscription, resource group and resource location separate. Microsoft Foundry is an AI platform within the broader Azure ecosystem; it is not the starting definition of Azure.
Academy lessons use your existing training access. Free guides stay open.