LOCKEDIN / FORWARD-DEPLOYED ENGINEERING 101
Understand it.
Then build it.
You can be an experienced engineer and still be new to agents. Start with what each thing is and how it helps a person do useful work. Explore 52 original introductions across software, agents, cloud, security and delivery. Start here without a model key; each topic connects to deeper instruction and practice.
- 101UnderstandPlain language, visual walkthrough, vocabulary
- 102Build with guidanceOriginal lessons, examples and knowledge checks
- 103Practise and explainRunnable labs, failure cases and handover
Microsoft Azure101 / LEARNING STUDIOA cloud platform · subscriptions, servers and services
What is Microsoft Azure?
Microsoft Azure is a collection of computing services you use over a network. Azure Virtual Machines runs servers, Blob Storage holds objects such as files, and other services provide databases, networking and AI capabilities. Microsoft operates the physical infrastructure; your team chooses how the application uses it and configures access, locations and cost controls.
Before an FDE adds an AI model, the customer needs a clear answer to which tenant, subscription and resource group will own and govern the delivered work.
UNDERSTAND THE SYSTEM
Azure: identity, ownership and location have separate layers
Follow the tenant, subscription and resource group, then inspect where the VM actually runs. These are management relationships, not a network route.
Read the connections in plain English
- 01Entra tenant → Subscription
The subscription is associated with this directory. Authorization still determines what each identity may do.
- 02Subscription → Resource group
Choose the intended subscription before managing the resource group.
- 03Resource group → Azure VM
The VM is managed in this resource group in the fictional example.
- 04Resource group → Storage account
The storage account is also in the group. A shared group does not grant data access.
- 05Azure VM → VM region
Inspect the VM's location rather than inferring it from the group's location or name.
- 06Azure VM → Storage account
The app needs the appropriate data permission and network path, even when both resources share a group.
Check your understanding: Does a resource group's location prove where its VM runs?
No. The group's metadata location and the VM's region can differ. Inspect the VM resource and the storage account themselves before making a location claim.
CONNECT IT TO WHAT YOU KNOW
Start with something familiar.
An identity directory is like the company's staff and service-identity register. A subscription is an administrative and spending scope. A resource group is a project folder for related equipment; the individual resources do the actual work.
The folder comparison is about management, not geography or network reachability. Resources in one group can have different locations. A group's location does not prove where its server or stored documents live.
Words worth knowing
- Microsoft Entra tenant
- The identity directory containing identities used to authenticate and access resources.
- Subscription
- An Azure resource-management and billing scope associated with one tenant.
- Resource group
- An administrative container for related resources within a subscription.
- Azure Virtual Machine
- A software-defined server with an operating system and allocated compute.
- Blob Storage
- Object storage accessed through a storage account and containers, separate from VM memory.
ONE EXAMPLE / FICTIONAL CASE
Follow the connections.
A fictional maintenance team plans a document assistant. Its training subscription contains a resource group for the server and storage. The team's identity directory is separate from those running resources.
UNDERSTAND THE SYSTEM
Azure: identity, ownership and location have separate layers
Follow the tenant, subscription and resource group, then inspect where the VM actually runs. These are management relationships, not a network route.
See what moves and why.
Read the connections in plain English
- 01Entra tenant → Subscription
The subscription is associated with this directory. Authorization still determines what each identity may do.
- 02Subscription → Resource group
Choose the intended subscription before managing the resource group.
- 03Resource group → Azure VM
The VM is managed in this resource group in the fictional example.
- 04Resource group → Storage account
The storage account is also in the group. A shared group does not grant data access.
- 05Azure VM → VM region
Inspect the VM's location rather than inferring it from the group's location or name.
- 06Azure VM → Storage account
The app needs the appropriate data permission and network path, even when both resources share a group.
Check your understanding: Does a resource group's location prove where its VM runs?
No. The group's metadata location and the VM's region can differ. Inspect the VM resource and the storage account themselves before making a location claim.
FROM RECOGNITION TO REASONING
Explain Azure's layers before provisioning a server.
- 01
Draw a tenant, a training subscription and a resource group, then place a VM and storage account in the group.
- 02
Label the VM's region separately from the resource group's metadata location.
- 03
Imagine the group was created in one region and the VM in another. Decide which setting you must inspect to find where the server runs.
A labeled environment map with separate ownership, identity and location evidence.
Compare your reasoning when you are ready
Inspect the VM's actual location. The resource group's location concerns its metadata and does not relocate a member VM. Likewise, the tenant confirms the identity directory, while the subscription identifies the selected resource-management scope.
Keep notes in your own working copy. Moving through these cards does not record completion.
TURN THE IDEA INTO USEFUL WORK
You can now go deeper.
Keep the identity directory, subscription, resource group and resource location separate. Microsoft Foundry is an AI platform within the broader Azure ecosystem; it is not the starting definition of Azure.
Academy lessons use your existing training access. Free guides stay open.