okunola babatunde

Posted on Mar 13

Hands-On Azure Cloud Engineering: Managing Networks, Virtual Machines, Storage Blobs, and Resource Governance

#azure #cloudcomputing #cloudinfrastructure #teclearning

Cloud infrastructure is not just about launching servers in the cloud. It’s about designing systems that are organized, secure, scalable, and easy to manage over time. Recently, I worked on a hands-on Azure guided project where I practiced managing key parts of a cloud environment. The experience simulated assisting an Azure administrator with maintaining and improving an existing infrastructure. The project covered several important areas of cloud engineering, including:

Network configuration
Virtual machine management
Cloud storage services
Resource governance and protection

Although the work involved technical tools, the main idea behind it was simple: build systems that are easy to understand, monitor, and protect from mistakes.

Preparing the Azure Environment

The project required an active Azure subscription, since all tasks involved creating and managing real cloud resources. One of the first best practices emphasised was using clear naming conventions when creating resources. In simple terms, this means naming resources in a way that clearly describes their purpose. When teams follow structured naming patterns, it becomes much easier to:

Quickly identify resources
Keep infrastructure organized
Clean up environments after projects
Maintain consistency across teams

Another important lesson was cost awareness. Because cloud services charge based on usage, engineers must always create and manage resources responsibly.

Supporting an Azure Administrator

In this scenario, I was supporting an Azure administrator who manages an existing cloud environment. The infrastructure already contained a Linux Virtual Machine (VM), but it wasn’t being fully utilised. At the same time, there was a need for another Linux system that could function as an FTP server to allow files to be transferred between systems.
Before setting this up, the administrator wanted better visibility into network traffic and system usage.
To make this possible, the first step was to create a new subnet within the existing virtual network.
Creating a New Subnet for Better Network Organization
Rather than modifying the current network segment, the administrator requested the creation of a separate subnet dedicated to the FTP server.
The original subnet was left untouched because it may be used for future virtual machines.

Creating a new subnet offers several advantages:

It separates workloads into different network segments
It improves monitoring of network activity
It keeps infrastructure organised
It allows the environment to scale in the future This approach is known as network segmentation, and it helps improve both security and visibility in cloud environments.

Managing the Virtual Machine

Once the network structure was prepared, the next task was to update the virtual machine configuration.
The existing Linux VM was moved to the newly created subnet, ensuring it would operate within the correct network environment for the FTP service.
In real-world cloud environments, tasks like this are common. Infrastructure engineers often need to adjust existing systems while ensuring services continue to run smoothly.

Working with Azure Storage Services

Another key part of the project involved learning how to manage cloud storage services.
Organizations often need reliable ways to store and share files across systems, and Azure provides several services designed for this purpose.
During the exercise, I worked with:

AzureStorage Accounts
Blob Storage Containers
Azure File Shares

The tasks included:

Creating a storage container
Creating a file share
Uploading files to both storage locations

Blob Storage is typically used for storing large amounts of data such as application files, backups, logs, and media.
Azure File Shares, on the other hand, work more like a shared network folder, allowing multiple systems to access the same files.
These services are essential when organizations need secure and scalable file storage in the cloud.

Protecting and Organising Resources with Tags and Locks

As cloud environments grow, managing resources becomes more complex. Azure provides governance tools to help teams keep everything organised and protected.

Two important tools used in this project were resource tags and resource locks.

Resource Tags
Tags are simple labels attached to resources.
For example, a tag can show:
• Which department owns the resource
• The purpose of the resource
• The environment (development, testing, or production)
This makes it easier to track usage, manage costs, and quickly understand what each resource is used for.
Resource Locks
Resource locks help prevent accidental deletion or modification of important systems.
Because the Linux VM was going to operate as an FTP server, a lock was applied to ensure that no one could mistakenly delete it.
This adds an extra layer of operational protection and stability.

Final Outcome
By completing the project, the environment now includes:

A new subnet for better network organization
A Linux virtual machine positioned correctly within the network
Azure storage services configured for file sharing and storage
Resource tags applied for better organization Resource locks implemented to protect critical infrastructure from being accidentally deleted. Together, these improvements help ensure the cloud environment is structured, secure, and easier to manage.

Key Takeaways

This experience reinforced several important cloud engineering principles:

Designing well-structured network architectures
Managing and updating virtual machine configurations
Using cloud storage solutions effectively
Organising infrastructure with resource tagging
Protecting critical resources using locks These are foundational skills for anyone working with modern cloud platforms like Microsoft Azure. Cloud engineering is not only about deploying resources — it's about building environments that are reliable, organised, and sustainable.

However, to make this learning easier for others, I also created a step-by-step guide with screenshots, so anyone interested in Azure infrastructure can follow along and practice these tasks independently.

Need an Azure account?
If you already have a Microsoft Azure account to use for this lab, skip to Login to Microsoft Azure. If you need to create an Azure account, complete the following steps.

Go to the Azure free account page.
Select Try Azure for free
Complete the sign-up process for an Azure account.
Login to Microsoft Azure
Login to Microsoft Azure at Azure Portal

Create a resource group

In order to make clean-up easy at the end, start with creating a new resource group to hold the resources for this guided project. Using resource groups to organize things is a quick way to ensure you can manage resources when a project is over.

From the Azure portal home page, in the search box, enter resource groups.
Select Resource groups under services.
Select Create

Note:

Your subscription should already be selected. If you have multiple Azure subscriptions associated with this login, select the one you’d like to use for the guided project.
Enter "guided-project-rg" in the Resource group name field.
The Region field will automatically populate. Leave your region set on Korea central
Select Review + create.
Select Create.
Return to the home page of the Azure portal by selecting Home.

Create a virtual network with one subnet
From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Create.
Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

Create a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select Create and then select Virtual machine
Select guided-project-rg for the Resource group.
Enter guided-project-vm for the Virtual machine name.
For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)
Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.
Enter guided-project-admin for the admin Username.
Enter a password for the admin account.
Confirm the password for the admin account.
Leave the rest of the settings as default settings. You can uploads.s3.amazonaws.com/uploads/articles/4y09h45cv9svvlrw5scz.png)
Select Review + create
Select Create to confirm the resource cost and create the virtual machine.
Select Home to return to the Azure portal home page. Note: Once validation has passed, you’ll receive a cost estimate of how much it will cost per hour to run the VM.

Create a Storage account

From the Azure portal home page, in the search box, enter storage accounts.
Select Storage accounts under services.
Select Create.
Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

Create a new subnet on an existing virtual network (vNet)

Login to Microsoft Azure at (Azure Portal)[https://portal.azure.com]
From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
From the guided-project-vnet blade, under settings, select Subnets.
To add a subnet, select + Subnet.
For Subnet purpose leave it as Default.
For Name enter: ftpSubnet.
Leave the rest of the settings alone and select Add.
Select Home to return to the Azure portal home page.

Create a network security group

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Network security groups.
Select + Create.
Verify the subscription is correct.
Select the guided-project-rg resource group.
Enter ftpNSG for the network security group name.
Select Review + create.
Once the validation is complete, select Create.
Wait for the screen to refresh and display Your deployment is complete.
Select Go to resource.

Create an inbound security rule

Under settings, select Inbound security rules.
Select + Add.
Change the Destination port ranges from 8080 to 22.
Select TCP for the protocol.
Set the name to ftpInbound.
Select Add.
Select Home to return to the Azure portal home page.

Associate a network security group to a subnet

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
Under settings, select Subnets.
Select the ftpSubnet you created.
On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Select Save. *Move the virtual machine network to the new subnet *
Login to Microsoft Azure at (Azure Portal)[https://portal.azure.com]
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If the virtual machine is running, select Stop. ## Note: In order to make some configuration changes, such as changing the subnet, the VM will need to be restarted. You can request the change without stopping the VM, but Azure will force a restart before completing the change.
Wait for the Status field to update and show Stopped (deallocated).
Within the Networking subsection of the menu, select Network settings.
Select the Network interface / IP configuration hyperlink for the VM.
On the IP Configurations page, update the Subnet to ftpSubnet.
Select Apply. 11. Select Home to return to the Azure portal home page.

Vertically scale the virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the Availability + scale submenu and select Size. 5. Select a new VM size D2s_v5 for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)
Select Resize.
Select Home to return to the Azure portal home page.

Attach data disks to a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the settings submenu and select Disks. 5. Select Create and attach a new disk.
Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine. 11. Select Home to return to the Azure portal home page.

Configure automatic shutdown on a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown. 5. In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.
Select Save.
Select Home to return to the Azure portal home page.

Create a storage container

Login to Microsoft Azure at (Azure Portal)[https://portal.azure.com] From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise
The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.) 5. On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.
In the Name field, enter storage-container.
Select Create.

Upload a file to the storage container

Select the storage container you just created.
Select Upload and upload the file you prepared.
Once the file is ready for upload, select Upload. With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file. ## Change the access tier
Select the file you just uploaded (the file name is a hyperlink).
Select Change tier.
Select Cold.
Select Save. ## Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.
Select Home to return to the Azure portal home page.
From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg.)
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.
On the Basics tab, in the name field enter file-share.
On the Backup tab, uncheck Enable backup
Select Review + create.
Select Create.
Once the file share is created, select Upload.
Upload the same file you uploaded to the blob storage or a different file, it’s up to you.
Select Home to return to the Azure portal home page. The next piece of the puzzle is figuring one way to control access to the files that have been uploaded. Azure has many ways to control files, including things like role-based access control. In this scenario, the Azure admin wants you to use shared access tokens or keys. ## Create a shared access signature token
From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
On the storage account blade, select Storage browser. Expand Blob containers
Expand Blob containers ## Note: Blob container is another name for the storage containers. Items uploaded to a storage container are called blobs.
Select the storage container you created earlier, storage-container. 7. Select the ellipses (three dots) on the end of the line for the image you uploaded.
Select Generate SAS ## Note: When you generate a shared access signature, you set the duration. Once the duration is over, the link stops working. The **Start automatically populates with the current date and time.Set 9. Signing method to Account key.
Set Signing key to Key 1 ## Tip: There are two signing keys available. You can choose either one, or create SAS tokens with different durations.
Set Stored access policy to None.
Set Permissions to Read.
Enter a custom start and expiry time or leave the defaults. 14. Set Allowed protocols to HTTPS only.
Select Generate SAS token and URI.
Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.
Select Home to return to the Azure portal home page. With the SAS token created, anyone with that link can access the file for the duration that was set when you created the SAS token. However, controlling access to a resource or file is about more than just granting access. It’s also about being able to revoke access. To revoke access with a SAS token, you need to invalidate the token. You invalidate the token by rotating the key that was used. ## Rotate access keys
From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
Expand the Security + networking submenu.
Select Access keys. 6. For Key 1, select Rotate key.
Read and then acknowledge the warning about regenerating the access key by selecting Yes. 8. Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error. ## Add tags to a virtual machine You’ll start by adding a pair of tags to the virtual machine. One tag will be to identify the purpose of the virtual machine and the other will be to indicate the department the machine supports.
Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
From the menu pane, select Tags.
On one line for Name enter Department and for Value enter Customer Service
On the next line, for Name enter Purpose and for Value enter FTP Server.
Select Apply. While you’re working on the virtual machine, it’s a great time to add a resource lock. ## Add a resource lock to a VM
If necessary, expand the Settings submenu.
Select Locks.
Select + Add.
For the name, enter VM-delete-lock.
For the Lock type, select Delete. You may enter a note to help remind you why you created the lock.
Select OK. That’s it. Now the VM is protected from deletion and has tags assigned to help track use. Time to move onto the network. Select Home to return to the Azure portal home page. ## Add tags to network resources
From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet network.
From the menu pane, select Tags. ## Note: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and apply create something new in the other field.
For the Name select Department.
For the Value enter IT.
Select Apply. Now both the VNet and VM have are organized. ## Exercise – Clean up ## Warning: Failure to complete this Clean up task could result in unexpected Azure costs. This task will remove resources created during this guided project. ## Remove delete locks If you attempt to delete a resource with a delete lock, you’ll receive a warning that the operation failed due to a delete lock being in place. To avoid that, it’s important to clear delete locks from resources you intend to delete before issuing the delete command.
Login to Microsoft Azure at (Azure Portal)[https://portal.azure.com]
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If necessary, expand the Settings submenu.
Select Locks.
Select Delete on the line for the VM-delete-lock.
On the pop-up window, select Delete to confirm deletion of the lock. Once the delete lock is removed, you’ll be able to delete the VM. While this was the only delete lock required by the exercise, if you applied other delete locks during the exercise, remove them now. When you’re done, select Home to return to the Azure portal home page. ## Delete the project resource group A key benefit of using resource groups is the ability to rapidly delete all of the resources assigned to a resource group at once.
From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the guided-project-rg resource group.
Select Delete resource group.
Select Apply force delete…
Enter guided-project-rg in the confirmation box.
Select Delete It will approximately 5 minutes before the resource group is fully deleted. You’ll need to refresh the resource group page every few minutes until the guided-project-rg is gone to confirm complete deletion. ## Important: Recall at the beginning of the Guided Project you checked for a NetworkWatcherRG resource group. If there WAS a NetworkWatcherRG when you started, then you’re finished. However, if the NetworkWatcherRG was created for the guided project, you’ll need to delete the NetworkWatcherRG as well following a nearly identical process. ## Delete the NetworkWatcherRG ## Important: If the NetworkWatcherRG existed prior to starting the guided project, do not delete it as part of the guided project clean up.
From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the NetworkWatcherRG resource group.
Select Delete resource group.
Enter NetworkWatcherRG in the confirmation box.
Select Delete.
On the Delete confirmation pop-up, select Delete.