Match Azure resources to workload needs

Learning objective

Identify essential Azure compute, networking, storage, and data-service concepts.

Core idea

An agent application still needs an ordinary application platform. Something executes code, something carries requests, and something stores the records that must survive execution. A model deployment does not replace these responsibilities. Identify each resource by the job it performs before choosing its Azure implementation.

For an architect preparing for AI-500, the useful prerequisite is a resource map: execution belongs to compute, connectivity belongs to networking, files and objects belong to storage, and queryable business records belong to data services. These categories interact, but success in one does not establish success in another. A running worker can fail to reach a database; a reachable database can reject its identity. See 0.12 for authentication and authorization.

How it works

Choose the level of compute control

Azure Virtual Machines give you control over the computing environment. Azure supplies the virtualized hardware, while you configure, patch, and install the software inside the VM. Choose this responsibility when the workload needs that control. Do not infer that a VM is preferable merely because the application uses an agent framework.

Azure App Service supports HTTP applications and APIs deployed as code or a container. Azure Functions supports event-driven execution through triggers such as HTTP requests, queue messages, and timers. The trigger is the execution entry point; the function’s business logic still decides what the event means. A queue-triggered document processor and a public web API therefore have different operational shapes even when both call the same model.

Azure Container Apps runs containers while abstracting Kubernetes cluster management. Its KEDA-based autoscaling supports event-driven scaling, and its jobs support on-demand, scheduled, or event-driven tasks. Azure Kubernetes Service (AKS) exposes Kubernetes APIs and gives you cluster-level configuration. Container Apps does not expose those APIs. A requirement to operate Kubernetes primitives distinguishes AKS from a requirement merely to run a container.

Scale-to-zero is also conditional. The compute comparison documents it for Container Apps and for Functions on Consumption or Flex Consumption plans. It can introduce cold-start latency. A low-latency synchronous service might need minimum active capacity rather than an idle execution path. Choose the platform and plan together instead of treating a product name as a complete scaling policy.

Separate connectivity, filtering, and private access

Azure Virtual Network provides the network in which resources communicate. Subnets divide its address space for resource placement. A network security group (NSG) filters inbound and outbound traffic using rules for source and destination address, port, and protocol. A route table changes where traffic travels. These mechanisms answer different questions: placement, permission to pass traffic, and next destination.

Azure Private Link exposes a supported service through a private endpoint. The private endpoint is a network interface with a private IP address from your virtual network. Its connection status matters: Approved permits use, while Pending requires the resource owner’s approval. Naming the endpoint in an architecture diagram does not establish a working connection.

For an Azure Functions caller, reaching a private endpoint requires outbound virtual network integration. Flex Consumption, Elastic Premium, and Dedicated (App Service) plans support it; the Consumption plan does not. Virtual network integration controls outbound connectivity and does not provide private inbound access to the function app.

DNS resolution must lead the caller to the intended endpoint. Check name resolution and the caller’s network route before changing application credentials. Private endpoint configuration also does not necessarily disable public access to the service; apply that service’s public-network access controls when the design requires it.

Target subresources matter. Azure Storage requires separate private endpoints for its blob and file subresources when you need private access to both. A working Blob endpoint does not prove that a file-share mount follows the same path. Keep network verification specific to the operation your application performs.

Match storage to the representation

Azure Blob Storage is object storage for text and binary data. Use it for source documents, exported reports, and other objects addressed as stored content. Azure Files supplies managed file shares when an application expects shared filesystem access. Azure managed disks provide block-level volumes for VMs. Objects, shared files, and VM disks are different interfaces, even if each can contain the same bytes.

Azure Queue Storage stores messages between application components. A message can identify a document that needs processing without containing the entire document. Azure Table Storage provides schemaless structured storage. Neither turns a Blob container into a database with relational joins.

Separate the durable object from the process that reads it. In your design, give the document an object identifier and give the processing job its own record. Restarting compute should not require reconstructing the only copy of the source document from the worker’s runtime state.

Choose data services from access patterns

Azure SQL Database is a managed relational database using the SQL Server engine. Relational stores organize schema-defined tables and support integrity constraints, joins, and transactions. They fit a business record whose correctness depends on related updates and explicit relationships.

Azure Cosmos DB for NoSQL supports flexible JSON document models and SQL-like querying. Select a document model when the application’s access patterns fit document-oriented records, rather than assuming that every agent state needs relational normalization. The decision still needs concrete queries and update semantics; “flexible schema” is not an excuse to leave the record contract undefined.

Azure AI Search provides search and indexing, including relevance-oriented retrieval. A search index serves discovery of evidence; it does not automatically become the authoritative order or approval record. See 0.8 for retrieval and grounding, and 1.2.5 for the ownership of agent persistence stores.

Key distinctions and trade-offs

The following choices separate responsibilities:

A private route and a data permission are independent requirements. Likewise, managed compute reduces infrastructure work without selecting the correct persistence model for you.

Architecture / decision scenario

A document-review service receives uploads, processes them asynchronously, and exposes review status through an API. You choose App Service for the HTTP API and a Functions queue trigger on Flex Consumption for processing. Blob Storage retains source documents, while Queue Storage carries document identifiers to the worker. Azure SQL Database stores the business approval record because related updates must obey relational constraints. Azure AI Search supports discovery of relevant text without owning the approval decision.

The worker uses outbound virtual network integration to reach storage through an approved private endpoint for blob. A separate file-share requirement would need the file target. You check DNS and routing, then verify the worker’s data permissions. If the workload later requires custom Kubernetes deployment controls, you assess AKS; the presence of a container alone does not justify that migration.

Common exam traps

• Treating a deployed model as the host for all application code.
• Choosing AKS solely because the workload is containerized.
• Assuming every Functions plan scales to zero.
• Choosing the Functions Consumption plan for a worker that must reach a private endpoint.
• Confusing an NSG traffic rule with a database or storage permission.
• Assuming a private endpoint disables public service access automatically.
• Using a search index as the authoritative transactional record.

What to remember

Map execution, connectivity, object storage, and business data separately. Choose compute by the control you need, networking by the actual request path, and persistence by the operations that must remain correct. Verify the specific endpoint and operation instead of reasoning from a service label alone.

Knowledge check

References

• Microsoft, Overview of virtual machines in Azure
• Microsoft, Choose a compute option for microservices
• Microsoft, What is Azure Virtual Network?
• Microsoft, Azure Functions networking options
• Microsoft, What is a private endpoint?
• Microsoft, Introduction to Azure Storage
• Microsoft, Understand data models