Azure For Advanced
A complete Azure service catalog written for practitioners — internals, limits, failure modes, and the trade-offs that only show up once a system is in production.
This reference assumes you’ve already run these services in production, or something close to it. Each entry skips the “what is it” framing and goes straight to the part that actually changes an architecture decision: internal behavior, scaling ceilings, failure modes, and the gotchas that don’t show up until you’re past the proof-of-concept stage. Use it as a decision-support reference, not an introduction.
1Compute Services
Execution environments, with the operational trade-offs that matter at scale.
Virtual Machines
Availability Sets protect against rack-level (fault domain) and host-level (update domain) failures within one datacenter, but offer zero protection against a datacenter outage — that requires Availability Zones instead, and the two can’t always be mixed within the same deployment.
App Service
Deployment slots share the same underlying App Service Plan compute — a slot swap doesn’t add capacity, and a resource-intensive warm-up on the target slot before swapping is essential to avoid a cold-start hit on cutover.
Azure Kubernetes Service (AKS)
The free-tier control plane has no SLA; production workloads need the Uptime SLA tier or the newer Base/Standard tiers — a common oversight that surfaces only during a control-plane incident.
Azure Container Apps
KEDA-based scale-to-zero introduces cold-start latency on the first request after idling — latency-sensitive APIs need a minimum replica count configured explicitly, not the default scale-to-zero behavior.
Azure Functions
Consumption plan cold starts scale with dependency load time and can exceed several seconds for larger applications — Premium plan’s pre-warmed instances are often necessary, not optional, once latency SLAs are involved.
Azure Batch
Low-priority (Spot-equivalent) VM pools can be reclaimed mid-job with limited notice — job/task-level checkpointing is required for large batch workloads to avoid restarting from scratch on eviction.
Azure Dedicated Host
Host maintenance events still apply and can force a live migration or restart across every VM on the host simultaneously — plan maintenance windows at the host level, not per-VM.
Virtual Machine Scale Sets
Scale-in policies determine which instances are removed first (oldest, newest, or balanced across zones) — the default policy can inadvertently remove instances holding local state if not explicitly configured.
2Storage Services
Persistence choices that are expensive to reverse once workloads depend on them.
Blob Storage
Early deletion fees on Cool/Cold/Archive tiers, plus rehydration latency for Archive (hours, not seconds), can silently erase the storage-cost savings if access patterns are misestimated — model actual retrieval frequency and urgency before choosing a tier.
Azure Files
Standard tier SMB performance is bounded by share-level IOPS/throughput quotas that scale with provisioned size on the premium tier — undersized premium shares silently bottleneck high-IOPS workloads regardless of the client VM’s own limits.
Managed Disks
Standard SSD and HDD disks have per-disk IOPS/throughput caps independent of attached VM size — a VM with generous disk-throughput limits still bottlenecks hard if the attached disk tier can’t deliver it.
Azure NetApp Files
Throughput scales with the selected service level (Standard/Premium/Ultra) and provisioned capacity together — under-provisioning capacity to save cost silently caps throughput below what the service level nominally allows.
Data Movement Tools (AzCopy, Storage Explorer)
Large-scale AzCopy transfers are sensitive to source-side metadata enumeration time on file-heavy (many small files) datasets, which can dominate total transfer time more than raw network throughput.
3Database Services
Where architectural mistakes are hardest and most expensive to unwind post-launch.
Azure SQL Database
DTU-to-vCore migration isn’t a simple tier switch — the underlying resource governance model differs enough that performance characteristics can shift meaningfully post-migration, warranting load testing rather than a like-for-like assumption.
Azure SQL Managed Instance
Instance pools reduce per-instance overhead but introduce noisy-neighbor risk across instances sharing the same pool’s compute — isolate latency-sensitive workloads onto dedicated instances rather than shared pools.
Cosmos DB
Partition key choice is effectively permanent post-creation and directly determines whether Request Unit (RU) consumption distributes evenly or hotspots on a small set of logical partitions — this is the single most consequential Cosmos DB design decision.
Azure Database for PostgreSQL/MySQL
Flexible Server’s zone-redundant HA failover takes measurable time (typically under a minute, but non-zero) — application-level connection retry logic is still required, HA alone doesn’t make failover transparent.
Azure Cache for Redis
Failover on non-Enterprise tiers promotes a replica but doesn’t guarantee zero data loss for unacknowledged writes — don’t treat it as a durable store even with persistence (RDB/AOF) enabled, without explicitly validating recovery behavior.
Azure Database Migration Service
Online migration cutover windows are bounded by replication lag catch-up time on the source, not by the migration tool itself — large, write-heavy source databases may still require a maintenance-window cutover despite “minimal downtime” framing.
4Networking Services
Where subtle misconfiguration causes outages that are hard to diagnose after the fact.
Virtual Network (VNet)
VNet peering is non-transitive — peering A↔B and B↔C does not let A reach C, a frequent source of “why can’t these resources talk” confusion in multi-hub topologies.
Azure Load Balancer
Basic SKU has no SLA and is being retired — production deployments still on Basic SKU should migrate to Standard SKU proactively rather than waiting for a forced, potentially disruptive migration.
Application Gateway
WAF rule evaluation adds measurable per-request latency, and overly broad custom rules can produce false positives that silently block legitimate traffic — WAF should run in detection mode initially, not prevention mode, when first enabled.
Azure Front Door
Origin health probes and routing rules interact in ways that can cause unexpected failover behavior if probe intervals and thresholds aren’t tuned against actual origin response characteristics.
ExpressRoute
Requires a connectivity provider and has multi-week provisioning lead times — it is a capacity-planning decision, not a reactive fix for a bandwidth or latency incident.
VPN Gateway
Basic and VpnGw1 SKUs lack the throughput and active-active redundancy of higher SKUs — undersized gateway SKUs are a common, easily overlooked bottleneck for site-to-site connections carrying more traffic than originally planned.
Azure Firewall
Scales automatically but has a ramp-up period under sudden traffic spikes — sustained high-throughput bursts immediately after a scale-up event can see degraded performance until scaling completes.
Network Watcher
NSG flow logs have their own storage and processing cost that scales with traffic volume — enabling verbose flow logging cluster-wide without a retention/analysis plan is a common unexpected cost driver.
Private Link
DNS configuration is the most common failure point — private endpoints require correct private DNS zone linkage, and misconfigured DNS resolution silently falls back to public endpoints rather than failing loudly.
5Big Data & Analytics Services
Cost and performance characteristics that only surface at real data volume.
Azure Synapse Analytics
Dedicated SQL pool compute (DWUs) bills continuously while paused-and-resumed incorrectly, and query performance is highly sensitive to distribution column choice — a poorly chosen distribution key causes data movement operations that dominate query time.
Azure Data Factory
Self-hosted integration runtime throughput is bounded by the host machine’s resources, not ADF itself — undersized self-hosted IR VMs are a common, misdiagnosed bottleneck in hybrid data movement pipelines.
Azure Databricks
Cluster auto-termination settings that are too aggressive cause repeated cold-start delays for interactive notebooks — balancing cost against interactive responsiveness requires deliberate idle-timeout tuning, not defaults.
Azure Stream Analytics
Query complexity and the number of Streaming Units (SUs) allocated directly determine whether a job can keep up with input rate — a job silently falling behind shows up as growing watermark delay, not an explicit error.
Azure Data Lake Storage Gen2
The hierarchical namespace enables efficient rename/delete at the directory level, but excessive small-file counts still degrade downstream Spark/Synapse query performance regardless of the namespace feature.
Power BI
DirectQuery mode pushes every visual interaction into a live query against the source — dashboards with many visuals on DirectQuery can generate query storms that overwhelm the source database under concurrent user load.
6AI & Machine Learning Services
Where production ML failure modes differ sharply from notebook-stage results.
Azure Machine Learning
Managed online endpoint autoscaling has cold-start latency on scale-from-zero that’s invisible in load tests run against already-warm endpoints — explicitly test scale-from-zero behavior if traffic is genuinely bursty.
Cognitive Services
Confidence thresholds across Vision/Language APIs aren’t calibrated per use case — the same numeric confidence score means different things for different categories, requiring per-category threshold tuning in production.
Azure OpenAI Service
Regional capacity and quota limits (tokens-per-minute) are allocated per deployment and can throttle unexpectedly under traffic growth — provisioned throughput units (PTUs) are often necessary for predictable latency at production scale, not the default pay-as-you-go quota.
Bot Service
Channel-specific message formatting constraints (character limits, rich card support) differ across Teams, web chat, and other channels — a bot tested only against one channel can silently degrade or truncate on others.
7Developer Tools & CI/CD Services
Pipeline design choices that determine deploy reliability under pressure.
Azure DevOps
Microsoft-hosted agent pools have concurrent job limits per organization that can silently queue pipeline runs during high-activity periods — self-hosted agent pools are often necessary for teams with heavy parallel CI/CD demand.
Azure Pipelines
YAML template reuse across many pipelines can create hidden coupling — a change to a shared template can break pipelines that don’t obviously reference it, requiring careful version pinning of template references.
GitHub Actions Integration
OIDC-based federated credentials (rather than long-lived service principal secrets) should be the default for GitHub-to-Azure authentication — static secrets in GitHub Actions workflows are an avoidable, persistent credential-leak risk.
Azure Artifacts
Upstream source caching behavior means a compromised or yanked public package can still be served from cache after removal upstream — cache invalidation policy needs explicit attention for supply-chain security.
8Operations & Monitoring Services
Observability tooling that’s only as good as its instrumentation discipline.
Azure Monitor
Alert rule evaluation frequency and the “auto-mitigate” window interact in ways that can mask flapping incidents — a metric oscillating around a threshold generates noisy alert churn unless combined with proper aggregation windows.
Application Insights
Adaptive sampling reduces cost but can drop the exact slow or failed request you’re chasing during an incident — temporarily disabling sampling or using debug-mode ingestion is often necessary for precise root-cause analysis.
Log Analytics Workspace
KQL query cost and performance degrade sharply on queries spanning very large time ranges without efficient filtering early in the query — always filter by time range and indexed columns first, not last.
Azure Automation
Runbook execution has default timeout and concurrency limits per Automation Account — large-scale remediation runbooks touching thousands of resources need explicit batching, not a single monolithic execution.
9Security & Identity Services
Where a misconfiguration is a breach, not a bug.
Microsoft Entra ID
Conditional Access policy conflicts (multiple policies applying to the same user/app combination) resolve via specific precedence rules that are easy to get wrong — test policy changes in report-only mode before enforcing, every time.
Key Vault
Soft-delete and purge protection are separate settings — without purge protection enabled, a deleted vault’s secrets can be permanently and irrecoverably purged during the soft-delete retention window by anyone with sufficient permissions.
Microsoft Defender for Cloud
Secure Score improvements from enabling recommendations don’t retroactively fix already-provisioned non-compliant resources — remediation is often a separate, manual or Azure Policy-driven step after enabling a recommendation.
Azure Policy
DeployIfNotExists and Modify effects require a system-assigned managed identity with sufficient permissions on the policy assignment — a missing role assignment causes silent remediation failures that don’t surface as policy violations.
Microsoft Sentinel
Analytics rule detection latency and Log Analytics ingestion delay together mean “real-time” detection can lag by several minutes — critical response playbooks shouldn’t assume sub-minute detection without validating actual pipeline latency.
10Migration Services
Cutover risk management, not just data movement.
Azure Migrate
Assessment sizing recommendations are based on collected performance data over a sampling window — a sampling window that misses peak load periods produces undersized recommendations that only surface as a problem post-migration.
Azure Database Migration Service
Online migration mode requires the source database to support the necessary replication mechanism (like SQL Server CDC) — not every source configuration supports online migration, forcing an offline cutover regardless of tooling preference.
Azure Site Recovery
Recovery Point Objective (RPO) is bounded by replication frequency, and a full failover test doesn’t guarantee application-level correctness — dependencies like DNS, licensing servers, and hardcoded IPs need explicit validation, not just VM boot success.
11Serverless & Application Integration Services
Decoupling primitives whose failure semantics need explicit handling.
Logic Apps
Consumption plan pricing bills per action execution — high-frequency, fine-grained workflows can accumulate cost faster than an equivalent Function App handling the same logic imperatively; Standard plan flips this to a fixed compute cost model.
Event Grid
At-least-once delivery with retry policies means duplicate event delivery is possible — event handlers must be idempotent, and event ordering is not guaranteed across topics by default.
Service Bus
Message lock duration and max delivery count interact — a consumer that processes slower than the lock duration causes message redelivery even though the original processing eventually succeeds, a common source of duplicate-processing bugs.
Event Hubs
Partition count sets the upper bound on consumer parallelism within a consumer group and can’t be decreased after creation — under-provisioning limits throughput scale, over-provisioning increases per-partition checkpoint overhead.
12API Management Services
Gateway-layer decisions that affect every downstream consumer.
Azure API Management
Policy execution order in the inbound/backend/outbound pipeline directly affects both correctness and latency — profiling the full policy chain (not just backend response time) is necessary when diagnosing unexpected API latency.
13Hybrid & Multicloud Services
Extending Azure’s control plane introduces its own consistency and latency realities.
Azure Arc
Policy and monitoring extended to Arc-enabled resources depend on a persistent, healthy connection from the Arc agent back to Azure — extended connectivity loss means those resources silently fall out of centralized compliance visibility until reconnected.
Azure Stack HCI
Feature parity with mainline Azure services lags meaningfully — validate specific service availability against the exact Stack HCI version deployed before assuming Azure documentation applies unmodified.
Azure VMware Solution
Licensing cost parity with on-premises VMware is often the deciding factor over re-architecting to native Azure compute — evaluate against actual vSphere feature dependencies (DRS, HA policies) before committing to a migration path.
Key Takeaways
- Most production incidents in this catalog trace back to default configurations left unexamined — SKU tiers, connection retry logic, and DNS resolution for Private Link are rarely correct out of the box at scale.
- Cosmos DB partition key choice and Synapse distribution column choice are the same underlying problem wearing different names — the wrong choice up front is expensive to fix later.
- At-least-once delivery is the default assumption across Event Grid, Service Bus, and Event Hubs — idempotency at the consumer is a correctness requirement, not an optional hardening step.
- Cost surprises concentrate in a few repeat offenders: Blob Storage early-retrieval fees, Log Analytics query cost on wide time ranges, and Logic Apps Consumption per-action billing at high frequency.
- Security failures are usually Conditional Access policy conflicts or missing managed identity permissions, not exotic exploits — these deserve as much scrutiny as any custom security tooling.
- This document reflects general architectural behavior; always validate specific limits, SLAs, and pricing against current official Azure documentation before finalizing production designs.