2.1 — Describe the core architectural components of Azure

Physical Infrastructure

Azure infrastructure has two layers: physical infrastructure (where hardware lives) and management infrastructure (how you organize and govern resources).

At the foundation are DatacentersBuildings full of servers, networking, and power that form the foundation of Azure infrastructure. You never interact with them directly; Azure groups them into higher abstractions called regions. — you never interact with them directly. Azure groups datacenters into RegionsGeographic areas containing one or more datacenters connected by a low-latency network. Azure has 60+ regions worldwide. When you deploy a resource, you choose a region. Some services are global (Microsoft Entra ID, Azure DNS) and do not require a region choice., of which there are 60+ worldwide. For disaster recovery, most regions belong to Region PairsTwo regions within the same geography that are linked together. Platform updates roll out to one region at a time; GRS automatically replicates to the paired region; during broad outages, one region of each pair is prioritized for recovery. Most pairs are at least 300 miles apart. that are at least 300 miles apart. Some regions are Sovereign RegionsIsolated Azure instances operated for compliance or government requirements, such as Azure Government (US government agencies) and Azure China 21Vianet (operated by 21Vianet, physically isolated from global Azure). — isolated instances for government or compliance needs. Within a region, Availability ZonesPhysically separate datacenters within a single region, each with independent power, cooling, and networking. A region that supports AZs has a minimum of three zones. Use AZs to protect apps and data from datacenter-level failures. provide datacenter-level fault isolation — a region that supports AZs has at least three zones.

Zonal services (e.g., VMs, managed disks) are pinned to a specific zone — you choose which zone. Zone-redundant services (e.g., Azure SQL Database, Zone-redundant Storage) spread automatically across zones; Microsoft handles replication.

Management Infrastructure

The management hierarchy is built from four levels. Individual ResourcesThe individual items you create in Azure: VMs, storage accounts, databases, etc. Every resource must belong to exactly one resource group. are always placed inside a Resource GroupsLogical containers that hold related resources for a solution. Resource groups cannot be nested. Deleting a resource group deletes all resources inside it. Resources in a group can span multiple regions, and the group itself has a region for metadata storage only., which cannot be nested and whose deletion removes all contained resources. Resource groups belong to SubscriptionsBilling and access-control boundaries that contain resource groups. A single Microsoft Entra tenant can have multiple subscriptions. Subscriptions serve as a billing boundary (separate invoices) and an access-control boundary (RBAC policies apply at subscription scope). — each subscription is a separate billing and access-control boundary. At the top, Management GroupsContainers that sit above subscriptions and allow you to apply governance at scale. Management groups can be nested up to 6 levels deep. Every directory has one Root Management Group. Policies and RBAC assigned at a management group are inherited by all subscriptions below. sit above subscriptions and can be nested up to 6 levels deep, with governance flowing down to all subscriptions below.

The Full Hierarchy (top to bottom)

Root Management Group
  └── Management Group (optional, nestable 6 levels)
        └── Subscription
              └── Resource Group
                    └── Resource

Governance (Azure Policy, RBAC) flows downward through this hierarchy — settings at a higher scope apply to everything below.