Cheat Sheet — The Numbers, Formulas & Decision Rules

One page of the things a principal Azure engineer recites without looking. Each links to the phase that derives it. Memorising the number is worthless without the why — but in an interview or an incident, having both is the difference between "sounds senior" and "is senior."

The control-plane request (P00–P01)

client → Entra (authenticate: JWT) → ARM (authorize: RBAC − NotActions, then deny wins)
       → Policy (deny/append/modify/audit) → resource provider (idempotent PUT)

Rule: every Azure write is one idempotent PUT to a resource ID. Control plane (manage the resource) and data plane (the blob/secret/message) are different systems with different identity, throttling, and SLA. Owner ≠ Blob Data Reader.

Resource ID shape:

/subscriptions/{sub}/resourceGroups/{rg}/providers/{namespace}/{type}/{name}

RBAC evaluation (P04)

effective control-plane perms = union(Actions) − union(NotActions)     # across all assignments
data-plane perms              = union(DataActions) − union(NotDataActions)
final = (matched by an allow) AND NOT (matched by any deny assignment)  # DENY ALWAYS WINS

Wildcards: * matches one+ segments; Microsoft.Storage/*/read matches any read under the RP. Assignments are additive and inherited down MG → Sub → RG → resource. There is no "deny by role"; you remove access by not assigning or via a deny assignment.

Azure Policy effects (P04), precedence high→low

disabled  <  audit/auditIfNotExists  <  append/modify  <  deployIfNotExists  <  deny

deny blocks the write at the control plane; audit only flags; deployIfNotExists (DINE) and modify need a managed identity with rights to remediate.

Management-group inheritance (P05)

effective at a scope = (assignments at this scope) ∪ (everything inherited from ancestors)
                       minus notScopes/exemptions

MG tree max depth 6 levels (under root). A subscription lives in exactly one MG.

OAuth2 / OIDC / JWT (P03, P09)

auth-code + PKCE:  challenge = BASE64URL(SHA256(verifier))   # method S256
client-credentials: client_id + secret/cert → access token (no user, app perms in `roles`)

JWT validation order (fail closed on any miss):

1. parse header → pick key by `kid` from JWKS
2. verify signature
3. iss == expected issuer (tenant)
4. aud == your API's app-ID-URI / client-id
5. nbf ≤ now ≤ exp           (apply ±clock-skew, default 300 s)
6. authorize: scp (delegated) or roles (app) contains required value

scp = space-delimited delegated scopes (user present). roles = app roles (daemon). Never trust a token you didn't validate aud on — that's the confused-deputy.

Networking (P06)

NSG: rules 100–4096, evaluated lowest priority number first, first match wins; defaults allow VirtualNetwork↔VirtualNetwork and AzureLB, deny the rest. Stateful — return traffic is auto-allowed (don't write a reverse rule).

Effective route next-hop:

choose route with LONGEST PREFIX match to dest IP
tie-break: UDR  >  BGP  >  system
0.0.0.0/0 is the default; a /32 UDR beats it

Subnet math: a /26 = 64 addresses, −5 reserved by Azure (.0 network, .1 gateway, .2/.3 Azure DNS-ish, .255 broadcast) → 59 usable. Smallest usable subnet is /29.

Private Endpoint: it rewrites DNS — the public FQDN must resolve to the private IP via a Private DNS zone (e.g. privatelink.blob.core.windows.net). Broken DNS = #1 failure.

Containers / OCI (P07)

tag  → manifest digest (sha256)  → [config digest, layer digest, layer digest, …]
pull = resolve tag → fetch manifest → fetch only MISSING layer blobs (content-addressed)

Garbage collection = mark all blobs referenced by a live manifest, sweep the rest. Tags are mutable; digests are immutable — pin prod by digest, not :latest.

CI/CD (P08)

Pipeline = DAG of stages (dependsOn + condition). A stage runs iff all deps succeeded and its condition is true. OIDC federation beats stored secrets: pipeline OIDC token → Entra (match issuer/subject/audience) → access token, nothing to leak. Rollout: blue-green (instant swap/rollback), canary (% then ramp, gate on health).

Messaging / eventing (P10)

Service Bus peek-lock:

receive → message LOCKED for lockDuration → complete | abandon | dead-letter
lock expires → message redelivered, DeliveryCount++
DeliveryCount > MaxDeliveryCount → moved to DLQ

Dedup: within DuplicateDetectionWindow, a repeat MessageId is dropped. Sessions = FIFO + single-consumer per session key. Event Grid: at-least-once, exponential-backoff retry (to ~24 h), then dead-letter to storage. Delivery semantics: at-most (no retry) → at-least (retry, may dup) → exactly-once effect (at-least + idempotent/dedup consumer).

Serverless (P11)

Functions scale controller adds instances from event backlog (queue depth / lag), up to the plan max; Consumption scales to zero (cold start is the cost). Durable orchestrators are replayed from history every event → must be deterministic: no clock, no random, no I/O outside activities; use context APIs only.

Key Vault & Managed Identity (P12)

Managed Identity token:  code → IMDS 169.254.169.254 → access token (NO secret)
Envelope encryption:     data --DEK--> ciphertext ;  DEK --KEK(in Vault)--> wrapped DEK
rotate KEK ⇒ rewrap DEK only (data untouched)

Soft-delete + purge-protection: a deleted secret/key is recoverable for the retention window and cannot be purged early when purge-protection is on. Prefer RBAC over legacy access policies.

Observability / KQL (P13)

T | where Timestamp > ago(1h)
  | summarize p95 = percentile(DurationMs, 95), n = count() by bin(Timestamp, 5m), Service
  | top 10 by p95 desc

summarize … by groups; bin(t, 5m) buckets time; sampling trades cost vs fidelity.

Reliability & SLA math (P00, P14)

serial dependencies:   A_total = ∏ Aᵢ            (more hops → lower SLA)
redundant copies:      A = 1 − ∏ (1 − Aᵢ)        (parallel raises SLA)

Three serial 99.9% services → 99.9%³ ≈ 99.7% (≈2× the downtime). Two redundant 99% → 1 − 0.01² = 99.99%.

Retry: exponential backoff base · 2ⁿ + full jitter random(0, backoff), capped, under a retry budget (e.g. ≤10% of calls) so retries can't amplify an outage. Honor 429 + Retry-After. Circuit breaker: closed → open (fail fast) → half-open (probe) → closed.

The five Well-Architected pillars (P00, P15)

Reliability · Security · Cost Optimization · Operational Excellence · Performance Efficiency

Rule: name the pillar you are trading, quantify both ends, then choose — and write the ADR. "Best architecture" is meaningless without the workload's weights.