Principal Azure Cloud Engineer & Architect — Curriculum
Target Role: Azure Cloud Engineer → Principal Cloud Architect — secure, event-driven, serverless platforms on Microsoft Azure (the reference JD — jd.md)
Also prepares you for:
- Microsoft / consulting partners — Cloud Solution Architect, Azure Platform Engineer
- Any enterprise running a regulated, multi-subscription Azure estate: landing zones, Entra ID, policy-as-code, private networking, event-driven serverless, and 24×7 ops
- The Azure certification ladder used as a floor, not a ceiling: AZ-104 (Administrator), AZ-204 (Developer), AZ-305 (Solutions Architect Expert), AZ-500 (Security), AZ-700 (Networking) — this track goes far deeper than any of them, because it makes you build the mechanisms the exams only name.
Duration: ~32 weeks core (≈8 months) — extendable with the capstones Seniority Target: Principal / Staff IC — the escalation point for the hardest cloud failures and the person who defines the platform standards the org builds on Goal: Make you the engineer who can architect an Azure platform at the system level and debug it at the token, route-table, manifest-digest, message-lock, checkpoint, and KQL-query level — across IaC, identity, governance, networking, containers, CI/CD, APIs, events, serverless, secrets, observability, and reliability.
Why This Curriculum Exists
Most "learn Azure" material teaches you to operate the portal: which blade to click,
which az command to copy. That gets you to senior. It does not get you to principal,
because the principal's job is to make correct tradeoffs under conflicting requirements
and to debug the layer everyone else stands on — and you cannot do either if the
service is a black box.
So this track is built on two non-negotiables:
- Every Azure mechanism in the JD gets implemented, not just described. The ARM deployment dependency graph, Terraform's plan/diff/replace engine, the OAuth2 + OIDC + JWT validation flows, the RBAC + Azure Policy evaluator, the NSG + effective- routes engine, an OCI/ACR registry with garbage collection, a CI/CD DAG with approval gates and OIDC federation, an API gateway with scope authorization and rate limiting, a Service Bus broker with peek-lock/sessions/dead-letter, the Functions scale controller and Durable replay engine, Key Vault envelope encryption and Managed- Identity token acquisition, a KQL query engine, and the reliability primitives (SLA composition, retry+jitter, circuit breaker) — you build a working, tested miniature of each.
- Everything is taught to the depth interviewers and incidents actually demand — the token claims, the priority ordering, the longest-prefix match, the lock-expiry off-by-one, the SLA arithmetic, the failure signatures. We assume you are building the platform that serves millions of requests with security and availability guarantees, not a demo resource group.
How Each Phase Teaches (the "many ways of explaining")
Every phase deliberately explains the same material through several lenses, because principal-level understanding is the intersection of all of them:
| Document | Voice | What it gives you |
|---|---|---|
README.md | the syllabus | why the phase exists, concept map, lab specs, integrated-scenario ideas, deliverables checklist, key takeaways |
WARMUP.md | the professor | zero-to-principal primer — every term from first principles, the mechanism under the hood, the math, lab guidance, success criteria, interview Q&A, references |
HITCHHIKERS-GUIDE.md | the senior who's been there | the compressed practitioner tour — 30-second mental model, the numbers to tattoo on your arm, az/Terraform one-liners, war stories, beginner mistakes |
BROTHER-TALK.md | your brother, off the record | candid real-talk — what nobody tells you, the 2 a.m. pager truth, the career framing |
lab-*/ | the lab bench | a runnable, test-verified implementation: lab.py (TODOs) → your code → solution.py (reference) → test_lab.py (the proof). Validation is pytest. |
The lab engineering standard is documented in LAB-STANDARD.md. Read it before you start the first lab.
The Phases
| # | Phase | You build (flagship lab) |
|---|---|---|
| 00 | The Azure Principal: Control Plane, Well-Architected & Tradeoffs | ARM resource-id parser + Well-Architected five-pillar tradeoff scorer + SLA/cost/region modeler |
| 01 | Azure Resource Manager & the Deployment Engine | ARM/Bicep template dependency-graph deployment engine + idempotent PUT + what-if diff |
| 02 | Terraform, CDKTF & IaC State Internals | a Terraform-style state + plan engine: diff, ForceNew replace, dependency ordering, drift |
| 03 | Microsoft Entra ID: OAuth2 / OIDC / JWT | authorization-code+PKCE & client-credentials flow engine + a JWT validator |
| 04 | RBAC & Azure Policy Evaluation | role Actions/NotActions wildcard matcher + scope inheritance + deny assignments + Policy effects |
| 05 | Azure Landing Zones & Management-Group Scale | management-group tree + effective policy/RBAC inheritance resolver + ALZ compliance scorer |
| 06 | Azure Networking & the Software-Defined Network | NSG priority evaluator + effective-routes longest-prefix engine + Private DNS / subnet calculator |
| 07 | Containers, Docker, ACR & AKS Internals | content-addressable OCI registry (digests, manifests, GC, geo-replication) + AKS bin-packing scheduler |
| 08 | CI/CD Pipelines & Secure Supply Chain | pipeline DAG executor (stages, gates, approvals) + OIDC workload-federation + blue-green/canary controller |
| 09 | RESTful APIs, JSON & Secure AuthN/AuthZ | an API gateway: route matching + JWT scope authorization + token-bucket rate limiting + policy pipeline |
| 10 | Event-Driven: Event Grid, Service Bus & Logic Apps | a Service Bus broker (peek-lock, sessions, dedup, dead-letter) + Event Grid retry delivery |
| 11 | Serverless: Functions, Triggers/Bindings & Durable | a Functions scale controller + a Durable-Functions deterministic replay engine |
| 12 | Secrets, Key Vault & Managed Identity | IMDS/MSI token acquisition + Key Vault envelope encryption + key rotation + soft-delete state machine |
| 13 | Observability, Azure Monitor & KQL | a KQL query engine (where/summarize/bin/join) + an alert-rule evaluator |
| 14 | Reliability, HA & Operational Troubleshooting | SLA composition + retry/backoff/jitter + circuit breaker + 429/Retry-After + a triage decision tree |
| 15 | Principal Architecture, FinOps & Capstone | an end-to-end secure event-driven serverless platform model with a combined security/SLA/cost scorer |
Use the sidebar for the full clickable table of contents, and see GLOSSARY.md / CHEATSHEET.md for the running references.
How to Use This Track
- Start here, then read Phase 00 end to end — it builds the mental model (control plane, Well-Architected pillars, the tradeoff dials) that every later phase plugs into.
- For each phase: read
WARMUP.md(professor), skimHITCHHIKERS-GUIDE.md(the numbers), do the lab (lab.pyred → green againsttest_lab.py), then readBROTHER-TALK.md. - Work phases roughly in order — identity (P03–P05) and networking (P06) underpin everything after them.
- Use interview-prep/ and system-design/ as running references; the capstone (P15) ties the whole stack together.
Cross-Cutting Themes (the principal's lenses)
- Control plane vs data plane — ARM/RBAC/Policy decide what exists and who may touch it; the blob, message, secret, and token are a separate system with separate identity, throttling, and SLA.
- Identity is the perimeter — every lab that touches auth defaults to deny, validates the token's claims, and prefers a Managed Identity over a secret.
- Idempotency everywhere — ARM
PUT, Terraform apply, Service Bus dedup, Event Grid retry, Durable replay — the same operation twice must converge, not duplicate. - Quantify the tradeoff — SLA composition, retry budgets, partition/shard sizing, and the monthly bill are arithmetic you do before the design review, not after the incident.