🛸 Hitchhiker's Guide — Phase 00: The Azure Principal

Read this if: you can click "Create resource" in the portal but "architect our Azure platform and defend it in a design review" still sounds like a different job. It is. This is the compressed tour the WARMUP derives slowly. Skim it, then read the WARMUP.

0. The 30-second mental model

Everything you do to Azure is one idempotent PUT to a resource ID through one control plane (ARM) — authenticate (Entra), authorize (RBAC, then deny wins), validate (Policy), route to the provider. And every design is a tradeoff across five Well-Architected pillars that you settle with numbers (SLA math, the bill) and record in an ADR. One sentence to tattoo: you don't click resources, you compose tradeoffs on a single control plane — and "best architecture" is meaningless without the workload's weights.

1. The control-plane request, one breath

client (portal / az / Terraform) ── PUT /subscriptions/.../{type}/{name} + Bearer token ──▶ ARM
  ARM:  authenticate (Entra JWT)  →  authorize (RBAC − NotActions, then DENY wins)
        →  Policy (deny/append/modify/audit)  →  resource provider (idempotent PUT)

A 401 is auth, a 403 is RBAC/deny/Policy, a 409 is conflict, a 429 is throttling, a 5xx is the provider. That mapping turns "it won't deploy" into a one-line diagnosis.

2. The resource ID is the whole address space

/subscriptions/{sub}/resourceGroups/{rg}/providers/{namespace}/{type}/{name}

It's simultaneously the RBAC scope, Policy scope, tag target, lock target, and audit key. Scopes nest MG → Subscription → RG → resource, and assignments inherit downward — so you can never answer "who can touch this?" from the resource alone; look up the chain. Nested types: …/virtualNetworks/vnet/subnets/snet → type is virtualNetworks/subnets, name is the leaf snet.

3. Control plane ≠ data plane (the trap)

4. The numbers to tattoo on your arm

5. The five pillars (score every design on these)

Reliability · Security · Cost Optimization · Operational Excellence · Performance Efficiency

You can't max all five. Name the pillar you're trading, quantify both ends, choose, write the ADR. Multi-region buys Reliability + Performance, costs Cost + Operational Excellence. Scale-to-zero buys Cost, costs Performance (cold start). There is no "best architecture" — only "best for these weights."

6. The reliability ladder (buy the lowest rung that hits the target)

single instance  →  multi-AZ (zone-redundant)  →  multi-region active/passive  →  active/active
   99.9%                99.99% (cheap nines)         region-outage survival         most expensive nine

Multi-AZ already hits four nines cheaply; multi-region is for region-outage survival specifically — and you discount the redundant-SLA formula for correlation (copies aren't truly independent).

7. az one-liners worth muscle memory

az account show --query id -o tsv                          # current subscription id
az resource list --query "[].id" -o tsv                    # every resource id (the address space)
az resource show --ids "<resource-id>"                     # round-trip a parsed id
az role assignment list --scope "<resource-id>" -o table   # who can touch this (at this scope)
az role assignment create --assignee <oid> --role "Storage Blob Data Reader" \
   --scope "<account-id>"                                  # grant a DATA role, not Owner
az provider register --namespace Microsoft.Storage         # fix "not registered to use namespace"
az policy assignment list --scope "<scope-id>" -o table    # what policy gates this scope

8. War-story shapes you'll relive

• "I'm Owner but I get 403 on the blob." → control-plane role, no DataAction. Assign a data role; don't escalate to a bigger control-plane role.
• "Our 'three nines' SLA isn't being met." → the path is serial, so the composite is the product (≈99.7 %), not 99.9 %. Add a redundant pair on the weak link, not more retries.
• "The bill doubled and nobody added VMs." → cross-region/egress traffic. Ingress is free; egress isn't. Look at the bandwidth line, not compute.
• "Multi-region is down even though we have two regions." → the copies weren't independent (shared dependency / paired-region fate). The 1 − ∏(1 − Aᵢ) number was an upper bound.
• "The subscription isn't registered to use namespace Microsoft.X." → a resource provider that was never registered. One command fixes it.

9. Vocabulary that signals you've held the pager

• Control plane / data plane — manage the resource vs use its data; different identity, throttling, SLA.
• Idempotent PUT — desired-state write that converges, not duplicates; the basis of IaC.
• Resource ID / scope — the address that is the RBAC/Policy unit; inheritance flows down.
• Deny wins — a deny assignment overrides any allow; RBAC is allow-additive otherwise.
• Serial vs redundant SLA — multiply vs 1 − ∏(1 − Aᵢ); the only two SLA operations.
• Deciding pillar — the one-sentence reason a tradeoff went the way it did; goes in the ADR.
• Spend the headroom — convert unused reliability/latency margin into cost savings.
• ADR — the durable record of a decision and what would reverse it.

10. Beginner mistakes that mark you in interviews

1. Saying "best architecture" without asking the workload's pillar weights.
2. Thinking Owner can read data — forgetting the control/data-plane split.
3. Quoting an SLA as the weakest link's number instead of the product of the serial path.
4. Saying "99.9 % vs 99.99 %, basically the same" — it's 43 vs 4 minutes, a 10× ask and a different architecture.
5. Optimising compute when egress dominates the bill (optimise the term that's actually big).
6. Treating multi-region as "free reliability" instead of the most expensive, correlation- discounted nine.
7. Making decisions in chat instead of ADRs — so they're re-litigated every quarter.

11. How this phase pays off later

• The control-plane request is P01–P05's spine (ARM deploy graph, Terraform plan, RBAC, Policy, landing zones all live on it).
• The resource ID + scope model is exactly how P04/P05 reason about inheritance.
• The control/data-plane split recurs in P09 (API auth), P10 (Service Bus), P12 (Key Vault).
• The SLA + cost math is Round-1 mental arithmetic and the backbone of P14 (reliability) and P15 (FinOps capstone).
• The ADR habit is Round-5 (architecture leadership) and your day job as a principal.

Now read the WARMUP slowly, then build the modeler. You'll use its functions as back-of-envelope checks for the rest of the track.