Deploy and Govern a Web App on Azure

Deploy a live web app on Azure and apply governance controls end-to-end.

Introduction

30 Second Summary

Cloud certifications prove you can work with a platform, but studying theory alone won't stick. The best way to prepare for the AZ-900 exam is to deploy something real on Azure.

In this project, you will deploy a live web app on Azure App Service, then apply governance controls like tags, locks, and policies to it. You'll cover all three AZ-900 exam domains through hands-on work in the Azure Portal.

What You'll Build

A fully deployed web application on Azure App Service (PaaS), organized within a properly governed resource group with identity access, monitoring, and cost management configured.

By the end of this project, you'll have:

A live web app accessible via a public .azurewebsites.net URL you can share.
A resource group with proper tagging, a delete lock, and an Azure Policy assignment enforcing tag requirements.
Hands-on experience with Azure Monitor metrics and Cost Management for tracking resource consumption.
Secret Mission: Create an Azure Storage account with Blob Storage and configure different access tiers to understand Azure's storage services.

Are there any prerequisites?

A basic understanding of cloud computing concepts (IaaS, PaaS, SaaS) is helpful. If you have AWS experience, many Azure concepts will feel familiar with different names.

No prior Azure account or Azure experience is needed. You'll set everything up from scratch in Step 1.

Create Your Azure Free Account

Before you can deploy anything on Azure, you need an account. Azure offers a generous free tier for new users that gives you real credits to experiment with production services.

In this step, you'll create your free Azure account and get familiar with the Azure Portal. The portal is where you'll manage every resource for the rest of this project.

In this step, get ready to:

Sign up for an Azure free account with $200 credit.
Explore the Azure Portal home page.
Verify your subscription is active.

Sign up for an Azure free account

Azure's free account gives you $200 in credit to spend across Azure services within 30 days. You also get 20+ popular services free for 12 months. Your card will not be charged unless you explicitly upgrade to pay-as-you-go pricing later.

Open your web browser and navigate to the Azure free account page:
https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account
Click Try Azure for free.
Sign in with a Microsoft account or a GitHub account. If you don't have either, create a free Microsoft account when prompted.

What do you need to sign up?

You'll need a phone number and a credit or debit card (not prepaid). Azure uses these for identity verification only.

During sign-up, you may see a temporary $1 authorization on your card. This is reversed after verification and is not a charge.

Fill in the About you section with your country/region, name, email, phone number, and address.
Complete the identity verification step. You'll receive an SMS code to confirm your phone number.
Enter your credit or debit card details in the Identity verification by card section.
Review the Microsoft Customer Agreement and click Sign up.

Seeing "You're not eligible for an Azure free account"?

Make sure you're using a personal Microsoft account, not a work or school account.
Clear your browser cache or try an incognito/private window.
Confirm your card is not prepaid. Virtual cards are also not accepted.

Help me troubleshoot my Azure free account sign-up.

Explore the Azure Portal

Now that your account is created, the Azure Portal is your primary interface for managing everything in Azure. Think of it as your cloud dashboard.

Navigate to https://portal.azure.com in your browser. You'll land on the Home page after signing in.
Look at the top of the page. Notice the search bar in the page header. This is Global search and you'll use it constantly to find services, resources, and documentation.
Look at the left side of the page. The Portal menu lets you navigate between Azure services. You can expand it by clicking the menu icon in the upper left corner.
Look at the top-right area. The Notifications icon (bell) is part of the global controls. It shows you status updates when you create or modify resources.

How does this compare to AWS?

The Azure Portal is similar to the AWS Management Console. The search bar works like the AWS service search. The portal menu is like the AWS services dropdown. Notifications mirror the CloudFormation events panel.

Verify your subscription is active

Every Azure resource you create lives inside a subscription. A subscription is the billing boundary for your account. In AWS terms, a subscription is like an AWS account.

Click the search bar at the top of the portal.
Type Subscriptions and select Subscriptions from the results.
Confirm you see a subscription listed (typically named Azure subscription 1) with a status of Active.

What is a subscription?

A subscription is Azure's billing boundary. All resources you create are billed to a subscription. You can have multiple subscriptions to separate workloads or departments.

Azure's full hierarchy runs: Management Groups > Subscriptions > Resource Groups > Resources. You'll work with resource groups in the next step.

Don't see an active subscription?

Make sure your sign-up completed fully. Check your email for a confirmation from Microsoft Azure.
Try refreshing the page. New subscriptions can take a minute to appear.
If your subscription shows as Disabled, your card verification may have failed. Go to Cost Management + Billing in the search bar to check for issues.

Help me fix my Azure subscription status.

Your Azure account is ready to go. Next up, you'll create your first resource group and deploy a live web app.

Create a Resource Group and Deploy a Web App

Every Azure resource needs a home. Before you deploy anything, you need a resource group to organize related resources together.

In this step, you'll create a resource group and then deploy a live web app inside it using Azure App Service. By the end, you'll have a public URL anyone can visit.

In this step, get ready to:

Create a resource group to organize your Azure resources.
Deploy a web app on Azure App Service using the Free F1 tier.
Visit your live app's public URL.

Create a resource group

A resource group is a logical container that holds related Azure resources. Think of it as a folder that keeps everything for one project together.

In the portal search bar at the top of the page, type Resource groups and select it from the results.
Click Create.
For Subscription, select your active subscription (Azure subscription 1).
For Resource group, enter az900-webapp-rg.
For Region, select a region close to you (e.g., East US).
Click Review + create, then click Create.

What is a resource group?

A resource group is a logical container for related resources in Azure. Every resource (web app, database, storage account) must belong to exactly one resource group.

In AWS terms, a resource group is like a combination of tags and a CloudFormation stack for organizing resources. Deleting the resource group deletes everything inside it.

Not seeing your subscription?

Make sure you completed the sign-up process in Step 1 and that your subscription status shows Active. You can verify by searching Subscriptions in the portal search bar.

Help me troubleshoot my Azure subscription

Deploy your web app on App Service

Azure App Service is a PaaS (Platform as a Service) offering that hosts web apps without you managing servers. In AWS terms, it works like Elastic Beanstalk.

In the portal search bar, type App Services and select it under Services.
Click Create, then select Web App.
In the Basics tab, for Subscription, select your active subscription.
For Resource group, select az900-webapp-rg.
For Name, enter a globally unique name for your web app (e.g., az900-myapp-yourname). Use only letters, numbers, and hyphens.
Set Publish to Code.
For Runtime stack, select .NET 8 (LTS).
For Operating System, select Windows.
For Region, choose the same region you selected for your resource group.
Under Pricing plans, click Create new for the App Service plan.
Name the plan az900-plan.
In the Pricing plan dropdown, select Free F1.
Click Review + create at the bottom of the page.
After validation passes, click Create.

What is an App Service plan?

An App Service plan defines the compute resources (CPU, memory, storage) that run your web app. The Free F1 tier gives you 60 CPU minutes per day, 1 GB RAM, and 1 GB storage at no cost.

Multiple web apps can share the same plan. The plan determines billing, not the number of apps running on it.

Why choose the same region?

Keeping your resource group and web app in the same region reduces latency and simplifies management. Pick whichever region is geographically closest to you.

Visit your live web app

Deployment takes about 30 seconds. Once it finishes, you can see your live app in a browser.

After deployment completes, click Go to resource.
On the App Service Overview page, find the Default domain field. It shows your app's URL in the format https://your-app-name.azurewebsites.net.
Click the URL to open your live web app in a new tab.

You should see a default Azure placeholder page with a message indicating your web app is running and waiting for your content.

Seeing an error instead of the placeholder page?

Give it a minute. The app sometimes takes a moment to fully start after deployment. Refresh the page after 30 seconds.

If you still see an error, double-check that you selected .NET 8 (LTS) as the runtime stack and Windows as the operating system during creation.

Help me troubleshoot my App Service deployment

Why is this a PaaS deployment?

You did not provision a VM, configure an operating system, or install a web server. Azure handled all of that behind the scenes. You just specified your runtime and clicked create. That is the power of PaaS compared to IaaS, where you manage the infrastructure yourself.

You now have a live web app running on Azure. Next up, you'll explore identity and access management with Microsoft Entra ID and Role-Based Access Control.

Explore Identity and Access with Microsoft Entra ID

Your web app is live and accessible to anyone with the URL. But in a real organization, you need to control who can access and manage your Azure resources.

In this step, you'll explore Microsoft Entra ID, Azure's identity service, and Role-Based Access Control (RBAC). These tools answer two critical questions: "Who are you?" and "What are you allowed to do?"

In this step, get ready to:

Explore Microsoft Entra ID and note your tenant details.
View RBAC role assignments on your resource group.
Browse built-in roles and understand Azure's resource hierarchy.

Open Microsoft Entra ID and note your tenant details

Every Azure subscription is associated with a Microsoft Entra ID tenant. The tenant is your organization's identity boundary. It stores user accounts, groups, and application registrations.

In the portal search bar at the top, type Microsoft Entra ID and select it from the results.
On the Overview page, look at the Basic information section.
Note your Tenant ID (the unique identifier for your directory).
Note your Primary domain (your default domain, usually ending in .onmicrosoft.com).

What is Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud-based identity and access management service. It handles authentication (proving who you are) and authorization (what you're allowed to do).

In AWS terms, Microsoft Entra ID combines the functions of AWS IAM and AWS Organizations identity into one service. Every Azure subscription trusts exactly one Entra ID tenant.

Explore role assignments in Access control (IAM)

RBAC is how Azure controls who can do what on which resources. Let's see what role you have on your resource group.

In the portal search bar, type Resource groups and select it.
Click your az900-webapp-rg resource group.
In the left menu, click Access control (IAM).
Click the Role assignments tab to view all role assignments at this scope.

You should see yourself listed with the Owner role. This role gives you full access to manage all resources in the group, including assigning roles to others.

Click + Add then Add role assignment to explore the available roles.
Browse the role categories. You'll see Job function roles (like Reader and Contributor) and Privileged administrator roles (like Owner).
Do NOT assign any role. Close the panel by clicking the X or pressing Escape.

What is RBAC?

Role-Based Access Control (RBAC) lets you assign permissions to users, groups, and applications at a specific scope. Azure has hundreds of built-in roles, but the three most common are:

Reader can view resources but not modify them.
Contributor can create and manage resources but cannot grant access to others.
Owner has full access, including granting access to others.

In AWS terms, RBAC roles work like IAM policies attached to users or groups.

Browse built-in roles and understand the resource hierarchy

Azure's access model relies on a hierarchy. Roles assigned at a higher level are inherited by everything below it.

Still in Access control (IAM) for your resource group, click the Roles tab.
Browse the list of built-in and custom roles available at this scope.
Click the View link in the Details column for any role to inspect its permissions.

Notice how roles are scoped. A role assigned at the subscription level is automatically inherited by all resource groups and resources below it.

What is Azure's resource hierarchy?

Azure organizes resources in a four-level hierarchy, from broadest to most specific:

Management Groups (organize multiple subscriptions).
Subscriptions (billing boundary).
Resource Groups (logical container for related resources).
Resources (individual services like your web app).

Permissions flow downward. If you're granted Contributor on a subscription, you're automatically a Contributor on every resource group and resource inside it. Understanding this hierarchy is critical for the AZ-900 exam.

Don't see your Owner role?

If you don't see yourself listed on the Role assignments tab, make sure you've selected the correct resource group (az900-webapp-rg). Also check that you're signed in with the same account you used to create the resource group.

Help me find my role assignment on my resource group.

You now understand how Azure identifies users and controls access. Next up, you'll apply governance controls like tags, locks, and policies to protect and organize your resources.

Apply Governance Controls

In the previous step, you explored identity and access controls with Microsoft Entra ID and RBAC. You now know who can access your resources and what they can do.

But access control is only part of the governance picture. You also need tools to organize resources, prevent accidental deletions, and enforce standards across your environment. In this step, you'll apply three governance controls to your resource group: tags, locks, and an Azure Policy.

In this step, get ready to:

Add resource tags for organization and cost tracking.
Apply a delete lock to protect your resource group from accidental deletion.
Assign an Azure Policy to enforce tagging standards on new resources.

Add tags to your resource group

Tags are key-value metadata pairs you attach to resources and resource groups. They help you organize, search, and track costs across your Azure environment.

In the portal search bar at the top, type Resource groups and select it.
Click az900-webapp-rg to open your resource group.
In the left menu, click Tags.
In the Name field, enter Environment.
In the Value field, enter Learning.
Click the empty row below to add a second tag.
For the second tag, enter Project as the Name and AZ900-Prep as the Value.
Click Apply.

What are tags?

Tags are metadata for organizing, searching, and tracking costs across resources. Each tag has a name (like Environment) and a value (like Learning). You can have up to 50 tag name-value pairs per resource or resource group.

In AWS terms, Azure tags are identical to AWS resource tags. Tags applied to a resource group are not automatically inherited by the resources inside it.

You should now see both tags displayed in the resource group overview.

Apply a delete lock to your resource group

Resource locks prevent accidental modifications or deletions. A delete lock means nobody (including you) can delete the resource group until the lock is removed first.

In the left menu of your resource group, click Locks.
Click + Add.
In the Lock name field, enter no-delete.
For Lock type, select Delete.
In the Notes field, enter Prevent accidental deletion during learning.
Click OK.

What is a resource lock?

Azure supports two lock types: Delete (prevents deletion but allows reads and modifications) and Read-only (prevents all changes). Locks apply to the resource regardless of RBAC permissions.

In AWS terms, this is similar to a DeletionPolicy in CloudFormation, but applied as a separate control you can add or remove independently.

You should see the no-delete lock listed on the Locks page.

Assign an Azure Policy to enforce tagging

Tags are useful, but only if everyone remembers to add them. Azure Policy lets you automatically enforce rules across your resources. You'll assign a built-in policy that denies any new resource creation in your resource group if it lacks the required tag.

In the portal search bar, type Policy and select it.
In the left menu, click Assignments.
Click + Assign policy at the top.
Under Scope, click the ellipsis (...).
Select your subscription, then expand it and select your resource group az900-webapp-rg.
Click Select at the bottom of the scope pane.
Under Policy definition, click the ellipsis (...) to open the list of available definitions.
In the search box, type Require a tag and its value on resources and press Enter.
Select the matching policy definition, then click Add.
Click Next to move to the Parameters tab.
For Tag Name, enter Environment.
For Tag Value, enter Learning.
Click Review + create.
Click Create.

What does this policy do?

The "Require a tag and its value on resources" policy has a deny effect. This means any new resource created inside az900-webapp-rg that does not have the Environment: Learning tag will be blocked. Existing resources are not affected retroactively.

In AWS terms, Azure Policy is like a combination of AWS Config Rules and Service Control Policies. It evaluates resources against rules and can audit or deny non-compliant deployments.

Don't see your resource group in the scope picker?

Make sure you select your subscription first, then expand it to find the resource group. If the scope picker appears unresponsive, try refreshing the page or using an incognito browser window.

You need at least Owner or Policy Contributor permissions on the subscription to assign policies. Your free account should have Owner by default.

Why can't I find my resource group in the scope picker?

Policy evaluation takes time

Azure Policy assignments can take up to 30 minutes to fully evaluate existing resources. You do not need to wait for this. The policy is active as soon as you create it, and it will deny non-compliant new resource creations immediately.

You should see your new policy assignment listed on the Policy Assignments page.

Your resource group is now properly governed with metadata tags, deletion protection, and an automated compliance policy. Next up, you'll monitor your app's performance and explore cost management tools.

Monitor Your App and Explore Cost Management

Your app is now deployed, secured with identity controls, and governed with tags, locks, and policies. The final piece of the puzzle is knowing how your app is performing and what it costs to run.

In this step, you'll explore the monitoring and cost tools that Azure provides out of the box. These cover the last major slice of the AZ-900 exam: management and governance.

In this step, get ready to:

View live metrics for your App Service using Azure Monitor.
Explore Cost Management to see your spending breakdown.
Review Azure Advisor recommendations for your resources.

View your app's metrics with Azure Monitor

Azure Monitor is Azure's built-in observability platform. It collects metrics and logs from your resources automatically, with no extra setup required for App Service.

In the portal search bar, type App Services and select it.
Click your web app (az900-myapp-yourname) to open its Overview page.
In the left menu under Monitoring, click Metrics.
In the Metric dropdown, select CPU Time.
Change the time range to Last hour using the time picker in the top-right corner of the chart.

You should see a chart showing CPU usage over the last hour. Since your app is on the Free F1 tier with minimal traffic, expect values close to zero.

What is Azure Monitor?

Azure Monitor collects metrics and logs from all your Azure resources automatically. For App Service, the metrics system is always-on with no configuration needed.

In AWS terms: Azure Monitor is like CloudWatch. It provides the same metrics, dashboards, and alerting capabilities.

Don't see any data on the chart?

If the chart is empty, make sure the Metric dropdown shows CPU Time and the time range is set to Last hour. A flat line at zero is normal for the Free tier with no active traffic.

Help me understand why my Azure Monitor metrics chart is empty.

Explore Cost Management and budgets

Cost Management is where organizations track and control their Azure spending. For the AZ-900 exam, remember that Azure Cost Management + Billing helps you analyze, budget, and optimize costs.

In the portal search bar, type Cost Management and select Cost Management (under the Cost Management + Billing service).
Click Cost analysis in the left menu.
You'll see a breakdown of your spending. This should be $0 or near $0 since you're using the Free tier.
Change the view to Cost by resource to see which specific resources are consuming your credit.
In the left menu, explore the Budgets option. This is where organizations set spending thresholds and alerts.

Why does Cost Management matter for AZ-900?

The AZ-900 exam tests your understanding of Azure's cost optimization tools. Cost Management lets you set budgets, view cost breakdowns by resource or tag, and receive alerts when spending exceeds thresholds.

Remember the tags you applied in the previous step? Tags like Environment and Project allow organizations to filter cost reports and understand exactly where money is going.

Review Azure Advisor recommendations

Azure Advisor provides personalized recommendations across five categories: reliability, security, performance, cost, and operational excellence.

Navigate back to your App Service. In the portal search bar, type App Services and click your app.
In the left menu, click Advisor recommendations.
Review any recommendations shown. You may see suggestions related to security or performance.

What are the three monitoring tools for AZ-900?

For the exam, remember these three distinct tools:

Azure Monitor collects metrics and logs from your resources. Think of it as the data collection and alerting layer.
Azure Advisor analyzes your resource configurations and provides actionable improvement recommendations.
Azure Service Health tracks the status of the Azure platform itself. It alerts you to outages, planned maintenance, and service issues.

In AWS terms: Azure Advisor is like Trusted Advisor. Azure Service Health is like the AWS Health Dashboard.

Try searching for Advisor directly

You can also type Advisor in the portal search bar to open the full Advisor dashboard. This gives you a summary across all your resources, grouped by the five recommendation categories.

Secret mission

Add Azure Blob Storage

Your app is deployed and governed, but what about storing files? In this secret mission, you'll create an Azure Storage account with Blob Storage, upload a file, and explore access tiers (Hot vs Cool) to understand Azure's storage cost optimization.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project uses Azure's Free F1 tier for App Service, which costs nothing. The Storage account (if created in the Secret Mission) costs fractions of a cent for the small amount of data stored. Your $200 free credit covers everything.

Resources you used:

Resource group az900-webapp-rg (contains all project resources).
App Service plan az900-plan (Free F1 tier).
App Service web app (running on Free tier).
Azure Policy assignment (scoped to your resource group).
Storage account with Blob container az900-files (Secret Mission).

Keep everything running

No action needed. Choose this if you're still actively building or studying for the AZ-900 exam.

Your App Service runs on the Free F1 tier, which costs $0 per month.
Your Storage account costs fractions of a cent and is covered by your $200 credit.
Your $200 credit lasts 30 days from sign-up. After that, free-tier services (like the F1 App Service plan) continue at no cost, but the Storage account would require upgrading to pay-as-you-go.

Pause - I'll come back to this later

The Free F1 App Service plan has no always-on capability, so there is nothing to pause. Your app only uses compute when actively receiving requests.

No action needed. Your resources remain in place at no cost while you're away.
If your 30-day free credit expires while you're away, the Storage account may be affected. The F1 App Service plan stays free regardless.

Delete - I don't want to use this again

Remove all project resources and start fresh. Deleting the resource group removes everything inside it, including the App Service plan, web app, Storage account, and the Policy assignment scoped to it.

You must remove the delete lock before you can delete the resource group.

In the Azure Portal search bar, type Resource groups and select it.
Click az900-webapp-rg to open your resource group.
In the left menu under Settings, click Locks.
Find the no-delete lock and click the Delete button next to it to remove the lock.
Go back to the resource group overview. Click Delete resource group at the top.
Type az900-webapp-rg in the confirmation field and click Delete.
Wait for the notification confirming the resource group has been deleted. This may take a minute or two.

That's a Wrap!

Nice work! You just deployed and governed your first Azure application end-to-end, covering all three AZ-900 exam domains through hands-on work in the Azure Portal.

You've learned how to:

Deployed a live web app on Azure App Service (PaaS) with a public URL, understanding how it compares to IaaS and SaaS.
Applied governance controls to your resources using tags, resource locks, and Azure Policy.
Monitored your app with Azure Monitor metrics and explored Cost Management to track resource spending.
Secret Mission: Created an Azure Storage account with Blob Storage and explored access tiers (Hot/Cool) to understand storage cost optimization.

Ready to quiz yourself?