Deploy and Govern Your First Azure Website

Host a live website on Azure Blob Storage with governance controls.

Introduction

30 Second Summary

Every website you visit lives on a server somewhere. When companies host their websites, they also need to organize those resources, protect them from accidental deletion, and keep an eye on costs. That's cloud administration in a nutshell.

In this project, you will deploy a live website on Azure, then apply the same governance controls that real Azure administrators use every day: tags for organization, locks for protection, and budgets for cost monitoring.

What You'll Build

By the end, you'll have a personal website live on the internet that you can pull up on your phone and show to anyone, backed by professional-grade governance controls that mirror real production workloads.

By the end of this project, you'll have:

A live public website hosted on Azure Blob Storage with a URL you can share with anyone.
Governance controls in place including tags that organize your resources and a resource lock that physically prevents accidental deletion.
A cost monitoring budget with an email alert that fires before charges ever surprise you.
Secret Mission: Deploy a custom 404 error page that displays when visitors hit a broken link on your site.

Are there any prerequisites?

You need an Azure account (a free account with $200 credit works perfectly) and a Windows PC with a web browser. No coding experience or additional software is required.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters.

You're going to deploy a live website on Azure, then apply the same governance controls that real administrators use to organize, protect, and monitor production workloads.

Set Up Your Azure Resources

Your website needs a home on Azure. Before you can deploy any files, you need two foundational building blocks in place.

In this step, you'll create a resource group to organize your Azure resources and a storage account to hold your website's files. These two pieces are the foundation for everything that follows.

In this step, get ready to:

Create a resource group to organize your project resources.
Create a storage account to store your website files.

Orient to the Azure Portal dashboard

The Azure Portal is your command center for creating and managing everything in this project. The search bar at the top of the page is how you'll find every Azure service.

In the Azure Portal, look at the top of the page. You'll see a search bar in the center that says Search resources, services, and docs.
Confirm you can see this search bar. You'll use it in every substep to navigate to Azure services.

What is the Azure Portal?

The Azure Portal is a web-based console where you create, configure, and manage all your cloud resources. Think of it as your cloud dashboard.

Everything you do in this project happens here. The search bar is the fastest way to navigate to any service.

Create a resource group

A resource group is a container that holds related Azure resources together. It makes it easy to manage, monitor, and delete everything for a project in one place.

Click the search bar at the top of the Azure Portal.
Type Resource groups and select Resource groups from the results.
Click + Create.
In the Resource group name field, enter az900-website-rg.
In the Region dropdown, select a region close to your location (for example, (US) East US or (Europe) West Europe).
Click Review + create.
Click Create.

You'll see a notification that your resource group has been created. This confirms your organizational container is ready.

Why do resource groups matter?

In a real Azure environment, you might have dozens of resources. Resource groups let you manage them as a unit. When you delete a resource group, everything inside it gets deleted too.

For the AZ-900 exam, remember that every Azure resource must belong to exactly one resource group.

Don't see Resource groups in search results?

Make sure you're typing in the search bar at the very top of the portal page, not in a sidebar filter. The search bar searches across all Azure services.

Help me find the Resource groups service in the Azure Portal.

Create a storage account

A storage account provides the actual storage space for your website files. Azure requires a globally unique name for each storage account.

Click the search bar at the top of the Azure Portal.
Type Storage accounts and select Storage accounts from the results.
Click + Create.
In the Resource group dropdown, select az900-website-rg.
In the Storage account name field, enter a globally unique name using only lowercase letters and numbers (for example, az900 followed by your name and the year, like az900yourname2026).
In the Region dropdown, select the same region you chose for your resource group.
Set Performance to Standard.
Set Redundancy to Locally-redundant storage (LRS).
Click Review + create.
Click Create.

Azure will deploy your storage account. This may take 15-30 seconds.

Why these settings?

Standard performance is the cost-effective option for static websites. Locally-redundant storage (LRS) keeps three copies of your data in a single data center, which is more than enough redundancy for a learning project.

Storage account names must be globally unique across all of Azure, between 3-24 characters, using only lowercase letters and numbers.

Seeing a name validation error?

If the portal says the storage account name is already taken, try a different combination. Add extra numbers or letters to make it unique. Remember: no uppercase letters, no hyphens, no special characters.

Help me pick a valid storage account name for Azure.

Now confirm that your storage account was created inside the correct resource group.

Before you navigate there, what do you expect to see listed inside your resource group?

Click the search bar and type Resource groups.
Select Resource groups from the results.
Click on az900-website-rg.
In the Overview page, look at the Resources section. You should see your storage account listed there.

Your storage account appears inside the resource group. This confirms both resources are created and properly organized.

Your Azure building blocks are in place. Next up, you'll turn this storage account into a live web server and deploy your first website to the world.

Deploy Your Website Live

Your resource group and storage account are in place. You now have a container ready to hold files, but nothing is actually serving a website yet.

Azure Blob Storage has a built-in static website hosting feature that turns your storage account into a web server with a public URL. In this step, you will enable that feature, create an HTML page, and upload it so the whole world can visit your site.

In this step, get ready to:

Enable static website hosting on your storage account.
Create an HTML file for your website in Notepad.
Upload the file and visit your live website in the browser.

Enable static website hosting

Your storage account can store files, but it does not serve them as a website by default. You need to flip a switch that tells Azure to treat one specific container as a web root.

In the Azure Portal, use the search bar at the top to search for Storage accounts.
Click on your storage account (e.g., az900yourname2026).
In the left menu under Data management, click Static website.
Set the toggle to Enabled.
In the Index document name field, type index.html.
Click Save.

After saving, a Primary endpoint URL appears on the page. This is your live website address.

Copy the Primary endpoint URL and paste it somewhere safe (a new browser tab's address bar works fine). You will need it shortly.

What is the Primary endpoint?

The Primary endpoint is the public URL where Azure serves your static website. It follows the format https://<storageaccount>.z<N>.web.core.windows.net/ where the number after z depends on your chosen region.

Behind the scenes, enabling static website hosting also created a special container called $web in your storage account. Any file you upload to that container becomes publicly accessible through this URL.

Don't see the Primary endpoint URL?

Make sure the toggle is set to Enabled and that you clicked Save. The endpoint only appears after saving.

Also confirm you typed index.html in the Index document name field. The field is case-sensitive.

Need more help? Why isn't my Primary endpoint URL showing after I enable static website hosting?

Create your website file

Now you need an actual HTML page to serve. You will create a simple page in Notepad that celebrates your first Azure deployment.

Press the Windows key to open your search bar.
Type Notepad and press Enter to open it.
Paste the following code into the empty Notepad window. This is the page structure and styling:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>My First Azure Website</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            max-width: 800px;
            margin: 0 auto;
            padding: 40px 20px;
            background-color: #f0f8ff;
            color: #333;
        }
        h1 {
            color: #0078d4;
        }
        .badge {
            display: inline-block;
            background-color: #0078d4;
            color: white;
            padding: 8px 16px;
            border-radius: 4px;
            margin-top: 20px;
        }
    </style>
</head>

What does this code do?

The <style> block defines how your page looks: a clean centered layout, a light blue background, and Azure-blue accent colors.
The .badge class creates a small blue pill-shaped label to show the page is powered by Azure.
The </head> tag at the bottom closes the page's metadata section. Your visible content comes next.

Place your cursor at the end of the last line (after </head>), press Enter to start a new line, and paste this code below it:

<body>
    <h1>My First Azure Website</h1>
    <p>This website is hosted on Azure Blob Storage using static website hosting.</p>
    <p>I deployed this as part of my AZ-900 Azure Fundamentals preparation.</p>
    <div class="badge">Powered by Azure</div>
</body>
</html>

What does this code do?

The <body> section contains everything visitors see on your page.
The <h1> is your page heading. The two <p> tags are paragraphs of text.
The <div class="badge"> creates the blue badge using the style you defined in the head section.

Click File in the Notepad menu bar, then click Save As.
Navigate to your Desktop folder in the save dialog.
Change the Save as type dropdown from "Text Documents (*.txt)" to All Files (*.*).
In the File name field, type index.html.
Click Save.

File saved as index.html.txt?

If you forgot to change Save as type to All Files (*.*), Notepad adds a hidden .txt extension. Delete the file, reopen Notepad, paste the code again, and this time change the dropdown before saving.

Still stuck? Help me save an HTML file correctly in Notepad

✔️ Awesome, I've got everything!

Great. Double check you saved the file to your Desktop as index.html with the type set to All Files.

ⓧ I'd like to double check the full code

Scroll up and confirm your Notepad file contains both chunks in order:

Chunk 1: The page structure and styling, starting with <!DOCTYPE html> and ending with </head>.
Chunk 2: The visible page content, starting with <body> and ending with </html>.

Your file should have 35 lines total. If anything is missing, delete the file content and paste both chunks again in order.

Upload the file and visit your live site

Your HTML file exists on your Desktop. Now you need to get it into the $web container so Azure can serve it to the world.

Switch back to the Azure Portal in your browser.
Navigate to your storage account (search Storage accounts and click your account name).
In the left menu under Data storage, click Containers.
Click on the $web container in the list.
Click the Upload button at the top of the container page.
In the upload panel, click Browse for files, navigate to your Desktop, select index.html, and click Open.
Click Upload to confirm.

You should see index.html listed inside the $web container. Your website is now live.

Why the $web container?

When you enabled static website hosting, Azure automatically created this special $web container. It is the only container Azure will serve as a website. Files in any other container are not publicly accessible through your website URL.

Before you open your site, what do you expect to see when you visit the Primary endpoint URL?

Open a new browser tab and paste your Primary endpoint URL into the address bar.
Press Enter to visit the page.

You should see your website with the heading "My First Azure Website" in blue, two paragraphs of text, and a blue "Powered by Azure" badge. This page is live on the internet and accessible from any browser in the world.

Seeing a 404 or blank page?

If you get a 404 error, confirm that your file is named exactly index.html (lowercase, no .txt extension) inside the $web container. The Index document name you set earlier is case-sensitive and must match exactly.

If the page is blank or shows broken formatting, open index.html in Notepad again and confirm both the head and body sections are present. Re-upload the corrected file if needed.

Still not working? Help me troubleshoot my Azure static website not loading

You just deployed a live website that anyone on the internet can visit. Next up, you will organize your resources with tags and discover why your site needs more protection than a confirmation dialog.

Organize Your Resources with Tags

Your website is live and accessible to anyone with the URL. In a real Azure environment with dozens of resources across multiple projects, you need a way to identify which project each resource belongs to and who owns it.

In this step, you'll add tags to organize your resources. Then you'll uncover a serious vulnerability: nothing prevents someone from accidentally deleting your entire live website.

In this step, get ready to:

Add tags to your resource group and storage account for organization.
Discover that tags do NOT automatically inherit from parent to child resources.
Uncover a deletion vulnerability that threatens your live website.

Add tags to your resource group

Tags are name-value pairs that let you categorize and filter resources across your entire Azure subscription. Think of them like labels on folders in a filing cabinet.

Return to the Azure Portal home page.
Type Resource groups in the search bar at the top and select it from the results.
Click on az900-website-rg to open your resource group.
In the left menu, click Tags.

You'll see an empty tags page. Time to add your first tag.

In the Name field, type Environment.
In the Value field, type Learning.
Click the empty row below to add another tag.
In the second Name field, type Project.
In the second Value field, type MyFirstWebsite.
Click Apply.

You should see a confirmation that the tags were saved. Both tags now appear on your resource group.

What are tags used for?

Tags help you organize resources by project, environment, owner, or cost center. For example, a company might tag resources with Department=Marketing to track which team is responsible for the costs.

On the AZ-900 exam, you'll be tested on how tags fit into Azure's governance hierarchy. They're one of several tools for managing resources at scale.

Don't see the Apply button?

Make sure you've clicked into the Name and Value fields and typed your values. The Apply button only becomes active once you've entered at least one tag pair.

help me find the Tags section in the Azure Portal

Tag your storage account and discover inheritance

You might expect that tagging a resource group would automatically apply those tags to every resource inside it. Let's test that assumption.

Click Overview in the left menu to return to the resource group's main page.
Click on your storage account name in the resources list to open it.
In the storage account's left menu, click Tags.

The tags page is empty. Your resource group's tags did NOT automatically flow down to the storage account inside it.

Why don't tags inherit?

This is a key AZ-900 concept. Tags applied to a resource group are NOT inherited by the resources within it. Each resource must be tagged independently.

This is by design. A resource group might hold resources from different projects or environments, and inheriting the parent's tags could cause incorrect categorization.

Add the same two tags directly to your storage account. In the Name field, type Environment and in Value, type Learning.
Add a second row. In Name, type Project and in Value, type MyFirstWebsite.
Click Apply.

Both tags now appear on your storage account. You've tagged both resources independently, just as you would in a production Azure environment.

Discover the deletion vulnerability

Your resources are tagged and organized. But how safe are they? Let's test what happens if someone tries to delete your entire resource group, including your live website.

Navigate back to your az900-website-rg resource group. You can use the breadcrumb trail at the top of the page, or search for Resource groups again.
On the Overview page, locate Delete resource group in the top toolbar.

Before you click it, think about this: what do you expect Azure will ask you to do before it deletes everything? Is there any hard barrier stopping you?

Click Delete resource group.

A confirmation dialog appears, asking you to type the resource group name to confirm. That's it. A single text field is the ONLY protection your live website has.

Anyone with sufficient permissions could type that name, click delete, and your website, storage account, and all your work would be gone permanently.

Click Cancel to close the dialog without deleting anything.

This vulnerability is real

In production Azure environments, accidental deletions happen. A team member might delete the wrong resource group, or an automated script might target the wrong subscription. This is the gap you'll close in the next step with resource locks.

Can't find the Delete resource group button?

Make sure you're on the resource group's Overview page, not inside the storage account. The Delete resource group button is in the top toolbar of the resource group page. You may need to scroll right in the toolbar if your browser window is narrow.

help me find the delete resource group button in the Azure Portal

You've organized your resources with tags and uncovered a critical gap in your website's protection. Next, you'll add a resource lock that physically blocks deletion, no matter who tries.

Protect Your Resources with Locks

In the previous step, you discovered that a single confirmation dialog is the only thing standing between your live website and accidental destruction. Anyone with sufficient permissions could type the resource group name and wipe everything out.

Resource locks add a hard barrier that blocks deletion regardless of who tries it. In this step, you'll apply a Delete lock and then prove it works by trying to delete your resource group again.

In this step, get ready to:

Apply a Delete lock to your resource group.
Confirm the lock blocks deletion attempts.
Observe lock inheritance on child resources.

Add a Delete lock to your resource group

Azure offers two types of resource locks: Delete (prevents deletion but allows modifications) and Read-only (prevents any changes at all). A Delete lock is the right fit here because you still want to update your website files.

In your az900-website-rg resource group, click Locks in the left menu under Settings.
Click Add at the top of the Locks pane.
In the Lock name field, enter PreventDeletion.
Set Lock type to Delete.
In the Notes field, type Protects live website from accidental deletion.
Click OK.

You should see your new PreventDeletion lock listed in the Locks pane with the type showing as Delete.

What are the two lock types?

A Delete lock allows reading and modifying the resource, but blocks deletion. A Read-only lock blocks both changes and deletion.

For a live website where you still want to upload new files, Delete is the right choice. Read-only would prevent you from updating your own site.

Don't see the Locks option?

Make sure you're looking at the resource group level, not inside the storage account. The left menu should say az900-website-rg at the top. Locks appears under the Settings section in the left navigation.

Help me find the Locks setting in my resource group

Test the lock by attempting deletion

The lock is in place. Now you'll prove it actually works by repeating the same deletion attempt that was so easy in the previous step.

Click Overview in the left menu to return to the resource group's main page.
Click Delete resource group in the top toolbar.
Type the resource group name az900-website-rg in the confirmation field.

Before you click Delete, what do you expect to happen this time? Last step, nothing stopped you. Will it be different now?

Click Delete.

This time, Azure blocks the deletion with an error stating the resource group cannot be deleted due to the active lock. The lock worked.

Why is this different from the confirmation dialog?

The confirmation dialog you saw in the previous step only asks you to type a name. It's a soft safeguard that anyone with sufficient permissions can bypass.

A resource lock is a hard barrier at the Azure platform level. Even an Owner-role user cannot delete the resource until someone explicitly removes the lock first. This two-step protection prevents hasty or accidental deletions.

Observe lock inheritance on child resources

You applied the lock to the resource group, not to the storage account directly. Locks placed on a resource group apply to all resources within that group. This is called lock inheritance.

Close the deletion error and click Overview in the left menu.
Click on your storage account name in the resources list.
In the storage account's left menu under Settings, click Locks.

You should see the PreventDeletion lock listed here, even though you never applied it to the storage account directly. The lock is inherited from the parent resource group.

Why does lock inheritance matter?

A single lock at the resource group level protects every resource inside it. You don't need to apply locks one by one to each storage account, database, or virtual machine.

This is an important AZ-900 concept. Tags do NOT inherit from resource groups, but locks DO. The two behave differently on purpose.

Don't see the inherited lock?

Make sure you're viewing the Locks pane of the storage account (not the resource group). If the lock doesn't appear, return to the resource group's Locks pane and confirm the lock was saved successfully.

Help me find the inherited lock on my storage account

Your live website is now protected. A single lock at the resource group level guards both the group itself and everything inside it. Next up, you'll set up cost monitoring so you never get surprised by charges.

Set Up Cost Monitoring

Your website is live, organized with tags, and protected by a resource lock. The final piece of the governance puzzle is knowing what you're spending.

Without a budget, costs could quietly climb without you noticing. Cost Management in Azure lets you create budgets with email alerts that fire before charges ever become a surprise.

In this step, get ready to:

Navigate to the Budgets pane in Cost Management.
Create a monthly budget with a $5 limit.
Configure an email alert at 80% of your budget.

Navigate to Cost Management Budgets

Azure budgets live at the subscription level, not inside a resource group. You need to navigate to your subscription first, then find the Cost Management section.

In the portal search bar at the top, type Subscriptions.
Click Subscriptions from the results.
Select your subscription from the list (you likely have one subscription listed).
In the left menu, find Cost Management and click Budgets.

You should see the Budgets pane. It will be empty since you haven't created any budgets yet.

Don't see Cost Management in the menu?

Make sure you clicked on the subscription name itself, not just the Subscriptions page. The left menu with Cost Management only appears after you open a specific subscription.

help me find Cost Management in my Azure subscription

Create a monthly budget

A budget sets a spending ceiling and tracks how close you are to it. You will set a $5 monthly limit, which is a sensible cap for learning on the free tier.

Click Add at the top of the Budgets pane.
In the Name field, enter AZ900-Monthly-Budget.
Set the Reset period to Monthly.
Set the Budget amount to 5 (this represents $5).
Click Next to move to the alert configuration.

Why $5?

Azure Blob Storage static website hosting is part of the always-free tier, so this project should cost you nothing. The $5 budget exists as a safety net in case you experiment beyond the project's scope later.

Configure an alert and create the budget

A budget without an alert is just a number on a screen. The alert is what actively notifies you when spending climbs toward your limit.

Under Alert conditions, set the type to Actual costs.
Set the threshold to 80 (this means 80% of your $5 budget).
In the Alert recipients (email) field, enter your email address.
Click Create.

When would I get an alert email?

Azure evaluates your actual costs against the budget periodically. If costs hit 80% of $5 (that's $4), you will receive an email typically within about an hour of evaluation.

For this project, you likely will never get that email since static website hosting is free-tier. The point is building the habit of setting budgets on every Azure project.

Before you check the result, what do you expect to see in the Budgets pane now that you clicked Create?

You should now see AZ900-Monthly-Budget listed in the Budgets pane. The budget shows your $5 amount, the Monthly reset period, and the 80% alert threshold. Your email address appears under the alert recipients.

Budget creation failed?

Budget creation requires Owner access to the subscription. If you are using your own free Azure account, you should have this by default. If you see a permissions error, check that you are signed in with the same account you used to create the subscription.

help me fix a permissions error when creating a budget in Azure

Secret mission

Deploy a Custom 404 Error Page

What happens when someone visits a broken link on your website? Right now, they get an ugly generic error. In this secret mission, you'll deploy a custom 404 page that handles missing pages gracefully and links visitors back to your homepage.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Azure Blob Storage static website hosting is part of the always-free tier. Your storage account holds only a few KB of HTML files, which falls well within free limits. You will not be charged for this project.

Resources you used:

1 Resource Group (az900-website-rg).
1 Storage Account with static website hosting enabled (inside the resource group).
1 Budget (AZ900-Monthly-Budget, subscription-level, $5/month).

Keep everything running

No action needed. Choose this if you are still actively building or want your website to stay live.

Your website remains accessible at its public URL at no cost.
The resource lock prevents anyone from accidentally deleting your resource group.
Your budget alert stays active and emails you if costs ever approach $5.

Pause - I'll come back to this later

Static websites have no compute to pause. There is no running process or virtual machine behind your site.

Your storage account holds only a few KB of HTML, so storage costs are effectively zero.
Leave everything as-is and come back whenever you are ready. There is nothing to shut down.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow these steps in order.

Remove the resource lock first. Navigate to your az900-website-rg resource group. In the left menu under Settings, click Locks. Select the PreventDeletion lock, then click Delete.
Delete the resource group. Go to the resource group Overview page. Click Delete resource group in the top toolbar. Type az900-website-rg to confirm, then click Delete. This removes the storage account and all uploaded files.
Delete the budget. In the portal search bar, type Subscriptions and select your subscription. In the left menu under Cost Management, click Budgets. Select AZ900-Monthly-Budget, then click Delete.

That's a Wrap!

Nice work! You just deployed a live website on Azure, organized it with tags, protected it with resource locks, and set up cost monitoring with a budget alert.

Here's what you learned:

Deployed a live website on Azure Blob Storage with a public URL anyone can visit.
Organized Azure resources using resource groups and tags, and discovered that tags do not inherit from parent to child.
Protected resources from accidental deletion using resource locks and saw lock inheritance in action across an entire resource group.
Configured cost monitoring with a monthly budget and an email alert at 80% threshold.
Secret Mission: Deployed a custom 404 error page with graceful error handling for broken links.

Ready to quiz yourself?