{"id":401,"date":"2026-04-13T22:34:23","date_gmt":"2026-04-13T22:34:23","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/azure-windows-server-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/"},"modified":"2026-04-13T22:34:23","modified_gmt":"2026-04-13T22:34:23","slug":"azure-windows-server-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/azure-windows-server-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/","title":{"rendered":"Azure Windows Server Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Compute"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Compute<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p><strong>What this service is<\/strong><br\/>\nIn Azure, <strong>Windows Server<\/strong> is most commonly deployed as a Microsoft-provided Windows Server operating system image running on <strong>Azure Virtual Machines (VMs)<\/strong> (and related compute offerings). You use it when you want full control over a Windows OS in the cloud\u2014domain-joined servers, custom apps, legacy services, file servers, or Windows-based infrastructure components.<\/p>\n\n\n\n<p><strong>Simple explanation (one paragraph)<\/strong><br\/>\nThink of Windows Server on Azure as \u201ca Windows Server you can rent by the minute\/hour,\u201d hosted in Microsoft datacenters. You choose a VM size, pick a Windows Server image (for example Windows Server 2022 Datacenter), connect over RDP, and run your workloads\u2014while Azure provides the underlying hardware, networking, and platform services (backup, monitoring, security, automation).<\/p>\n\n\n\n<p><strong>Technical explanation (one paragraph)<\/strong><br\/>\nWindows Server is the guest operating system installed on Azure compute (primarily Azure VMs). You manage the OS and anything inside it (roles\/features, patches, apps, local firewall, AD DS membership), while Azure manages the physical hosts and offers capabilities such as managed disks, VNets, Network Security Groups, load balancing, Azure Monitor, Backup, Site Recovery, and governance through Azure Policy. Licensing can be included in the VM rate (pay-as-you-go) or brought via <strong>Azure Hybrid Benefit<\/strong>, depending on eligibility and compliance requirements.<\/p>\n\n\n\n<p><strong>What problem it solves<\/strong><br\/>\nWindows Server on Azure solves the need to run Windows-based workloads without owning and operating physical servers\u2014enabling faster provisioning, elastic scaling, improved resilience options, global reach, and tighter integration with modern cloud security, monitoring, and automation\u2014while keeping compatibility with Windows Server applications and administration tools.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Windows Server?<\/h2>\n\n\n\n<p><strong>Official purpose<\/strong><br\/>\n<strong>Windows Server<\/strong> is Microsoft\u2019s server operating system for running infrastructure and application workloads such as Active Directory Domain Services (AD DS), IIS web hosting, file and print services, remote access, and application hosting.<\/p>\n\n\n\n<p>On <strong>Azure<\/strong>, Windows Server is typically consumed as:\n&#8211; A <strong>Windows Server image<\/strong> on <strong>Azure Virtual Machines<\/strong> (IaaS)\n&#8211; Windows Server in specialized scenarios (for example, Azure Stack HCI or Arc-enabled servers), depending on your hybrid architecture<\/p>\n\n\n\n<p><strong>Core capabilities<\/strong>\n&#8211; Full Windows Server OS environment (GUI or Core depending on image\/SKU)\n&#8211; Server roles and features (IIS, File Services, AD DS, DNS, DHCP, etc.)\n&#8211; Integration with Microsoft management tooling (PowerShell, Windows Admin Center, Remote Server Administration Tools)\n&#8211; Azure integrations for monitoring, security, backup, disaster recovery, and automation<\/p>\n\n\n\n<p><strong>Major components (in an Azure deployment context)<\/strong>\n&#8211; <strong>Compute layer<\/strong>: Azure Virtual Machines (VM size\/series, availability options)\n&#8211; <strong>Storage<\/strong>: Azure Managed Disks (OS disk + data disks), optionally Azure Files\n&#8211; <strong>Networking<\/strong>: Azure Virtual Network (VNet), subnets, NSGs, load balancers, Azure Bastion\n&#8211; <strong>Identity<\/strong>: Local accounts, Active Directory (domain join), and optional Microsoft Entra ID integrations for management\n&#8211; <strong>Management &amp; ops<\/strong>: Azure Monitor, Log Analytics \/ VM Insights, Update Management (see current Azure Update Manager capabilities), Azure Automation (where applicable), Microsoft Defender for Cloud, Azure Policy<\/p>\n\n\n\n<p><strong>Service type<\/strong><br\/>\nWindows Server itself is an <strong>operating system<\/strong>, not a standalone Azure \u201cmanaged service.\u201d In Azure Compute terms, it is primarily used via <strong>IaaS<\/strong> (Azure VMs), where you are responsible for OS configuration and most in-guest operations.<\/p>\n\n\n\n<p><strong>Scope and availability<\/strong>\n&#8211; <strong>Subscription-scoped<\/strong>: You deploy Windows Server VMs into an Azure subscription and resource group.\n&#8211; <strong>Regional<\/strong>: VMs and their resources (VNet, disks) are created in specific Azure regions. Some VM sizes or features are region-dependent.\n&#8211; <strong>Zonal (optional)<\/strong>: Many VM SKUs support <strong>Availability Zones<\/strong>. You can place VMs zonally for higher availability (region\/zone support varies\u2014verify in official docs for your region).<\/p>\n\n\n\n<p><strong>How it fits into the Azure ecosystem<\/strong>\nWindows Server is a foundational building block in Azure Compute:\n&#8211; Runs enterprise Windows workloads with tight integration into Azure networking and security\n&#8211; Complements PaaS offerings (App Service, SQL Database) when you need OS-level control\n&#8211; Integrates with Azure governance, monitoring, and security tooling for operational maturity at scale<\/p>\n\n\n\n<p>If you are looking for official entry points, start here:\n&#8211; Azure Windows VM documentation: https:\/\/learn.microsoft.com\/azure\/virtual-machines\/windows\/\n&#8211; Windows Server on Azure overview (Windows Server docs): https:\/\/learn.microsoft.com\/windows-server\/administration\/windows-server-on-azure\/<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Windows Server?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster time to provision<\/strong>: Create servers in minutes instead of procurement cycles.<\/li>\n<li><strong>Reduced datacenter overhead<\/strong>: Less spend and effort on hardware lifecycle, rack\/stack, and physical facilities.<\/li>\n<li><strong>Global footprint<\/strong>: Deploy close to users using Azure regions.<\/li>\n<li><strong>Flexible licensing options<\/strong>: Pay-as-you-go licensing or <strong>Azure Hybrid Benefit<\/strong> (eligibility rules apply\u2014verify licensing requirements).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OS-level control<\/strong>: Install custom software, drivers (within Azure support constraints), Windows roles\/features.<\/li>\n<li><strong>Compatibility<\/strong>: Supports many legacy or Windows-only applications that don\u2019t fit PaaS\/container models.<\/li>\n<li><strong>Networking control<\/strong>: VNets, routing, private IPs, load balancers, and security boundaries.<\/li>\n<li><strong>Automation<\/strong>: Use PowerShell, Desired State Configuration (DSC), VM extensions, and CI\/CD patterns.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standardized deployments<\/strong>: Use images, VM Scale Sets (where applicable), and Infrastructure as Code (Bicep\/Terraform).<\/li>\n<li><strong>Observability<\/strong>: Azure Monitor, logs, metrics, alerts, and agent-based in-guest telemetry.<\/li>\n<li><strong>Backup and DR<\/strong>: Azure Backup and Azure Site Recovery provide repeatable protection patterns.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security controls<\/strong>: NSGs, Azure Firewall, disk encryption options, Defender for Cloud recommendations.<\/li>\n<li><strong>Central governance<\/strong>: Azure Policy, tagging, resource locks, RBAC.<\/li>\n<li><strong>Auditability<\/strong>: Activity logs + guest-level logs in Log Analytics \/ SIEM integrations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Scale up<\/strong>: Move to larger VM sizes for CPU\/RAM requirements.<\/li>\n<li><strong>Scale out<\/strong>: Add more VMs behind a load balancer for stateless tiers.<\/li>\n<li><strong>Performance choice<\/strong>: VM families (general purpose, memory optimized, compute optimized) and disk types.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Windows Server on Azure when you need one or more of the following:\n&#8211; OS-level access (RDP\/PowerShell remoting)\n&#8211; Windows authentication\/AD integration requirements\n&#8211; Windows Server roles (IIS, AD DS, file services)\n&#8211; \u201cLift-and-shift\u201d migrations with minimal refactoring\n&#8211; Strong control over patching windows, security tooling, and 3rd-party agents<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When they should not choose it<\/h3>\n\n\n\n<p>Avoid Windows Server VMs when:\n&#8211; The workload can be served by a <strong>managed PaaS<\/strong> (less patching and ops), such as Azure App Service, Azure SQL, or Azure Functions.\n&#8211; You need extremely rapid autoscaling for stateless workloads\u2014containers (AKS) or serverless may fit better.\n&#8211; You cannot maintain OS patching and hardening discipline (IaaS requires operational ownership).\n&#8211; Licensing constraints or compliance requirements prevent cloud deployment (validate with legal\/compliance).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Windows Server used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (core banking middleware, regulated Windows apps, AD-integrated services)<\/li>\n<li>Healthcare (Windows-based vendor applications, EMR integrations, compliance-driven environments)<\/li>\n<li>Retail and e-commerce (Windows web tiers, integration services, batch jobs)<\/li>\n<li>Manufacturing (OT\/IT connectors, Windows-based MES\/SCADA integration components)<\/li>\n<li>Government and education (identity services, Windows-based line-of-business applications)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Infrastructure\/platform teams modernizing datacenters<\/li>\n<li>Application teams hosting .NET Framework or Windows middleware<\/li>\n<li>Security teams deploying Windows-based security tooling\/collectors<\/li>\n<li>DevOps\/SRE teams standardizing compute platforms and monitoring<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IIS-hosted applications (including legacy ASP.NET \/ .NET Framework apps)<\/li>\n<li>Domain controllers, DNS, PKI components (with careful design)<\/li>\n<li>File servers and application servers<\/li>\n<li>RDS (Remote Desktop Services) components (validate licensing and architecture)<\/li>\n<li>Build agents and Windows CI workloads<\/li>\n<li>Third-party Windows-only enterprise software<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2-tier\/3-tier enterprise apps (web\/app\/db; DB may be SQL on VM or PaaS)<\/li>\n<li>Hub-and-spoke networks with shared services<\/li>\n<li>Hybrid identity with on-prem AD and Azure networking connectivity<\/li>\n<li>Disaster recovery patterns using Azure Site Recovery<\/li>\n<li>Jumpbox\/bastion patterns (prefer Azure Bastion)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: HA across zones\/regions, backups, monitoring, controlled inbound access.<\/li>\n<li><strong>Dev\/test<\/strong>: Smaller VM sizes, auto-shutdown, ephemeral environments, image-based rebuilds.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic Windows Server-on-Azure scenarios. Each includes the problem, why Windows Server fits, and an example.<\/p>\n\n\n\n<p>1) <strong>Lift-and-shift a legacy Windows web app<\/strong>\n&#8211; <strong>Problem<\/strong>: A .NET Framework\/IIS app can\u2019t easily move to App Service due to dependencies.\n&#8211; <strong>Why Windows Server fits<\/strong>: Full IIS + OS control; minimal refactoring.\n&#8211; <strong>Scenario<\/strong>: Move an on-prem IIS farm to Azure VMs behind Azure Load Balancer.<\/p>\n\n\n\n<p>2) <strong>Active Directory Domain Services (AD DS) in Azure<\/strong>\n&#8211; <strong>Problem<\/strong>: Need domain-join for servers\/apps in Azure and hybrid identity integration.\n&#8211; <strong>Why Windows Server fits<\/strong>: AD DS role, DNS, Group Policy.\n&#8211; <strong>Scenario<\/strong>: Deploy two domain controllers in separate Availability Zones for Azure workloads (design carefully; validate Microsoft guidance).<\/p>\n\n\n\n<p>3) <strong>Windows file server for applications<\/strong>\n&#8211; <strong>Problem<\/strong>: Apps require SMB shares with NTFS permissions.\n&#8211; <strong>Why Windows Server fits<\/strong>: File Server role, Windows ACLs, DFS.\n&#8211; <strong>Scenario<\/strong>: Host application shares on a Windows Server VM with Premium SSD and Azure Backup.<\/p>\n\n\n\n<p>4) <strong>Windows-based line-of-business (LOB) application server<\/strong>\n&#8211; <strong>Problem<\/strong>: Vendor app requires Windows services, registry settings, and local components.\n&#8211; <strong>Why Windows Server fits<\/strong>: OS-level configuration and compatibility.\n&#8211; <strong>Scenario<\/strong>: Run the vendor middleware on Windows Server 2022 with restricted inbound access.<\/p>\n\n\n\n<p>5) <strong>Secure jump host for admin access<\/strong>\n&#8211; <strong>Problem<\/strong>: Need controlled administrative access to private subnets.\n&#8211; <strong>Why Windows Server fits<\/strong>: Familiar admin environment; can host tooling (RSAT, scripts).\n&#8211; <strong>Scenario<\/strong>: Deploy a hardened Windows Server jumpbox and use Azure Bastion to avoid exposing RDP publicly.<\/p>\n\n\n\n<p>6) <strong>Build and release agents for Windows workloads<\/strong>\n&#8211; <strong>Problem<\/strong>: CI pipelines need Windows-specific build tools.\n&#8211; <strong>Why Windows Server fits<\/strong>: Install MSBuild, Visual Studio Build Tools, SDKs.\n&#8211; <strong>Scenario<\/strong>: Self-hosted build agents on ephemeral Windows Server VMs in a locked-down subnet.<\/p>\n\n\n\n<p>7) <strong>Remote Desktop Services (RDS) components<\/strong>\n&#8211; <strong>Problem<\/strong>: Centralized Windows app publishing for users.\n&#8211; <strong>Why Windows Server fits<\/strong>: Supports RDS roles (architecture and licensing must be validated).\n&#8211; <strong>Scenario<\/strong>: Host RDS session hosts on Azure VMs (or evaluate Azure Virtual Desktop as an alternative).<\/p>\n\n\n\n<p>8) <strong>Migration staging server<\/strong>\n&#8211; <strong>Problem<\/strong>: Need an intermediate server for data migration, ETL, or transitional connectivity.\n&#8211; <strong>Why Windows Server fits<\/strong>: Run migration tooling, scripts, and connectors.\n&#8211; <strong>Scenario<\/strong>: Temporary Windows Server VM for cutover weekend, then decommission.<\/p>\n\n\n\n<p>9) <strong>Security tooling and collectors<\/strong>\n&#8211; <strong>Problem<\/strong>: Need Windows-based collectors\/agents for SIEM, vulnerability scanning, or logging.\n&#8211; <strong>Why Windows Server fits<\/strong>: Runs Windows-only security software.\n&#8211; <strong>Scenario<\/strong>: Deploy a Windows Server VM for a scanning tool in a dedicated \u201csecurity\u201d subnet with strict NSGs.<\/p>\n\n\n\n<p>10) <strong>Application compatibility testing<\/strong>\n&#8211; <strong>Problem<\/strong>: Validate application behavior across Windows Server versions.\n&#8211; <strong>Why Windows Server fits<\/strong>: Easy to spin up images for 2019\/2022 in isolated environments.\n&#8211; <strong>Scenario<\/strong>: Create short-lived test VMs, snapshot disks, and run regression tests.<\/p>\n\n\n\n<p>11) <strong>Edge or hybrid management bridge<\/strong>\n&#8211; <strong>Problem<\/strong>: Need a management endpoint in Azure to coordinate hybrid servers.\n&#8211; <strong>Why Windows Server fits<\/strong>: Run Windows Admin Center gateway and integrate with Azure services.\n&#8211; <strong>Scenario<\/strong>: Admin team uses a Windows Server VM to manage mixed on-prem and Azure Windows fleets.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<blockquote>\n<p>Note: Many \u201cfeatures\u201d in Azure Windows Server deployments are delivered by <strong>Azure Virtual Machines<\/strong> plus Windows Server capabilities. This section focuses on what you can realistically do with Windows Server in Azure and what Azure adds around it.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">1) Marketplace Windows Server images (multiple versions\/SKUs)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets you deploy supported Windows Server versions (for example, 2019\/2022; exact images vary by region) directly from Azure.<\/li>\n<li><strong>Why it matters<\/strong>: Fast provisioning with known-good images and predictable baselines.<\/li>\n<li><strong>Practical benefit<\/strong>: Standardize builds across environments.<\/li>\n<li><strong>Caveats<\/strong>: Image availability and SKUs differ by region and compliance clouds; verify images via Azure Portal or <code>az vm image list<\/code>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Pay-as-you-go licensing or Azure Hybrid Benefit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Choose whether Windows Server licensing is included in the VM rate (PAYG) or bring eligible licenses to reduce cost.<\/li>\n<li><strong>Why it matters<\/strong>: Windows licensing can be a major cost driver.<\/li>\n<li><strong>Practical benefit<\/strong>: Optimize cost for long-running servers with existing license entitlements.<\/li>\n<li><strong>Caveats<\/strong>: Eligibility depends on licensing terms (for example Software Assurance \/ subscription); verify with Microsoft licensing guidance:<\/li>\n<li>Azure Hybrid Benefit (Windows VMs): https:\/\/learn.microsoft.com\/azure\/virtual-machines\/windows\/hybrid-use-benefit-licensing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Windows Server Datacenter: Azure Edition (where applicable)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Provides Azure-optimized Windows Server editions with cloud-centric capabilities (feature set depends on current release).<\/li>\n<li><strong>Why it matters<\/strong>: Enables features targeted for Azure environments (for example, hotpatching scenarios).<\/li>\n<li><strong>Practical benefit<\/strong>: Reduced patch-related reboots and improved operational uptime (when configured and supported).<\/li>\n<li><strong>Caveats<\/strong>: Not all features apply to all VM sizes\/regions; verify in official docs:<\/li>\n<li>Windows Server Azure Edition documentation: https:\/\/learn.microsoft.com\/windows-server\/get-started\/azure-edition<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) VM extensions for configuration and integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Adds post-deployment capabilities (agents, configuration, monitoring, security).<\/li>\n<li><strong>Why it matters<\/strong>: Automates configuration and enables deeper Azure integrations.<\/li>\n<li><strong>Practical benefit<\/strong>: Install monitoring agents, enable login extensions, run custom scripts.<\/li>\n<li><strong>Caveats<\/strong>: Extensions can fail due to networking\/DNS\/proxy issues; treat as code and monitor extension provisioning state.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Azure networking primitives (VNet, NSG, load balancing)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Places Windows Server VMs on private networks with controlled inbound\/outbound flows.<\/li>\n<li><strong>Why it matters<\/strong>: Network design is the backbone of secure deployments.<\/li>\n<li><strong>Practical benefit<\/strong>: Private-only servers, controlled RDP, multi-tier segmentation.<\/li>\n<li><strong>Caveats<\/strong>: Misconfigured NSGs\/Udr routes are common causes of \u201ccan\u2019t connect\u201d incidents.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Managed disks and storage performance choices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Provides OS\/data disks with selectable performance tiers (Standard HDD\/SSD, Premium SSD, Ultra Disk in supported regions).<\/li>\n<li><strong>Why it matters<\/strong>: Disk performance is often the bottleneck for Windows workloads (especially IO-heavy apps).<\/li>\n<li><strong>Practical benefit<\/strong>: Tune IO and latency via disk selection, caching, and stripe sets (Storage Spaces) where appropriate.<\/li>\n<li><strong>Caveats<\/strong>: Changing disk type\/size may have constraints; Ultra Disk requires specific VM series and zone\/region support\u2014verify.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Backup and disaster recovery integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Azure Backup can protect VM data; Azure Site Recovery can replicate VMs for DR.<\/li>\n<li><strong>Why it matters<\/strong>: Production workloads need recoverability.<\/li>\n<li><strong>Practical benefit<\/strong>: Policy-based backups and DR runbooks.<\/li>\n<li><strong>Caveats<\/strong>: Backup retention and storage costs can be significant; DR replication adds ongoing cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Monitoring, logging, and alerting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Azure Monitor + VM Insights (Log Analytics) can collect metrics and guest performance data.<\/li>\n<li><strong>Why it matters<\/strong>: You can\u2019t operate what you can\u2019t observe.<\/li>\n<li><strong>Practical benefit<\/strong>: CPU\/memory\/disk\/network visibility; event logs; alerting.<\/li>\n<li><strong>Caveats<\/strong>: Log ingestion and retention have costs; plan data collection carefully.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Security posture management and threat protection<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Microsoft Defender for Cloud can provide recommendations and threat protection options.<\/li>\n<li><strong>Why it matters<\/strong>: Windows servers are common targets; posture and patch hygiene are critical.<\/li>\n<li><strong>Practical benefit<\/strong>: Central security visibility across subscriptions.<\/li>\n<li><strong>Caveats<\/strong>: Some Defender plans add cost; verify plans and scope.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Availability options (zones, sets, scale patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Improves resiliency using Availability Zones or Availability Sets; scale patterns with VM Scale Sets for certain workloads.<\/li>\n<li><strong>Why it matters<\/strong>: Single VM is a single point of failure.<\/li>\n<li><strong>Practical benefit<\/strong>: Higher uptime for multi-VM architectures.<\/li>\n<li><strong>Caveats<\/strong>: Not all VM sizes support zones in all regions; application architecture must support redundancy.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>A Windows Server deployment in Azure typically includes:\n&#8211; One or more <strong>Windows Server VMs<\/strong>\n&#8211; A <strong>Virtual Network (VNet)<\/strong> with segmented subnets (web\/app\/data\/management)\n&#8211; <strong>Network Security Groups (NSGs)<\/strong> controlling traffic\n&#8211; Optional <strong>Azure Bastion<\/strong> for RDP without public exposure\n&#8211; <strong>Managed disks<\/strong> for OS\/data\n&#8211; <strong>Azure Monitor<\/strong> for metrics\/logs\n&#8211; <strong>Azure Backup<\/strong> (optional) for recoverability\n&#8211; Optional <strong>Load Balancer<\/strong> (L4) or Application Gateway (L7) depending on app tier needs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request \/ data \/ control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane<\/strong>: Azure Resource Manager (ARM) provisions VMs, NICs, disks, NSGs; actions are audited in Azure Activity Log.<\/li>\n<li><strong>Data plane<\/strong>: Application traffic flows through VNet, NSGs, and (optionally) load balancers\/firewalls to the VM NIC.<\/li>\n<li><strong>Management plane (in-guest)<\/strong>: You administer Windows via RDP, PowerShell remoting (WinRM), or management tools; you patch and configure inside the OS.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations include:\n&#8211; <strong>Azure Virtual Machines<\/strong> (hosting)\n&#8211; <strong>Azure Managed Disks<\/strong> (storage)\n&#8211; <strong>Azure Virtual Network \/ NSG<\/strong> (network + security boundaries)\n&#8211; <strong>Azure Bastion<\/strong> (secure RDP\/SSH without public IP exposure)\n&#8211; <strong>Azure Monitor \/ Log Analytics \/ VM Insights<\/strong> (observability)\n&#8211; <strong>Azure Backup<\/strong> (backup)\n&#8211; <strong>Azure Site Recovery<\/strong> (DR)\n&#8211; <strong>Microsoft Defender for Cloud<\/strong> (security posture \/ threat protection)\n&#8211; <strong>Azure Policy<\/strong> (governance)\n&#8211; <strong>Azure Key Vault<\/strong> (secret storage for automation scenarios; avoid storing secrets on VMs)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>At minimum for a typical VM:\n&#8211; Resource group\n&#8211; VNet\/subnet\n&#8211; NIC\n&#8211; Disk resources\n&#8211; Public IP (optional; avoid in production if possible)\n&#8211; NSG<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure access uses <strong>Azure RBAC<\/strong> (Microsoft Entra ID identities + role assignments).<\/li>\n<li>VM login uses <strong>local admin<\/strong> (created during provisioning) or <strong>domain credentials<\/strong> (if domain-joined).<\/li>\n<li>Optionally, you can enable <strong>Entra ID-based login<\/strong> for Windows VMs in some scenarios (verify supported OS versions and requirements in official docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VMs are placed into a subnet with a private IP.<\/li>\n<li>Inbound is controlled by NSG rules (and optionally Azure Firewall\/NVA).<\/li>\n<li>Outbound can be controlled using NSGs, UDRs, Azure Firewall, NAT Gateway, or proxies.<\/li>\n<li>For admin access, prefer <strong>Azure Bastion<\/strong> or a private management plane (VPN\/ExpressRoute + jump host).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use Azure Monitor for platform metrics and alerts (CPU\/network\/disk).<\/li>\n<li>Use Log Analytics\/VM Insights for guest-level performance counters and Windows Event Logs (plan cost).<\/li>\n<li>Govern with Azure Policy (allowed VM sizes, required tags, disk encryption policies, deny public IPs for production).<\/li>\n<li>Use Azure Activity Log for control plane auditing, plus guest logs for OS-level auditing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (single VM)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  User[Admin\/User] --&gt;|RDP\/HTTPS| Edge[Public IP or Bastion]\n  Edge --&gt; NSG[NSG Rules]\n  NSG --&gt; VM[Windows Server VM]\n  VM --&gt; Disk[Managed OS\/Data Disks]\n  VM --&gt; Mon[Azure Monitor\/Log Analytics]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (multi-tier, secure admin, HA)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  Internet((Internet)) --&gt; WAF[Application Gateway (WAF)]\n  WAF --&gt; WebLB[Load Balancer \/ App Gateway Backend]\n  WebLB --&gt; Web1[Web VM1&lt;br\/&gt;Windows Server IIS]\n  WebLB --&gt; Web2[Web VM2&lt;br\/&gt;Windows Server IIS]\n\n  subgraph VNet[Azure Virtual Network]\n    subgraph WebSubnet[Web Subnet]\n      Web1\n      Web2\n    end\n    subgraph AppSubnet[App Subnet]\n      App1[App VM1&lt;br\/&gt;Windows Server]\n      App2[App VM2&lt;br\/&gt;Windows Server]\n    end\n    subgraph DataSubnet[Data Subnet]\n      DB[(Data Store)]\n    end\n    subgraph MgmtSubnet[Management Subnet]\n      Bastion[Azure Bastion]\n    end\n  end\n\n  Web1 --&gt; App1\n  Web2 --&gt; App2\n  App1 --&gt; DB\n  App2 --&gt; DB\n\n  Admin[Admin] --&gt; Bastion --&gt; Web1\n  Admin --&gt; Bastion --&gt; App1\n\n  NSGWeb[NSG Web] -.applies.-&gt; WebSubnet\n  NSGApp[NSG App] -.applies.-&gt; AppSubnet\n  NSGMgmt[NSG Mgmt] -.applies.-&gt; MgmtSubnet\n\n  Web1 --&gt; Monitor[Azure Monitor + Logs]\n  App1 --&gt; Monitor\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/subscription\/tenant requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>Azure subscription<\/strong> with billing enabled<\/li>\n<li>Access to Microsoft Entra ID tenant associated with the subscription<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>Minimum permissions depend on your org policies. For this tutorial, you typically need:\n&#8211; <strong>Contributor<\/strong> on a resource group (or subscription) to create VM\/network resources\n&#8211; <strong>Virtual Machine Contributor<\/strong> plus <strong>Network Contributor<\/strong> can also work if scoped appropriately\n&#8211; Permission to create role assignments is <strong>not<\/strong> required for the basic lab, but is common in enterprise setups<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VM compute + Windows licensing (if pay-as-you-go)<\/li>\n<li>Managed disks and storage transactions<\/li>\n<li>Public IP and outbound data transfer (egress)<\/li>\n<li>Optional services (Log Analytics, Backup, Bastion, Defender for Cloud) may add cost<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed<\/h3>\n\n\n\n<p>Choose one approach:\n&#8211; <strong>Azure Portal<\/strong> (browser)\n&#8211; <strong>Azure CLI<\/strong> (recommended for repeatability): https:\/\/learn.microsoft.com\/cli\/azure\/install-azure-cli\n&#8211; Remote Desktop client:\n  &#8211; Windows: built-in Remote Desktop Connection\n  &#8211; macOS: Microsoft Remote Desktop (App Store)\n  &#8211; Linux: FreeRDP \/ Remmina<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Windows Server images are broadly available, but:<\/li>\n<li>VM sizes vary by region<\/li>\n<li>Availability Zones support varies by region<\/li>\n<li>Azure Edition-specific features vary\u2014<strong>verify in official docs<\/strong> for your region<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Common constraints:\n&#8211; Regional vCPU quotas (per VM family)\n&#8211; Public IP limits\n&#8211; Disk count and throughput limits per VM size\nCheck quotas: Azure Portal \u2192 Subscriptions \u2192 Usage + quotas, or via CLI where applicable.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>For the hands-on lab (basic):\n&#8211; Resource Group\n&#8211; Virtual Network + Subnet\n&#8211; Network Security Group\n&#8211; Public IP (or Azure Bastion if you choose that path)\n&#8211; Windows Server VM<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Windows Server on Azure is priced primarily through the <strong>Azure Virtual Machines<\/strong> model, because Windows Server is the guest OS running on compute. Exact rates vary by:\n&#8211; Region\n&#8211; VM size\/series\n&#8211; Windows Server edition\/image type\n&#8211; Billing model (pay-as-you-go vs reserved instances vs savings plans)\n&#8211; Licensing approach (included license vs Azure Hybrid Benefit)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing sources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure VM pricing for Windows: https:\/\/azure.microsoft.com\/pricing\/details\/virtual-machines\/windows\/<\/li>\n<li>Azure Pricing Calculator: https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you pay for)<\/h3>\n\n\n\n<p>1) <strong>Compute (VM hours)<\/strong>\n&#8211; Charged for the VM size while it\u2019s running (and in some cases while allocated).\n&#8211; Windows VMs typically include an additional license component when using pay-as-you-go images.<\/p>\n\n\n\n<p>2) <strong>Windows Server licensing<\/strong>\n&#8211; <strong>Pay-as-you-go<\/strong>: License is included in the VM rate.\n&#8211; <strong>Azure Hybrid Benefit<\/strong>: You may be able to apply eligible Windows Server licenses to reduce the Windows license portion (verify eligibility and compliance):<br\/>\n  https:\/\/learn.microsoft.com\/azure\/virtual-machines\/windows\/hybrid-use-benefit-licensing<\/p>\n\n\n\n<p>3) <strong>Storage<\/strong>\n&#8211; Managed disks (OS disk + data disks), snapshots, images\n&#8211; Disk type and size drive cost (Standard HDD\/SSD, Premium SSD, etc.)\n&#8211; Transactions and some performance characteristics may affect cost indirectly<\/p>\n\n\n\n<p>4) <strong>Networking<\/strong>\n&#8211; Public IP addresses (pricing depends on SKU and usage)\n&#8211; Outbound data transfer (egress) from Azure to the internet or across regions is typically charged\n&#8211; VPN Gateway\/ExpressRoute (if used) add significant cost<\/p>\n\n\n\n<p>5) <strong>Operations\/security add-ons (optional but common)<\/strong>\n&#8211; Azure Monitor \/ Log Analytics ingestion + retention\n&#8211; Azure Backup (protected instances + backup storage)\n&#8211; Defender for Cloud plans (if enabled)\n&#8211; Azure Bastion (hourly + data processed)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure has a free account concept, but Windows Server VM hours are generally not \u201cfree\u201d in a way that covers meaningful Windows Server usage. Always validate current offers on Azure\u2019s free account page (offers change).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (what makes Windows Server on Azure expensive)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Running VMs 24\/7 (compute dominates)<\/li>\n<li>Overprovisioned VM sizes<\/li>\n<li>Premium disks sized far larger than needed<\/li>\n<li>High log ingestion volumes (Windows Event Logs + performance counters)<\/li>\n<li>Egress-heavy workloads (downloads, media streaming, cross-region replication)<\/li>\n<li>Add-on services (Bastion, Firewall, VPN gateways) without right-sizing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden\/indirect costs to plan for<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Patching and maintenance time<\/strong> (operational cost, not billed by Azure)<\/li>\n<li><strong>Backups<\/strong> (storage and retention)<\/li>\n<li><strong>DR replication<\/strong> (ASR ongoing replication + storage)<\/li>\n<li><strong>IP address management and security operations<\/strong><\/li>\n<li><strong>Idle environments<\/strong> (dev\/test VMs left running)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (practical checklist)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size VM series (B-series for light dev\/test; D\/E-series for general\/memory needs)<\/li>\n<li>Use <strong>auto-shutdown<\/strong> for dev\/test VMs<\/li>\n<li>Use <strong>Reserved Instances<\/strong> or <strong>Savings Plans<\/strong> for predictable 24\/7 workloads (verify current options for Windows VMs)<\/li>\n<li>Use <strong>Azure Hybrid Benefit<\/strong> where eligible<\/li>\n<li>Use appropriate disk types and sizes; avoid large Premium disks by default<\/li>\n<li>Minimize log ingestion; collect what you need, tune retention<\/li>\n<li>Avoid public IPs for servers that don\u2019t need them; use Bastion\/VPN selectively (note: Bastion adds its own cost)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no exact prices)<\/h3>\n\n\n\n<p>A minimal learning lab often includes:\n&#8211; 1 small Windows Server VM (for example a B-series or small D-series)\n&#8211; 1 OS disk (Standard SSD)\n&#8211; 1 public IP\n&#8211; Minimal monitoring (platform metrics)<\/p>\n\n\n\n<p>Costs will vary heavily by region and VM size. Use the Azure Pricing Calculator and select:\n&#8211; Virtual Machines \u2192 Windows \u2192 chosen VM size and hours\n&#8211; Managed Disks \u2192 OS disk type\/size\n&#8211; Bandwidth \u2192 estimate outbound data (small for this lab)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations (no fabricated numbers)<\/h3>\n\n\n\n<p>A production deployment may include:\n&#8211; 2\u20136 Windows Server VMs across zones (compute x N)\n&#8211; Load balancer or Application Gateway (WAF)\n&#8211; Premium disks for performance\n&#8211; Log Analytics workspace with retention and alerts\n&#8211; Azure Backup (daily backups + long retention)\n&#8211; Azure Firewall + NAT Gateway (if enforcing outbound)\n&#8211; DR to a secondary region (ASR + storage + test failover)<\/p>\n\n\n\n<p>For production budgeting, use the pricing calculator and treat logging, backup, and network egress as first-class cost components\u2014not afterthoughts.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab deploys a Windows Server VM on Azure, secures RDP access, installs IIS, serves a test page, validates access, and then cleans up.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Deploy a <strong>Windows Server<\/strong> VM in Azure Compute, connect securely via RDP, install the <strong>IIS<\/strong> role, and publish a simple webpage reachable from the internet on port 80 (HTTP) for validation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create a resource group and network (VNet\/Subnet\/NSG).\n2. Create a Windows Server 2022 VM.\n3. Restrict RDP (3389) to your public IP (basic safety for a lab).\n4. Install IIS and open HTTP (80).\n5. Validate from a browser.\n6. Delete resources to avoid ongoing charges.<\/p>\n\n\n\n<blockquote>\n<p>Production note: For real systems, prefer <strong>Azure Bastion<\/strong> or private connectivity (VPN\/ExpressRoute) instead of exposing RDP. This tutorial uses restricted public RDP to keep the lab broadly accessible and low-complexity.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Prepare variables and sign in (Azure CLI)<\/h3>\n\n\n\n<p>1) Install Azure CLI (if needed): https:\/\/learn.microsoft.com\/cli\/azure\/install-azure-cli<\/p>\n\n\n\n<p>2) Sign in and select your subscription:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az login\naz account show\naz account set --subscription \"&lt;YOUR_SUBSCRIPTION_ID_OR_NAME&gt;\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: CLI is authenticated and pointing to the correct subscription.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a resource group<\/h3>\n\n\n\n<p>Choose a region close to you (example uses <code>eastus<\/code>). Use any supported region.<\/p>\n\n\n\n<pre><code class=\"language-bash\">RG=\"rg-windowsserver-lab\"\nLOCATION=\"eastus\"\n\naz group create --name \"$RG\" --location \"$LOCATION\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: Resource group is created.<\/p>\n\n\n\n<p>Verify:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group show --name \"$RG\" --query \"{name:name, location:location}\" -o table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create network components (VNet, subnet, NSG)<\/h3>\n\n\n\n<p>Create a VNet and subnet:<\/p>\n\n\n\n<pre><code class=\"language-bash\">VNET=\"vnet-windowsserver-lab\"\nSUBNET=\"subnet-default\"\n\naz network vnet create \\\n  --resource-group \"$RG\" \\\n  --name \"$VNET\" \\\n  --address-prefixes \"10.10.0.0\/16\" \\\n  --subnet-name \"$SUBNET\" \\\n  --subnet-prefixes \"10.10.1.0\/24\"\n<\/code><\/pre>\n\n\n\n<p>Create an NSG:<\/p>\n\n\n\n<pre><code class=\"language-bash\">NSG=\"nsg-windowsserver-lab\"\n\naz network nsg create \\\n  --resource-group \"$RG\" \\\n  --name \"$NSG\"\n<\/code><\/pre>\n\n\n\n<p>Associate NSG to the subnet:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network vnet subnet update \\\n  --resource-group \"$RG\" \\\n  --vnet-name \"$VNET\" \\\n  --name \"$SUBNET\" \\\n  --network-security-group \"$NSG\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: A VNet\/subnet exists and the NSG is attached to the subnet.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Windows Server VM<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">4.1 Pick an image (recommended: list to confirm)<\/h4>\n\n\n\n<p>Azure image identifiers change over time. First, list available Windows Server 2022 images in your region and pick one.<\/p>\n\n\n\n<pre><code class=\"language-bash\">az vm image list \\\n  --publisher MicrosoftWindowsServer \\\n  --offer WindowsServer \\\n  --location \"$LOCATION\" \\\n  --output table\n<\/code><\/pre>\n\n\n\n<p>Look for a Windows Server 2022 SKU (examples you might see include variants such as <code>2022-datacenter<\/code>, <code>2022-datacenter-core<\/code>, or Azure Edition SKUs). If you are unsure, verify in the Azure Portal marketplace for \u201cWindows Server 2022 Datacenter\u201d.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4.2 Create the VM<\/h4>\n\n\n\n<p>Set credentials. Password must meet Windows complexity rules (length, uppercase, lowercase, number, special char).<\/p>\n\n\n\n<pre><code class=\"language-bash\">VM=\"vm-windowsserver-lab\"\nADMIN_USER=\"azureuser\"\nADMIN_PASS='&lt;UseAComplexPasswordHere!123&gt;'\n\n# Replace the image URN below with one you confirmed in Step 4.1 if needed.\nIMAGE_URN=\"MicrosoftWindowsServer:WindowsServer:2022-datacenter:latest\"\n\naz vm create \\\n  --resource-group \"$RG\" \\\n  --name \"$VM\" \\\n  --image \"$IMAGE_URN\" \\\n  --size \"Standard_B2s\" \\\n  --admin-username \"$ADMIN_USER\" \\\n  --admin-password \"$ADMIN_PASS\" \\\n  --vnet-name \"$VNET\" \\\n  --subnet \"$SUBNET\" \\\n  --public-ip-sku \"Standard\" \\\n  --nsg \"\" \\\n  --output json\n<\/code><\/pre>\n\n\n\n<p>Notes:\n&#8211; We used <code>--nsg \"\"<\/code> because we already associated an NSG to the subnet.\n&#8211; VM size <code>Standard_B2s<\/code> is often a reasonable lab choice; availability depends on region\/quota.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>: A Windows Server VM is provisioned with a public IP.<\/p>\n\n\n\n<p>Verify:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az vm show -g \"$RG\" -n \"$VM\" --show-details --query \"{name:name, powerState:powerState, publicIps:publicIps}\" -o table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Lock down RDP (3389) to your public IP<\/h3>\n\n\n\n<p>Find your current public IP (do this from your workstation). One way:\n&#8211; Visit: https:\/\/ifconfig.me\/ (or your preferred \u201cwhat is my IP\u201d service)<\/p>\n\n\n\n<p>Set a variable:<\/p>\n\n\n\n<pre><code class=\"language-bash\">MYIP=\"&lt;YOUR_PUBLIC_IP_ADDRESS&gt;\"\n<\/code><\/pre>\n\n\n\n<p>Create an NSG rule allowing RDP only from your IP:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network nsg rule create \\\n  --resource-group \"$RG\" \\\n  --nsg-name \"$NSG\" \\\n  --name \"Allow-RDP-From-MyIP\" \\\n  --priority 1000 \\\n  --direction Inbound \\\n  --access Allow \\\n  --protocol Tcp \\\n  --source-address-prefixes \"$MYIP\/32\" \\\n  --source-port-ranges \"*\" \\\n  --destination-address-prefixes \"*\" \\\n  --destination-port-ranges 3389\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: RDP is allowed only from your IP address.<\/p>\n\n\n\n<p>Verify rule:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network nsg rule show -g \"$RG\" --nsg-name \"$NSG\" -n \"Allow-RDP-From-MyIP\" -o table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Connect to the VM via RDP<\/h3>\n\n\n\n<p>Get the VM public IP:<\/p>\n\n\n\n<pre><code class=\"language-bash\">PIP=$(az vm show -g \"$RG\" -n \"$VM\" --show-details --query publicIps -o tsv)\necho \"$PIP\"\n<\/code><\/pre>\n\n\n\n<p>On your computer:\n&#8211; Open Remote Desktop\n&#8211; Computer: <code>&lt;public-ip&gt;<\/code>\n&#8211; Username: <code>.\\azureuser<\/code> (or <code>azureuser<\/code>)\n&#8211; Password: the one you set<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>: You can log into the Windows Server desktop (or Server Core if you chose a Core image).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Install IIS (Web Server) on Windows Server<\/h3>\n\n\n\n<p>On the VM, open <strong>PowerShell<\/strong> as Administrator and run:<\/p>\n\n\n\n<pre><code class=\"language-powershell\">Install-WindowsFeature -Name Web-Server -IncludeManagementTools\n<\/code><\/pre>\n\n\n\n<p>Create a simple homepage:<\/p>\n\n\n\n<pre><code class=\"language-powershell\">Set-Content -Path \"C:\\inetpub\\wwwroot\\index.html\" -Value \"&lt;h1&gt;Windows Server on Azure - IIS is working&lt;\/h1&gt;\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: IIS role is installed and the default site serves your custom HTML.<\/p>\n\n\n\n<p>Verify locally on the VM:\n&#8211; Open a browser inside the VM and go to: <code>http:\/\/localhost<\/code>\n&#8211; You should see the message.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Allow inbound HTTP (80) via NSG and Windows Firewall<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">8.1 NSG rule for HTTP<\/h4>\n\n\n\n<p>From your workstation (Azure CLI):<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network nsg rule create \\\n  --resource-group \"$RG\" \\\n  --nsg-name \"$NSG\" \\\n  --name \"Allow-HTTP\" \\\n  --priority 1010 \\\n  --direction Inbound \\\n  --access Allow \\\n  --protocol Tcp \\\n  --source-address-prefixes \"*\" \\\n  --source-port-ranges \"*\" \\\n  --destination-address-prefixes \"*\" \\\n  --destination-port-ranges 80\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">8.2 Windows Firewall rule (usually auto-configured by IIS)<\/h4>\n\n\n\n<p>IIS installation typically configures firewall rules. If you still can\u2019t reach port 80, verify on the VM:<\/p>\n\n\n\n<pre><code class=\"language-powershell\">Get-NetFirewallRule -DisplayGroup \"World Wide Web Services (HTTP)\"\n<\/code><\/pre>\n\n\n\n<p>If needed (verify before enabling broadly), you can enable the rule group:<\/p>\n\n\n\n<pre><code class=\"language-powershell\">Enable-NetFirewallRule -DisplayGroup \"World Wide Web Services (HTTP)\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: Port 80 is reachable from the internet (for lab validation).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>1) From your workstation, open a browser to:\n&#8211; <code>http:\/\/&lt;VM_PUBLIC_IP&gt;<\/code><\/p>\n\n\n\n<p>You should see:\n&#8211; <code>Windows Server on Azure - IIS is working<\/code><\/p>\n\n\n\n<p>2) Validate on the VM:<\/p>\n\n\n\n<pre><code class=\"language-powershell\">Invoke-WebRequest -UseBasicParsing http:\/\/localhost | Select-Object -ExpandProperty StatusCode\n<\/code><\/pre>\n\n\n\n<p>Expected output:\n&#8211; <code>200<\/code><\/p>\n\n\n\n<p>3) Validate NSG effective rules (optional):\n&#8211; Azure Portal \u2192 VM \u2192 Networking \u2192 \u201cEffective security rules\u201d<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and realistic fixes:<\/p>\n\n\n\n<p>1) <strong>RDP can\u2019t connect<\/strong>\n&#8211; Confirm your IP didn\u2019t change (home ISPs can rotate). Update the NSG rule source IP.\n&#8211; Confirm VM is running:\n  <code>bash\n  az vm get-instance-view -g \"$RG\" -n \"$VM\" --query instanceView.statuses -o table<\/code>\n&#8211; Check you used the right username format (<code>.\\azureuser<\/code>).<\/p>\n\n\n\n<p>2) <strong>Password rejected during VM creation<\/strong>\n&#8211; Windows password policy requires complexity. Choose a stronger password and retry.<\/p>\n\n\n\n<p>3) <strong>IIS works on localhost but not from the internet<\/strong>\n&#8211; NSG rule missing for port 80 or wrong priority.\n&#8211; Windows Firewall rule not enabled.\n&#8211; You are using HTTPS in the browser (this lab is HTTP only).<\/p>\n\n\n\n<p>4) <strong>VM creation fails due to quota<\/strong>\n&#8211; Choose a smaller VM size or request quota increases:\n  &#8211; Azure Portal \u2192 Subscriptions \u2192 Usage + quotas<\/p>\n\n\n\n<p>5) <strong>VM size not available in region<\/strong>\n&#8211; Pick a different size or region.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, delete the entire resource group:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group delete --name \"$RG\" --yes --no-wait\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: All lab resources (VM, disks, IP, NIC, VNet, NSG) are removed.<\/p>\n\n\n\n<p>Verify deletion (may take a few minutes):<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group exists --name \"$RG\"\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>multi-VM<\/strong> designs for production services (avoid single points of failure).<\/li>\n<li>Use <strong>Availability Zones<\/strong> where supported; otherwise use Availability Sets (verify current guidance).<\/li>\n<li>Keep tiers separated with subnets: web\/app\/data\/management.<\/li>\n<li>Treat VMs as replaceable: automate builds (image + configuration) rather than manual configuration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least privilege via Azure RBAC; separate roles for network vs compute vs security operations.<\/li>\n<li>Restrict RDP:<\/li>\n<li>Prefer <strong>Azure Bastion<\/strong> or private access (VPN\/ExpressRoute).<\/li>\n<li>If public RDP is unavoidable, restrict source IPs and consider just-in-time access (capability depends on Defender for Cloud and configuration\u2014verify).<\/li>\n<li>Avoid using the built-in local admin for day-to-day operations; use domain accounts with controlled privileges.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size VMs and disks; measure before scaling up.<\/li>\n<li>Use auto-shutdown for dev\/test.<\/li>\n<li>Use Reserved Instances\/Savings Plans for steady-state production (verify applicability and current offerings).<\/li>\n<li>Apply Azure Hybrid Benefit if eligible and compliant.<\/li>\n<li>Control log ingestion and retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choose VM series aligned to workload:<\/li>\n<li>General purpose for most servers<\/li>\n<li>Memory optimized for caching\/app servers<\/li>\n<li>Storage optimized for heavy IO (verify options)<\/li>\n<li>Use Premium SSD for IO-sensitive workloads.<\/li>\n<li>Separate OS and data disks; consider disk striping only when justified and supported.<\/li>\n<li>Monitor disk queue length, latency, and throughput.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regular backups + test restores.<\/li>\n<li>Use health probes and load balancers for multi-instance services.<\/li>\n<li>Define RTO\/RPO and match to backup\/DR architecture (Backup vs ASR vs cross-region patterns).<\/li>\n<li>Patch regularly and coordinate reboots.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standardize on:<\/li>\n<li>Naming conventions<\/li>\n<li>Tagging (owner, environment, cost center, data classification)<\/li>\n<li>Base image\/hardening baseline<\/li>\n<li>Centralize monitoring and alerting.<\/li>\n<li>Use automation for common tasks (patching windows, certificate rotation, onboarding\/offboarding).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use Azure Policy to enforce:<\/li>\n<li>Required tags<\/li>\n<li>Allowed regions and VM sizes<\/li>\n<li>Deny public IPs for production (where appropriate)<\/li>\n<li>Use resource locks for critical production resource groups.<\/li>\n<li>Adopt a naming convention like:<\/li>\n<li><code>vm-&lt;app&gt;-&lt;env&gt;-&lt;region&gt;-&lt;nn&gt;<\/code><\/li>\n<li><code>nsg-&lt;subnet&gt;-&lt;env&gt;-&lt;region&gt;<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure RBAC<\/strong> controls who can create\/modify VMs and networking.<\/li>\n<li><strong>In-guest access<\/strong> is controlled by:<\/li>\n<li>Local users\/groups<\/li>\n<li>Domain accounts (if joined to AD DS)<\/li>\n<li>Security policies (GPO\/local policy)<\/li>\n<li>Protect privileged access:<\/li>\n<li>Use separate admin accounts<\/li>\n<li>Use MFA for Azure portal access<\/li>\n<li>Consider Privileged Identity Management (PIM) for role elevation (if your tenant uses it)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>At rest<\/strong>: Azure Managed Disks support encryption at rest by default (platform-managed keys). Customer-managed keys are possible in many scenarios\u2014verify current requirements and supported configurations.<\/li>\n<li><strong>In transit<\/strong>: Use TLS for application traffic; for admin access prefer Bastion\/VPN rather than exposing RDP.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not expose RDP\/WinRM to the internet in production.<\/li>\n<li>Segment with subnets and NSGs; apply \u201cdeny by default\u201d inbound.<\/li>\n<li>Consider Azure Firewall or a vetted NVA for egress control in regulated environments.<\/li>\n<li>Use Private Link for PaaS dependencies where applicable (for example, private endpoints to storage).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store secrets in scripts on the VM disk.<\/li>\n<li>Use <strong>Azure Key Vault<\/strong> for secrets\/certificates and fetch them via managed identity-aware applications where possible.<\/li>\n<li>Rotate local admin passwords; consider centralized password management solutions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Azure Activity Logs and send them to Log Analytics\/SIEM.<\/li>\n<li>Collect Windows Event Logs relevant to authentication and system changes (plan ingestion cost).<\/li>\n<li>Use Defender for Cloud recommendations as a baseline and adapt to your environment.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm:<\/li>\n<li>Data residency requirements (region selection)<\/li>\n<li>Logging retention policies<\/li>\n<li>Vulnerability management requirements<\/li>\n<li>Patch SLAs and maintenance windows<\/li>\n<li>Validate Windows Server licensing\/compliance (especially with Azure Hybrid Benefit).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving RDP open to <code>0.0.0.0\/0<\/code><\/li>\n<li>Using a single shared local admin account<\/li>\n<li>No patching process<\/li>\n<li>Overly permissive NSGs (\u201cAllow Any Any\u201d)<\/li>\n<li>No backup\/recovery testing<\/li>\n<li>Installing unnecessary roles\/features increasing attack surface<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use hardened baselines (CIS\/Microsoft security baselines where applicable).<\/li>\n<li>Prefer Server Core when GUI isn\u2019t needed (smaller attack surface; operational tradeoff).<\/li>\n<li>Use Azure Bastion for admin access, or private connectivity.<\/li>\n<li>Implement vulnerability scanning and patch management with measurable SLAs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Windows Server is not a managed PaaS<\/strong>: You must patch, harden, and operate it.<\/li>\n<li><strong>Image\/SKU differences<\/strong>: Not all Windows Server images are identical (Core vs Desktop Experience; Azure Edition vs non-Azure Edition). Verify features before standardizing.<\/li>\n<li><strong>RDP exposure risk<\/strong>: Public RDP is a common compromise vector; prefer Bastion\/private access.<\/li>\n<li><strong>Quota constraints<\/strong>: Regional vCPU quotas can block deployments unexpectedly.<\/li>\n<li><strong>VM size availability<\/strong>: Some sizes are unavailable in some regions or require quota increases.<\/li>\n<li><strong>Disk performance limits<\/strong>: VM size caps disk throughput\/IOPS; you can buy fast disks but still be capped by VM limits.<\/li>\n<li><strong>Logging cost surprises<\/strong>: High-volume Windows Event Logs\/perf counters can generate significant Log Analytics charges.<\/li>\n<li><strong>Backup retention costs<\/strong>: Long retention policies increase storage consumption and cost.<\/li>\n<li><strong>Patching reboots<\/strong>: Many Windows updates require reboots; design with redundancy and maintenance windows.<\/li>\n<li><strong>Domain controller considerations<\/strong>: Running AD DS on Azure VMs is possible, but requires careful design (time sync, availability, backup\/restore patterns). Follow official guidance\u2014do not improvise.<\/li>\n<li><strong>Legacy OS support<\/strong>: Older Windows Server versions may have support limitations and security risks. Plan upgrades and confirm Extended Security Update options in official docs.<\/li>\n<li><strong>Third-party licensing<\/strong>: Some vendor software tied to hardware IDs or USB dongles may not work well in cloud VMs.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Windows Server VMs are one option within Azure Compute. Alternatives may reduce operational load or better fit modern architectures.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Windows Server on Azure Virtual Machines<\/strong><\/td>\n<td>Full control workloads, legacy apps, Windows roles<\/td>\n<td>OS-level control, broad compatibility, flexible networking<\/td>\n<td>You manage patching\/hardening\/ops; licensing and VM management complexity<\/td>\n<td>When you need Windows roles or custom software and cannot use PaaS<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure App Service (Windows)<\/strong><\/td>\n<td>Web apps\/API apps that fit PaaS model<\/td>\n<td>Managed runtime, easy scaling, less OS management<\/td>\n<td>Less OS control; not all legacy dependencies supported<\/td>\n<td>When app can be refactored\/packaged for App Service<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Kubernetes Service (AKS) with Windows nodes<\/strong><\/td>\n<td>Containerized Windows workloads<\/td>\n<td>Orchestrated scaling, modern deployment patterns<\/td>\n<td>Complexity, Windows container constraints<\/td>\n<td>When you have (or want) a container platform and app supports it<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Virtual Desktop (AVD)<\/strong><\/td>\n<td>End-user desktops and app streaming<\/td>\n<td>Managed VDI control plane<\/td>\n<td>Different goal than server hosting; licensing considerations<\/td>\n<td>When the use case is user desktops\/app virtualization<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Stack HCI + Azure Arc<\/strong><\/td>\n<td>Hybrid\/on-prem with Azure management<\/td>\n<td>Local performance\/data residency with Azure governance<\/td>\n<td>Requires on-prem footprint and ops<\/td>\n<td>When workloads must remain on-prem but need Azure management<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS EC2 Windows<\/strong><\/td>\n<td>Windows VMs on AWS<\/td>\n<td>Similar IaaS model, wide ecosystem<\/td>\n<td>Different governance\/identity tooling; migration effort<\/td>\n<td>When org standardizes on AWS or has dependencies there<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Compute Engine Windows<\/strong><\/td>\n<td>Windows VMs on GCP<\/td>\n<td>Similar IaaS patterns<\/td>\n<td>Different integration model, fewer Microsoft-native synergies<\/td>\n<td>When org standardizes on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>On-prem VMware\/Hyper-V<\/strong><\/td>\n<td>Datacenter-hosted Windows<\/td>\n<td>Full local control, no cloud egress<\/td>\n<td>CapEx, scaling limits, facility overhead<\/td>\n<td>When latency\/data residency or existing investment demands on-prem<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Regulated 3-tier application modernization (without refactoring)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: A financial services firm has a mission-critical .NET Framework app requiring IIS, COM components, and domain integration. Refactoring to PaaS is not feasible in the short term.<\/li>\n<li><strong>Proposed architecture<\/strong>:<\/li>\n<li>Hub-and-spoke VNet<\/li>\n<li>Web tier: 2+ Windows Server IIS VMs behind Application Gateway (WAF)<\/li>\n<li>App tier: 2+ Windows Server VMs in private subnet<\/li>\n<li>Data tier: either SQL Server on Azure VMs (if required) or Azure SQL (if feasible)<\/li>\n<li>Admin access via Azure Bastion; no public RDP<\/li>\n<li>Azure Backup for VMs; Azure Site Recovery to secondary region<\/li>\n<li>Azure Monitor + Log Analytics; Defender for Cloud enabled<\/li>\n<li><strong>Why Windows Server was chosen<\/strong>:<\/li>\n<li>Required OS-level dependencies and Windows authentication<\/li>\n<li>Controlled change with minimal code modification<\/li>\n<li><strong>Expected outcomes<\/strong>:<\/li>\n<li>Faster environment provisioning, standardized builds<\/li>\n<li>Improved resilience using zones\/DR<\/li>\n<li>Central visibility and governance through Azure<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: Simple Windows-based vendor application<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: A small SaaS team needs a vendor Windows service that must run continuously and integrates with a third-party Windows-only SDK.<\/li>\n<li><strong>Proposed architecture<\/strong>:<\/li>\n<li>Single Windows Server VM initially (with strong backup strategy)<\/li>\n<li>Private VNet; inbound only through a minimal API endpoint (or a reverse proxy)<\/li>\n<li>Basic monitoring alerts and weekly patching window<\/li>\n<li>Plan to evolve to active\/standby or scale-out if usage grows<\/li>\n<li><strong>Why Windows Server was chosen<\/strong>:<\/li>\n<li>Fastest path to run required Windows components<\/li>\n<li>Minimal engineering time compared to refactoring for containers\/PaaS<\/li>\n<li><strong>Expected outcomes<\/strong>:<\/li>\n<li>Rapid go-live<\/li>\n<li>Predictable monthly costs with right-sizing<\/li>\n<li>Clear upgrade path to multi-VM HA if needed<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Windows Server an Azure service by itself?<\/strong><br\/>\nWindows Server is an operating system. In Azure Compute, it\u2019s most commonly deployed as the OS on <strong>Azure Virtual Machines<\/strong>.<\/p>\n\n\n\n<p>2) <strong>Do I need to buy Windows Server licenses separately to run Windows Server on Azure?<\/strong><br\/>\nNot necessarily. You can use <strong>pay-as-you-go<\/strong> images where licensing is included in the VM rate, or use <strong>Azure Hybrid Benefit<\/strong> if you have eligible licenses. Validate licensing requirements in official docs and with your licensing provider.<\/p>\n\n\n\n<p>3) <strong>What\u2019s the difference between Windows Server Datacenter and Azure Edition?<\/strong><br\/>\nAzure Edition is intended for Azure-optimized scenarios and may support additional cloud-focused features. Availability and feature scope depend on current releases\u2014verify in official Windows Server Azure Edition documentation.<\/p>\n\n\n\n<p>4) <strong>Should I use Server Core or Desktop Experience?<\/strong><br\/>\nServer Core reduces attack surface and overhead but can be harder for teams unfamiliar with CLI-based administration. Desktop Experience is easier for GUI-driven operations but has more components to patch.<\/p>\n\n\n\n<p>5) <strong>How do I access a Windows Server VM securely without opening RDP to the internet?<\/strong><br\/>\nPrefer <strong>Azure Bastion<\/strong> or private connectivity (VPN\/ExpressRoute) into the VNet, plus a jump host pattern if needed.<\/p>\n\n\n\n<p>6) <strong>What ports should I open for a typical IIS server?<\/strong><br\/>\nUsually 80 (HTTP) and\/or 443 (HTTPS). Avoid opening management ports publicly (3389 RDP, 5985\/5986 WinRM).<\/p>\n\n\n\n<p>7) <strong>How do I patch Windows Server VMs in Azure?<\/strong><br\/>\nYou patch inside the OS (Windows Update\/WSUS\/Configuration Manager) and can use Azure-integrated tooling depending on your environment (for example Azure Update Manager capabilities\u2014verify current docs).<\/p>\n\n\n\n<p>8) <strong>Can I join an Azure Windows Server VM to an on-prem Active Directory domain?<\/strong><br\/>\nYes, if you have network connectivity (VPN\/ExpressRoute) and DNS configured properly. Many orgs run hybrid identity.<\/p>\n\n\n\n<p>9) <strong>Can I run a domain controller on Azure?<\/strong><br\/>\nIt is possible, but requires careful adherence to Microsoft guidance (time sync, replication, backup\/restore considerations, availability). Use multiple DCs and proper design.<\/p>\n\n\n\n<p>10) <strong>How do I monitor Windows performance counters and event logs?<\/strong><br\/>\nUse <strong>Azure Monitor<\/strong> and <strong>Log Analytics \/ VM Insights<\/strong> to collect guest telemetry. Be mindful of ingestion and retention cost.<\/p>\n\n\n\n<p>11) <strong>What\u2019s the easiest way to reduce costs for dev\/test VMs?<\/strong><br\/>\nUse smaller VM sizes, enable auto-shutdown, deallocate when not in use, and avoid expensive add-ons unless needed.<\/p>\n\n\n\n<p>12) <strong>How do I back up a Windows Server VM?<\/strong><br\/>\nUse <strong>Azure Backup<\/strong> for VM-level backups, and consider in-guest backups for application-consistent requirements. Always test restores.<\/p>\n\n\n\n<p>13) <strong>What is the recommended way to handle secrets on Windows Server VMs?<\/strong><br\/>\nUse Azure Key Vault and avoid hardcoding secrets in scripts. Implement rotation and access control.<\/p>\n\n\n\n<p>14) <strong>Can I move my existing on-prem VM to Azure?<\/strong><br\/>\nYes\u2014migration approaches include Azure Migrate and other tooling. Validate app dependencies and network design.<\/p>\n\n\n\n<p>15) <strong>Do Windows Server VMs support Availability Zones?<\/strong><br\/>\nMany VM sizes support zones, but it\u2019s region- and SKU-dependent. Verify for your region and chosen VM size.<\/p>\n\n\n\n<p>16) <strong>What are common reasons a Windows VM deployment fails?<\/strong><br\/>\nQuota limits, unsupported VM sizes in the region, password policy failures, or policy restrictions (Azure Policy denies public IP, noncompliant SKUs, etc.).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Windows Server<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure Windows VM documentation: https:\/\/learn.microsoft.com\/azure\/virtual-machines\/windows\/<\/td>\n<td>Core guidance for deploying and operating Windows Server on Azure VMs<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Windows Server on Azure: https:\/\/learn.microsoft.com\/windows-server\/administration\/windows-server-on-azure\/<\/td>\n<td>Windows Server-specific Azure guidance and links to key scenarios<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Windows Server Azure Edition: https:\/\/learn.microsoft.com\/windows-server\/get-started\/azure-edition<\/td>\n<td>Understand Azure Edition capabilities and requirements<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Azure VM pricing (Windows): https:\/\/azure.microsoft.com\/pricing\/details\/virtual-machines\/windows\/<\/td>\n<td>Official pricing model and dimensions for Windows VMs<\/td>\n<\/tr>\n<tr>\n<td>Official calculator<\/td>\n<td>Azure Pricing Calculator: https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/td>\n<td>Build region-specific estimates including disks, bandwidth, monitoring, etc.<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure Hybrid Benefit for Windows VMs: https:\/\/learn.microsoft.com\/azure\/virtual-machines\/windows\/hybrid-use-benefit-licensing<\/td>\n<td>Rules and implementation guidance for bringing licenses<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure Bastion documentation: https:\/\/learn.microsoft.com\/azure\/bastion\/<\/td>\n<td>Best practice for secure RDP\/SSH without public exposure<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure Monitor overview: https:\/\/learn.microsoft.com\/azure\/azure-monitor\/<\/td>\n<td>Monitoring fundamentals, logs, metrics, alerts<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Microsoft Defender for Cloud: https:\/\/learn.microsoft.com\/azure\/defender-for-cloud\/<\/td>\n<td>Security posture management and protection options<\/td>\n<\/tr>\n<tr>\n<td>Official learning platform<\/td>\n<td>Microsoft Learn (Azure): https:\/\/learn.microsoft.com\/training\/azure\/<\/td>\n<td>Curated learning paths and labs for Azure operations<\/td>\n<\/tr>\n<tr>\n<td>Official architecture<\/td>\n<td>Azure Architecture Center: https:\/\/learn.microsoft.com\/azure\/architecture\/<\/td>\n<td>Reference architectures and best practices for production design<\/td>\n<\/tr>\n<tr>\n<td>GitHub samples (official)<\/td>\n<td>Azure Quickstart Templates: https:\/\/github.com\/Azure\/azure-quickstart-templates<\/td>\n<td>Deployable templates including Windows VM patterns (verify template currency)<\/td>\n<\/tr>\n<tr>\n<td>Community learning<\/td>\n<td>Windows Server community hub: https:\/\/learn.microsoft.com\/windows-server\/<\/td>\n<td>Broader Windows Server learning and administration guidance<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, cloud engineers, platform teams<\/td>\n<td>Azure fundamentals, DevOps practices, automation, CI\/CD around infra<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate practitioners<\/td>\n<td>DevOps, SCM, cloud basics and operational practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations and SRE-leaning teams<\/td>\n<td>Cloud ops, monitoring, reliability practices, cost awareness<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, operations engineers, platform teams<\/td>\n<td>Reliability engineering practices, observability, incident response<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops teams exploring automation<\/td>\n<td>AIOps concepts, automation-driven operations and monitoring<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training and guidance (verify specific offerings)<\/td>\n<td>Beginners to working professionals<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and coaching<\/td>\n<td>DevOps engineers, sysadmins transitioning to DevOps<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps enablement (training\/consulting mix\u2014verify scope)<\/td>\n<td>Teams needing hands-on guidance<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resources<\/td>\n<td>Ops\/DevOps teams needing practical support<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company Name<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps engineering (verify exact service catalog)<\/td>\n<td>Architecture, implementation support, automation<\/td>\n<td>Azure VM landing zones, CI\/CD setup, monitoring baselines<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps and cloud consulting\/training<\/td>\n<td>Cloud adoption, DevOps transformation, best practices<\/td>\n<td>Azure Windows Server migration planning, IaC standardization<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting services<\/td>\n<td>Delivery support, automation, operational maturity<\/td>\n<td>Windows workload migration playbooks, logging\/alerting setups<\/td>\n<td>https:\/\/devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Windows Server on Azure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure fundamentals: subscriptions, resource groups, regions<\/li>\n<li>Azure networking basics: VNets, subnets, NSGs, DNS<\/li>\n<li>Basic Windows Server administration: users\/groups, services, Event Viewer<\/li>\n<li>Security fundamentals: least privilege, MFA, patching hygiene<\/li>\n<li>PowerShell basics (highly recommended)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Infrastructure as Code:<\/li>\n<li>Bicep (Azure native) or Terraform<\/li>\n<li>Enterprise networking:<\/li>\n<li>Hub-and-spoke, private endpoints, firewalling, routing<\/li>\n<li>Observability:<\/li>\n<li>Azure Monitor, Log Analytics, alert design, SLOs<\/li>\n<li>Resilience:<\/li>\n<li>Availability Zones, multi-region DR, backup validation<\/li>\n<li>Security:<\/li>\n<li>Defender for Cloud, vulnerability management, hardening baselines, Key Vault patterns<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud engineer \/ cloud administrator<\/li>\n<li>Windows systems engineer<\/li>\n<li>DevOps engineer (Windows workloads)<\/li>\n<li>Site Reliability Engineer (SRE) in Windows-heavy environments<\/li>\n<li>Security engineer (endpoint\/server hardening and monitoring)<\/li>\n<li>Solutions architect (hybrid and migration programs)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (examples to consider)<\/h3>\n\n\n\n<p>Certification offerings change. Verify current Microsoft certifications on Microsoft Learn:\n&#8211; Microsoft Certifications overview: https:\/\/learn.microsoft.com\/credentials\/\nCommon Azure tracks include:\n&#8211; Azure Administrator\n&#8211; Azure Solutions Architect\n&#8211; Azure Security Engineer<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a hardened Windows Server IIS baseline image and deploy it with Bicep<\/li>\n<li>Implement Azure Bastion + private subnets + no public IP policy<\/li>\n<li>Create a patching runbook and measure compliance<\/li>\n<li>Configure Azure Backup and perform test restores monthly<\/li>\n<li>Build a two-VM IIS farm with a load balancer and automated configuration<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure Virtual Machines (VMs)<\/strong>: Azure\u2019s IaaS compute service to run operating systems like Windows Server.<\/li>\n<li><strong>Windows Server<\/strong>: Microsoft server OS used for roles like IIS, AD DS, file services.<\/li>\n<li><strong>VNet (Virtual Network)<\/strong>: Private network boundary in Azure.<\/li>\n<li><strong>Subnet<\/strong>: A segmented IP range within a VNet.<\/li>\n<li><strong>NSG (Network Security Group)<\/strong>: Stateful L3\/L4 firewall rules for subnets\/NICs.<\/li>\n<li><strong>Public IP<\/strong>: Internet-routable IP address assigned to Azure resources.<\/li>\n<li><strong>Azure Bastion<\/strong>: Managed service providing RDP\/SSH access without exposing public IP on the VM.<\/li>\n<li><strong>Managed Disk<\/strong>: Azure-managed block storage for VM OS and data.<\/li>\n<li><strong>Availability Zone<\/strong>: Physically separate datacenter locations within an Azure region.<\/li>\n<li><strong>Azure Hybrid Benefit<\/strong>: Licensing benefit allowing eligible Windows Server licenses to reduce VM costs.<\/li>\n<li><strong>Azure Monitor<\/strong>: Platform for metrics, logs, and alerting.<\/li>\n<li><strong>Log Analytics<\/strong>: Workspace-based logging and query platform used by Azure Monitor.<\/li>\n<li><strong>Microsoft Defender for Cloud<\/strong>: Security posture management and protection recommendations for Azure workloads.<\/li>\n<li><strong>IIS (Internet Information Services)<\/strong>: Windows web server role used to host websites and web apps.<\/li>\n<li><strong>ARM (Azure Resource Manager)<\/strong>: Azure control plane for provisioning and managing resources.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p><strong>Windows Server<\/strong> on <strong>Azure Compute<\/strong> is most commonly delivered by running Windows Server as the guest OS on <strong>Azure Virtual Machines<\/strong>. It matters because many organizations still rely on Windows-based workloads that need OS-level control, domain integration, and Windows Server roles like IIS and file services.<\/p>\n\n\n\n<p>Architecturally, it fits best when you need IaaS flexibility and can commit to strong operations: patching, hardening, monitoring, backups, and network security. Cost is driven primarily by VM size\/runtime, Windows licensing approach (pay-as-you-go vs <strong>Azure Hybrid Benefit<\/strong>), disks, logging, and network egress. Security success depends on eliminating public management exposure (prefer Bastion\/private access), enforcing least privilege, and keeping patch compliance high.<\/p>\n\n\n\n<p>Use Windows Server on Azure when compatibility and control matter; choose PaaS options when you can to reduce operational overhead. Next step: productionize the lab by adding Azure Bastion, private subnets, backup policies, monitoring alerts, and Infrastructure as Code for repeatable deployments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Compute<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40,26],"tags":[],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-azure","category-compute"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=401"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/401\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}