Skip to content

Azure

Azure is Microsoft's cloud, widely used in enterprise data and AI. This sheet focuses on the services data scientists and ML engineers reach for: Blob Storage for data, VMs for compute, Azure Machine Learning as the ML platform, Functions for serverless glue, and Azure OpenAI for managed foundation models.

Table of Contents

Installation / Setup

pip install azure-cli
az login                            # opens browser-based sign-in
az account show                     # which subscription am I in?
az account set --subscription "<name or id>"
az configure --defaults group=rg-ml location=eastus   # defaults save typing

Everything in Azure lives in a resource group — create one first:

az group create --name rg-ml --location eastus

Core Services

Service Category What it does Typical AI/data use
Blob Storage Storage Object storage (hot/cool/archive tiers) Datasets, models, artifacts
Virtual Machines Compute VMs incl. GPU sizes (NC/ND series) Training boxes, custom servers
Azure Machine Learning ML platform Notebooks, jobs, endpoints, registry Managed training & serving
Functions Serverless Event-driven code, no servers Data triggers, preprocessing glue
Azure SQL / PostgreSQL Flexible Databases Managed relational DBs App + metadata storage
Cosmos DB NoSQL Multi-model global DB Chat history, feature store
AKS Containers Managed Kubernetes Deploy model services at scale
Azure OpenAI GenAI Managed GPT/embedding models LLM APIs with enterprise controls
Entra ID (Azure AD) Identity Users, service principals, RBAC All access control
Key Vault Secrets Encrypted key/secret storage API keys, connection strings
Application Insights / Log Analytics Observability Logs, metrics, tracing Monitoring services and jobs

Common Operations

Blob Storage

# Container (like an S3 bucket) + upload/download
az storage container create --account-name mystore --name models
az storage blob upload --account-name mystore --container-name models --name model.pt --file model.pt
az storage blob download --account-name mystore --container-name models --name model.pt --file ./model.pt
az storage blob list --account-name mystore --container-name models --output table

# SAS token — time-limited access without making the blob public
az storage blob generate-sas --account-name mystore --container-name models --name model.pt --permissions r --expiry 2026-09-08T00:00:00Z

VMs (compute)

az vm create \
  --resource-group rg-ml \
  --name ml-vm \
  --image UbuntuLTS \
  --size Standard_NC6s_v3 \          # GPU series for training
  --admin-username azureuser \
  --generate-ssh-keys

az vm start --resource-group rg-ml --name ml-vm
az vm stop   --resource-group rg-ml --name ml-vm
az vm delete --resource-group rg-ml --name ml-vm --yes   # deallocated VMs still bill storage!

Azure Machine Learning

az ml workspace create --name ml-ws --resource-group rg-ml
az ml job create --file job.yaml --workspace-name ml-ws --resource-group rg-ml
az ml online-endpoint create --name my-endpoint --workspace-name ml-ws --resource-group rg-ml

Practical Examples

Example 1 — Register a model and deploy an online endpoint

# endpoint-deploy.yaml (Azure ML CLI v2)
$schema: https://azuremlschemas.azureedge.net/latest/managedOnlineEndpoint.schema.json
name: my-model-endpoint
auth_mode: key

# scoring.py + environment defined in the folder; deploy via:
# az ml online-endpoint create --file endpoint.yaml
# az ml online-deployment create --file deployment.yaml

az ml online-endpoint create --name my-model-endpoint -g rg-ml -w ml-ws
az ml online-deployment create --name blue --endpoint-name my-model-endpoint \
  --model azureml:my-model:1 --instance-type Standard_DS3_v2 --instance-count 1 -g rg-ml -w ml-ws

# Score the endpoint
az ml online-endpoint invoke --name my-model-endpoint --request-file sample.json -g rg-ml -w ml-ws

Example 2 — Blob-triggered preprocessing with Functions

# Azure Functions: blob trigger (Python)
import logging
import azure.functions as func

def main(myblob: func.InputStream):
    logging.info(f"Processing blob: {myblob.name}, size: {myblob.length} bytes")
    data = myblob.read()
    # ... clean and write to another container via Blob SDK

Example 3 — Azure OpenAI chat

from openai import AzureOpenAI

client = AzureOpenAI(
    azure_endpoint="https://my-resource.openai.azure.com/",
    api_key="YOUR_API_KEY",
    api_version="2024-06-01",
)

resp = client.chat.completions.create(
    model="gpt-4o",  # deployment name in your resource
    messages=[{"role": "user", "content": "Explain embeddings in one sentence."}],
)
print(resp.choices[0].message.content)

Common Patterns

Data lake layout (mirrors the S3 pattern)

mystore/
  raw/       # untouched source data
  curated/   # validated, deduplicated
  features/  # feature stores
  models/    # artifacts + metadata

Service principals for automation

# Create a service principal (machine identity) and scope its access
az ad sp create-for-rbac --name ml-ci-sp --role Contributor --scopes /subscriptions/<sub>/resourceGroups/rg-ml
# → use the appId + password in CI; never a human account

Key Vault for secrets

az keyvault create --name myvault --resource-group rg-ml
az keyvault secret set --vault-name myvault --name openai-key --value "YOUR_API_KEY"
# Read at runtime with the SDK; never in code or notebooks

Best Practices

  • Put everything in a resource group per project — makes cleanup (az group delete) and cost attribution trivial.
  • Use managed identities over keys — VMs, Functions, and ML jobs can authenticate to storage without storing credentials.
  • Deallocate idle VMs — a stopped VM still bills for its disks; delete or use Azure's auto-shutdown.
  • Use blob tiers — cold datasets in cool/archive tier save up to 80% on storage.
  • Keep secrets in Key Vault — connection strings and API keys belong there, injected as env vars at runtime.
  • Pin the Azure CLI/SDK in CI — version drift breaks pipelines.

Common Mistakes

Mistake Consequence Correct approach
Stopping (not deleting) VMs forever Monthly disk billing on idle machines Delete or auto-shutdown schedule
Open network security group (0.0.0.0/0 SSH) Brute-force / compromise Restrict NSG to your IP; use Azure Bastion
Blob container set to public Data exposure Private container + SAS URLs / managed identity
Keys in code or notebooks Leakage via logs and commits Key Vault + managed identity
Creating resources outside a resource group Orphaned, unbillable-to-project resources Always --resource-group

Troubleshooting

Symptom Cause Fix
AuthorizationFailed RBAC role missing on the scope Assign role: az role assignment create --assignee <principal> --role Contributor --scope <scope>
Blob AuthenticationError Wrong account key / SAS expired Regenerate key; check SAS expiry
VM can't SSH NSG blocks port 22 Add NSG rule for your IP; check az vm show -d public IP
ML job Failed Code/image error View job logs: az ml job show --name <id> --query logs
OpenAI 429 Rate limit / quota Request quota increase; add retry with backoff
Function timeout Long-running preprocessing Split work; increase timeout; move to a job

Official Documentation

Last Updated

2026-09-07 — Initial version.

Found a mistake or something outdated? Open an issue or submit a pull request — see CONTRIBUTING.md.