Host a web app on a platform you never patch

short · 25 min · Skills measured 1.3

Before you start — what this lab needs, and what it can cost

This lab runs in your own Azure subscription: an Azure free account or a pay-as-you-go subscription, so every command acts on something real and billed to you. Charges are possible, so do the clean-up the same day; the Azure pricing calculator gives current rates for anything you are unsure of. Work in Azure Cloud Shell (Bash), opened from the Cloud Shell button in the Azure portal's top bar: it already has the Azure CLI and your sign-in, so nothing is installed and no credentials are handled. The first time it starts, choose No storage account required, so Cloud Shell itself creates nothing billable. Work with the least privilege the lab allows: the Contributor role on the subscription is enough for every step, and you never need Global Administrator. On a brand-new account the first user is the subscription's Owner and the directory's Global Administrator, so if that is the only identity you have, use it carefully and only for the steps written here. This lab relies on the budget alert you set in lesson 1's lab, az900-monthly-budget, which emails you as this subscription's costs build up. A budget only warns: it never stops or deletes anything, so the clean-up is still yours to do. Every command uses the region eastus. You may choose one nearer to you, but then use it in every command of the lab, and expect your region wherever a step shows eastus. Some names must be unique across all of Azure, so they end in NNNNN: replace NNNNN with five random digits you choose, and use the same five digits everywhere in the lab.

This lab ends with a clean-up. Do it the same day: anything left running in your subscription is billed to you.

Task

Create a web app on Azure App Service, a platform service (PaaS), on the F1 Free tier, and reach it over HTTPS, all without choosing an operating system, a server or a patch level. Contrast that with infrastructure as a service (IaaS) by reading the list of operating system images a virtual machine would make you pick and keep patched, and with software as a service (SaaS) by reading the identity you sign in with, which stays yours in every service type. Finish by placing six workloads into IaaS, PaaS or SaaS. The clean-up is one delete.

Steps

Open Cloud Shell (Bash) and create the lab's resource group:

az group create --name az900-lab04-rg --location eastus

Create an App Service plan on the F1 Free tier. The plan is the platform's capacity; F1 is small, shared and cannot scale out, but it is real PaaS:

az appservice plan create --name az900-lab04-plan --resource-group az900-lab04-rg --location eastus --sku F1

If Azure says you have reached the limit of free plans, look for an F1 plan left over from an earlier attempt with az appservice plan list --query '[].{name:name, rg:resourceGroup, sku:sku.name}' -o table. 3. Create the web app on that plan, and make it answer over HTTPS only:

az webapp create --name az900web04NNNNN --resource-group az900-lab04-rg --plan az900-lab04-plan
az webapp update --name az900web04NNNNN --resource-group az900-lab04-rg --https-only true

If the name is taken, choose other digits. You were never asked for an operating system version, a server size or a patch schedule: Microsoft runs and patches the servers, the operating system and the runtime underneath, and your job would be the code and the data. 4. Reach the app. Its address comes from the platform, so read it and request it:

curl -s -o /dev/null -w '%{http_code}' https://$(az webapp show --name az900web04NNNNN --resource-group az900-lab04-rg --query defaultHostName -o tsv)

It prints 200. Open the same address in your browser: App Service's placeholder page says the app is up and waiting for content. The page is empty of anything of yours, and this lab deploys no code. 5. Contrast it with IaaS, without building anything. List the operating system images a virtual machine starts from:

az vm image list -o table

The CLI prints a short built-in list of common Linux and Windows Server images, with a note that it is an offline list. With IaaS you choose one of these, and from then on installing its security updates, its middleware and its applications is your job for as long as the VM lives. That is more control, and more work. This step creates nothing. 6. Contrast it with SaaS. Read the identity you are signed in as:

az ad signed-in-user show --query userPrincipalName -o tsv

It prints your sign-in name. Microsoft Entra ID holds that account, and it is the same identity service that Microsoft 365 users sign in with. In SaaS the provider runs the whole application, but which people can sign in, and the data they put in it, stay the customer's in every service type. 7. Place each workload in IaaS, PaaS or SaaS. (a) Moving forty servers before a datacenter lease ends in three months, redesigning later. (b) A custom web API that developers update several times a day, with a small operations team. (c) Staff email and calendars, starting next month, with no developers. (d) A legacy application that needs a custom kernel module. (e) A relational database without managing the server's operating system, patching or backups. (f) SQL Server installed by the company on a server it controls. Check your answers in the Notes.

Verify

Confirm the plan is the Free tier and the app is running over HTTPS only:

az appservice plan show --name az900-lab04-plan --resource-group az900-lab04-rg --query sku.name -o tsv

Expected output: F1.

az webapp show --name az900web04NNNNN --resource-group az900-lab04-rg --query state -o tsv

Expected output: Running.

az webapp show --name az900web04NNNNN --resource-group az900-lab04-rg --query httpsOnly -o tsv

Expected output: true.

Cost and clean-up

Charges are possible in any subscription, but the F1 Free tier is not billed for the plan itself. The other steps only read. Delete the resource group the same day all the same, so nothing is left waiting to be changed to a paid tier.

Created by this lab: the resource group az900-lab04-rg; the App Service plan az900-lab04-plan on the F1 Free tier; the web app az900web04NNNNN on that plan.

Delete the resource group, which deletes the web app az900web04NNNNN and the plan az900-lab04-plan with it:

az group delete --name az900-lab04-rg --yes

Check it is gone

az group exists --name az900-lab04-rg

Expected output: false.

Notes

Step 7 answers. (a) IaaS: lift-and-shift onto Azure Virtual Machines, with little change. (b) PaaS: Azure App Service, where developers own the code and Azure runs the platform. (c) SaaS: Microsoft 365. (d) IaaS: PaaS hides the operating system, so a kernel module or administrator rights on the host point to a VM. (e) PaaS: Azure SQL Database. (f) IaaS: the company runs the VM and everything on it. Being hosted by Azure is never the clue, because Azure hosts every type.

Three things are the same in every service type: the provider looks after the physical datacenters, network and hosts, and the customer looks after its data, its devices, and its accounts and identities. Service types are chosen per workload, so one organisation often runs all three at once.

Lesson 4's capstone builds the IaaS side for real, with one small virtual machine, next to a web app like this one.

This is an independent study companion for the Microsoft Azure Fundamentals (AZ-900) exam and is not produced by or endorsed by Microsoft. Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies.

This is an independent study companion for Microsoft Azure Fundamentals AZ-900 and is not produced by or endorsed by CompTIA.