The four doors
| Door | What it looks like | When you use it |
|---|---|---|
| Azure portal | portal.azure.com in a browser. Menus, blades, forms. | Daily admin, learning, one-off changes. The exam shows screenshots of it. |
| Azure PowerShell | Commands like New-AzVM in a PowerShell window after Connect-AzAccount | Windows admins, scripts |
| Azure CLI | Commands like az vm create after az login | Linux/Mac admins, scripts, pipelines |
| Templates (ARM JSON or Bicep) | A text file describing the resources; you hand the file to Azure | Repeatable environments, change control |
Cloud Shell is a terminal inside the portal (the >_ icon at the top) that already has both PowerShell and CLI installed, so you need nothing on your PC. It asks for a small storage account the first time to keep your files.
Managing a server once it exists
There are two different things you might mean by "managing a server", and they use two different roads.
- Managing the box: turn it on or off, make it bigger, add a disk, delete it. This is done through the portal (or a command), because Azure owns the box. You never need to log in to Windows for this.
- Working inside the box: install software, edit a config file, look at Event Viewer. For this you must open a session on the operating system itself, as if you were sitting at its keyboard.
Words you need for the second road:
| Word | Plain meaning |
|---|---|
| RDP | Remote Desktop. The Windows way to see a server's screen from your PC. The app is already on every Windows machine. |
| SSH | The Linux equivalent: a text terminal instead of a screen. |
| Port | A numbered door on a server. Each service listens on its own door: RDP on 3389, SSH on 22, websites on 443. A firewall opens or closes doors. |
| Private IP | The server's address inside your Azure network (10.0.1.4). Reachable only from inside that network. |
| Public IP | An address on the internet (20.5.5.5) that Azure can attach to a server so the whole world can reach it. Convenient, and dangerous for a management door. |
| NSG | Network security group: a list of allow/deny rules, like a firewall, attached to the server's network card or its subnet. Covered properly in the networking module. |
Exposed to the whole internet
- RDP door 3389 is visible to everyone
- Password-guessing bots find it within hours or days
- Higher risk of unauthorised access
- Needs constant patching and extra firewall rules
More secure (recommended)
- VM has no public IP address
- Only people who can sign in to the portal (with MFA) can reach it
- RDP traffic never leaves Azure's network
- No exposure to the public internet
- Much lower risk of automated attacks
Giving the server its own public IP is easier but risky, because it exposes the server to the whole internet. Azure Bastion keeps the VM private: you reach it only through the portal with your account and MFA. The exam treats Bastion as the correct answer whenever both are offered.
Path A is how most people would do it on day one: give the VM a public IP and open port 3389 in the NSG. It works, and within hours automated bots across the internet find the open door and start guessing passwords. Every exam question that mentions "without a public IP", "without opening management ports" or "reduce the attack surface" is steering you away from this.
Path B is Azure Bastion. Think of it as a guarded reception desk that Microsoft runs inside your network. You never connect to the server directly. You sign in to the portal (which already demands your password and MFA), open the VM's page, click Connect › Bastion, type the server's own username and password, and the server's desktop appears in a browser tab. The traffic between you and Azure is ordinary HTTPS on port 443, the same as any website. The server keeps only its private address, so nothing on the internet can even see it.
You, the admin: open a desktop on VM-Web1 the safe way
- One-off setup per network: deploy Bastion into the VM's virtual network (about 10 minutes; details in the networking module). Do not give VM-Web1 a public IP.
- Virtual machines › VM-Web1 › Connect › Bastion.
- Enter the local administrator username and password you set when you built the VM (or an SSH key for Linux). Click Connect.
- A new browser tab shows the Windows desktop. Work as normal; close the tab when done.
How the portal is organised
- Home shows recent resources and a search bar at the top. Searching is faster than menus: type "storage accounts" and go.
- Every resource opens as a blade with a left menu: Overview, Activity log, Access control (IAM), Tags, then the resource's own settings, then Monitoring, then Automation (where "Export template" lives).
- Creating anything is a wizard with tabs: Basics → the resource's own tabs → Tags → Review + create. The Review tab validates and shows the equivalent template under "Download a template for automation".
You, the admin, on day one
- Sign in at portal.azure.com with your work account. Entra ID checks password and MFA.
- Top-right shows your directory (tenant); switch it if your company has more than one.
- Open Subscriptions to see which subscriptions you can reach. If the list is empty you have no Azure role yet, even if you are a Global Administrator in Entra ID.
- Open Cloud Shell (
>_), runaz account showto confirm which subscription commands will target.