Forem: Faith Aneke Adaora

🧹 Part 6: Resource Cleanup & Cost Control -Decommissioning Azure Infrastructure

Faith Aneke Adaora — Fri, 10 Apr 2026 19:18:54 +0000

Overview: 🧹 Clean Up (Avoid Unexpected Azure Costs)

Every good cloud engineer knows this:
If you don’t clean up, you keep paying and Azure resources continue running and billing until they are deleted.
So the final step in this guided project was to properly remove everything i have created.

This ensures:
•No unexpected charges
•No orphaned resources
•A clean environment

Procedure

🔓 Step 1: Remove Delete Locks

Earlier in the project,i protected the VM with a Delete lock.
Hence, before deleting anything that lock must be removed.
Here’s what i did:

✔ Removing the VM Lock

1.Navigated to Virtual Machines
2.Selected guided-project-vm
3.Opened Settings → Locks
4.Deleted the VM-delete-lock
5.Confirmed removal

Once the lock was removed,the VM became eligible for deletion.

✔ Removing the Resource Group Lock (If Applied)

I also applied a lock at the Resource Group level, i :
1.Navigated to Resource Groups
2.Selected the project resource group

3.Opened Settings → Locks
4.Deleted the Resource Group delete lock

5.Confirmed removal.

💡 Reminder

Always remove locks before attempting to delete resources.

🗑️ Step 2: Delete the Resource Group

One of the biggest advantages of using resource groups is that you can delete everything at once.
Where instead of deleting:
•The VM
•The VNet
•The Storage account
•The NSG
•The Subnets individually…

I simply:
1.Navigated to Resource Groups
2.Selected guided-project-rg

3.Chose Delete resource group

4.Entered the resource group name to confirm.
5.Confirmed removal

Within a few minutes, Azure removed all associated resources.
Clean. Efficient. Complete.

⚠️ Important Note: The NetworkWatcherRG Check

🔗 Azure sometimes automatically creates a resource group called ¥NetworkWatcherRG,if it already existed before the project, do NOT delete it.
🔗 If it was created during this guided project, then it should also be removed using the same deletion process.
🔗 Always verify before deleting shared system resource groups.

✅ Final Outcome’

At this point:
☑️ •All locks removed
☑️ •All project resources deleted
☑️ •No active billable services remaining
☑️ •Environment fully cleaned

This concludes the Azure Management Tasks Guided Project.

From:

✔ Environment setup
✔ Networking updates
✔ VM management
✔ Storage configuration
✔ Tags & governance
✔ Cleanup & cost control

This is a full administrative lifecycle, end to end.

🔒 Part 5 : Managing Tags & Resource Locks in Azure

Faith Aneke Adaora — Thu, 09 Apr 2026 20:24:41 +0000

🏷️ Overview

After configuring networking, scaling the VM, and managing storage,the final responsibility was governance.
This is because in real-world environments, deploying resources isn’t enough,you must:
• Organize them
• Monitor ownership
• Prevent accidental deletion

Hence, this phase focused on tags and resource locks which are two simple but powerful Azure management tools.

🎯 The Scenario

The Azure admin had two concerns:
1.Prevent accidental deletion of the VM running as an FTP server.
2.Quickly identify which department owns which resource.
This is where governance best practices come in.

🖥️ Managing Tags and Locks on the Virtual Machine

Step 1: 🏷️ Adding Tags to the VM

Tags allow you to categorize and group resources using key-value pairs.
• Where inside the guided-project-vm

•I added two tags:
Name Value
Department Customer Service
Purpose FTP Server

This makes it easy to:
•Filter resources by department
•Track cost allocation
•Identify resource purpose instantly
Tags are small but powerful for reporting and organization.

Step 2: 🔒 Adding a Resource Lock to Prevent Deletion

Next, I secured the VM.
Where inside Settings → Locks, I:
•Selected + Add

•Named the lock VM-delete-lock
•Chose Lock type: Delete
•Added a note explaining the reason

What this means

The VM can still be modified but it cannot be deleted unless the lock is removed first.
This is critical for production workloads where one accidental click won’t take down the FTP server.

Step 3: 🌐 Adding Tags to Network Resources

Governance shouldn’t stop at compute.
Next, I moved to the virtual network (guided-project-vnet)

and added:
Name Value
Department IT

Key Note💡 1:

Now both
•The VM
•The Virtual Network are clearly categorized and traceable and this improves:
•Visibility
•Cost tracking
•Operational clarity

Key Note💡 2:

Tags and Locks Matter because:
In large environments with hundreds of resources,
•Tags help with cost management and reporting.
•Locks prevent critical service disruptions.
•Governance reduces operational risk.

✅ Conclusion

Cloud administration is not just about building infrastructure.
It’s about managing it responsibly.

Therefore at this stage of the guided project, i have:
•Organized resources using tags.
•Protected critical infrastructure with delete locks.
•Improved visibility across departments.
•Strengthened governance practices.

This concludes the Azure Management Tasks guided project.
🔗 From networking…
🔗 To compute…
🔗 To storage…
🔗 To governance…
🔑 A full administrative lifecycle.

🗄️ Part 4 : Managing Azure Storage - Containers, Access Tiers & Secure Access Control

Faith Aneke Adaora — Thu, 09 Apr 2026 19:34:33 +0000

Overview

With the virtual network and VM fully configured,the next responsibility shifted to storage management.

This part of the project focused on three critical things:

•Storing data efficiently

•Optimizing storage cost

•Controlling and revoking access securely

Here’s how I handled it 👇

Procedure 1: 📦 Creating a Storage Container & Uploading a Blob

Inside the existing storage account (guided-project-rg), I:
•Navigated to Data storage → Containers

•Created a new container called storage-container

•Uploaded a test image file

Once uploaded, Azure automatically assigned it the Hot access tier which is ideal for frequently accessed data.
But since this was just a test file, keeping it in Hot storage wasn’t cost-efficient.

Procedure 2:❄️ Changing the Access Tier (Cost Optimization)

To optimize cost:
•I selected the uploaded blob
•Clicked Change tier

•Switched it from Hot → Cold
•Saved the configuration

This reinforced an important cloud concept (storage tiers directly impacting cost),where not all data needs premium, high-frequency access.

Procedure 3: 📁 Creating a File Share

Beyond blob storage, I also needed to configure Azure Files for shared access scenarios.Inside the same storage account:
•I navigated to File shares

•Created a new share called file-share

•Enabled backup (for this lab)

•Uploaded a file into the share

Now the environment supported both:
•Blob storage (object-based)
•File shares (SMB-style shared storage)

Which are two different storage solutions and two different use cases.

Procedure 4: 🔐 Generating a Shared Access Signature (SAS Token)

Next came secure access control, where instead of giving full account access,i generated a Shared Access Signature (SAS) for the uploaded blob.

The Configuration included are :

•Signing method: Account key
•Signing key: Key 1
•Permissions: Read only
•Protocol: HTTPS only
•Custom expiration time

Once generated, i copied the Blob SAS URL into a new browser tab and it successfully displayed the image.

That link allowed temporary limited access.
This is powerful because:
•No need to share account keys
•Access is time-bound
•Permissions are granular

Procedure 5: 🔁 Rotating Access Keys (Revoking Access)

Granting access is only half the story,revoking access is just as important.Since the SAS token was signed using Key 1,i invalidated it by:
•Navigating to Security + networking → Access keys
•Selecting Rotate key for Key 1
•Confirming the regeneration

After the key rotation, I refreshed the SAS URL tab.

☑️ Result

Authentication failed,access successfully revoked and this demonstrated a critical Azure security concept.
Rotating storage account keys immediately invalidates all SAS tokens generated with that key.

📊 Final Outcome

By the end of this exercise, i had:
•Created and configured blob storage
•Optimized cost using access tiers
•Deployed Azure File Shares
•Generated secure, time-limited access
•Revoked access by rotating keys

🔑 Conclusion

This part of the guided project strengthened my understanding of:
•Storage architecture
•Access governance
•Cost management
•Real-world administrative control
Where cloud storage isn’t just about uploading files.It’s about managing lifecycle, security, and access responsibly.

🖥️ Part 3: Managing the Virtual Machine - Migration, Scaling & Cost Optimization

Faith Aneke Adaora — Thu, 09 Apr 2026 13:54:13 +0000

Overview

As the environment continued to evolve, networking was only one piece of the puzzle.

With the new ftpSubnet created and secured in Part 2, the next step was ensuring the virtual machine could properly support its workload.

This phase moved beyond networking and focused on VM management ,i.e aligning subnet placement, compute power,storage and cost optimization to ensure performance, security, and efficiency.

Here’s how I handled it 👇

🔄 Step 1: Migrating the VM to the New Subnet

Since the new subnet had stricter network rules (allowing only SSH – Port 22), the VM had to be placed inside it.

I navigated to:
•Virtual Machines
•Selected guided-project-vm

•Stopped the VM (Azure requires deallocation for subnet changes)

•Waited until it showed Stopped (deallocated)

Then:
•Opened Networking
•Selected the Network Interface / IP configuration

•Changed the subnet to ftpSubnet
•Clicked Apply

📝 Note

The VM was now operating inside the secured subnet environment
✅ Network segmentation
✅ Security alignment

📈 Step 2: Vertically Scaling the VM

With the VM transitioning into an FTP server role, it needed more processing power.

From the VM blade:
•I selected Size under Availability + Scale
•Chose a higher SKU (e.g., D2s_v5)
•Clicked Resize

📝 Note

✅ Vertical scaling allows us to increase CPU and memory without redeploying the VM.
✅ Now the machine could handle more concurrent connections and file transfers.
✅ Performance upgraded 🚀

💾 Step 3: Attaching a New Data Disk

An FTP server without sufficient storage is a problem waiting to happen.
So I attached a new managed disk:
•Opened Disks
•Selected Create and attach a new disk

•Named it ftp-data-disk
•Set size to 20 GB
•Applied changes

📝 Note

✅ The VM now had dedicated storage for uploads and file transfers.

⏱️ Step 4: Configuring Automatic Shutdown (Cost Control)

Running a VM 24/7 can quietly increase cloud costs.
Since the admin only needed the FTP server during working hours, I configured automatic shutdown:
•Navigated to Auto-shutdown
•Set scheduled shutdown to 7:15 PM (UTC)
•Saved configuration

📝 Note

✅ Now,the VM automatically powers down daily thereby reducing unnecessary compute charges.
✅ Cost optimization is also in action 💡

📊 Final Outcome

By the end of this task, I had:
✅•Migrated the VM to a secured subnet
✅•Increased its compute capacity
✅•Expanded its storage
✅•Implemented automated cost control

This exercise reinforced something important:
Azure management isn’t just about deploying resources,it’s about maintaining,optimizing, and securing them over time.

That’s what real cloud administration looks like.

🛡️ Part 2: Managing the Virtual Network -Segmentation and Traffic Control

Faith Aneke Adaora — Thu, 09 Apr 2026 12:35:07 +0000

📝 Overview

After deploying the environment in Part 1, the next phase focused on managing and governing Azure resources.

Cloud engineering doesn’t stop at deployment,proper administration ensures security, efficiency, and operational stability.

In this multi-part series (Part 2 – Part 6), I’ll be covering:

•Updating the Virtual Network

•Managing Virtual Machines

•Controlling Storage Access

•Managing Tags and Resource Locks

In this article (Part 2), I’ll focus specifically on Updating the Virtual Network, with an emphasis on improving network segmentation for tighter security control.

🌐 Updating the Virtual Network: Securing SFTP Traffic with a Dedicated Subnet

When managing cloud environments, security and structure go hand in hand.
As part of my Azure Management Tasks guided project, I needed to improve the network design by creating a dedicated subnet specifically for SFTP traffic.

Instead of allowing traffic to mix within the main subnet,I segmented the network and applied tighter security controls using a Network Security Group (NSG).

Here’s how I did it 👇

🎯 The Goal

•Create a new subnet inside an existing Virtual Network

•Restrict traffic using a Network Security Group

•Allow only secure SFTP (SSH – Port 22) traffic

•Associate the NSG with the subnet

This ensures better isolation, tighter access control, and improved security posture.

🛠️ Step 1: Creating a Dedicated Subnet

I logged into the Azure Portal and navigated to Virtual Networks.

Inside my existing VNet (guided-project-vnet), I:
•Opened Subnets
•Clicked + Subnet

•Named it ftpSubnet
•Left the remaining settings as default
•Selected Add

Just like that, the new subnet was created.
This subnet will only handle SFTP traffic, separating it from other workloads in the environment.

🔐 Step 2: Creating a Network Security Group

Next, I needed to control what traffic could reach this subnet.

From the Azure portal:
•I searched for Network Security Groups from the virtual network section
•Clicked + Create

•Selected my resource group (guided-project-rg)
•Named the NSG ftpNSG

•Reviewed and deployed it

Once deployment was complete, I opened the resource to configure inbound rules.

🚦 Step 3: Allowing Secure SFTP Traffic

Inside the NSG:
•I navigated to Inbound security rules
•Clicked + Add

•Changed the destination port from 8080 to 22
•Selected TCP
•Named the rule ftpInbound
•Clicked Add

Now, only SSH/SFTP traffic on Port 22 is allowed inbound.
No unnecessary open ports. No over-permissive rules.

🔗 Step 4: Associating the NSG with the Subnet

Finally, I needed to enforce the rule.
I went back to:
•Virtual Network

•Selected guided-project-vnet
•Opened Subnets
•Selected ftpSubnet

•Attached ftpNSG under the Security section
•Saved the configuration

Now the subnet is officially protected.

📊 The Outcome

By the end of this task:

•A new subnet was created for SFTP traffic

•A Network Security Group was deployed

•Port 22 was securely configured

•The NSG was successfully associated with the subnet

⚙️ Conclusion

The environment is now more segmented, controlled, and secure.
This is the kind of practical Azure management task that strengthens real-world cloud engineering skills not just theory, but actual infrastructure design decisions.

🏗️ Part 1: Azure Project Setup - Resource Group, VNet, VM & Storage

Faith Aneke Adaora — Thu, 09 Apr 2026 06:45:52 +0000

📝OVERVIEW

In Azure,management tasks are the set of ongoing operational activities required to govern, secure, and maintain cloud resources after they have been deployed.

Before performing management tasks in Azure, it’s important to first build a structured cloud environment. In this part, I provisioned the foundational resources required for the project:
•Resource Group
•Virtual Network (VNet)
•Virtual Machine (VM)
•Storage Account

This setup ensures proper organization, secure networking, scalable compute, and reliable storage before moving into advanced management operations.

🔹 PROCEDURE

1️⃣ Create a Resource Group

Purpose:

This organize project resources for easy management and cleanup.

Steps:

1.In the Azure portal search bar, type Resource groups.
2.Select Resource groups under Services.

3.Select Create.

4.Enter guided-project-rg as the Resource group name or any other unique name of your choice .
5.Leave the default Region.
6.Select Review + create → Create.

7.Return to the Home page.

2️⃣ Create a Virtual Network

Purpose:

This Provide network infrastructure for the virtual machine.

Steps:

1.Search for Virtual networks in the Azure portal.

2.Select Create.

3.Confirm Subscription and Resource group (guided-project-rg).
4.Enter guided-project-vnet as the Virtual network name.
5.Select Review + create → Create.

6.Wait for deployment to complete.

7.Return to Home.

3️⃣ Create a Virtual Machine

Purpose:

This Deploys a Linux-based virtual machine for compute resources.

Steps:

1.Search for Virtual machines.

2.Select Create → Virtual machine.

3.Select guided-project-rg as the Resource group or the new Resource group of your choice .

4.Enter guided-project-vm as the VM name or any unique name of your choice .
5.Choose an Ubuntu image (e.g., Ubuntu Server 24.04 LTS - x64 Gen2).

6.Under Administrator account:
•Authentication type: Password
•Username: guided-project-admin
•Set and confirm password

7.Leave other settings as default.
8.Select Review + create → Create.
9.After deployment, return to Home.

4️⃣ Create a Storage Account

Purpose:

This Provides cloud storage for project data.

Steps:

1.Search for Storage accounts.

2.Select + Create.

3.Confirm Subscription and Resource group (guided-project-rg).
4.Enter a globally unique storage account name.
5.Select Review + create → Create.

6.Wait for deployment to complete.

7.Return to Home.

🔹 RESULTS

✔ Resource group created for organized management.
✔ Virtual network deployed with default subnet.
✔ Ubuntu virtual machine successfully provisioned.
✔ Storage account created for data storage.
✔ Environment ready for the next phase of the guided project.