Mastering Infrastructure Automation with Azure DevOps

🔷 DevOps [Azure Track]

Currently available in Islamabad

---

Azure is the cloud platform of enterprise. Banks, telecoms, government agencies, healthcare systems, and large software vendors across the world have standardised on Microsoft Azure — and the demand for Azure DevOps engineers with hands-on infrastructure automation skills is growing faster than the supply. Azure's deep integration with Microsoft's broader ecosystem (.NET, Active Directory, GitHub, Visual Studio Code, and the Microsoft 365 suite) makes it the dominant cloud platform in enterprise IT outsourcing, which is exactly the market Pakistan's IT export sector serves.

The core program builds the foundation every Azure DevOps engineer needs in 4–5 weeks: Linux, containers, Azure infrastructure, CI/CD with Azure DevOps Pipelines and GitHub Actions, Infrastructure as Code with Terraform and Bicep, observability with Azure Monitor, and cost governance. Advanced specialisations — AKS, security, serverless, platform engineering, ML infrastructure, and SRE — are offered as separate add-on tracks so students can go deep on the areas most relevant to their target roles without covering everything at once.

💡 Why Azure DevOps in 2026

---

• Azure is the dominant cloud platform in enterprise IT — the majority of large Pakistani IT firms and their international enterprise clients run on Azure, making it the most commercially relevant cloud for the local outsourcing market
• Microsoft Entra ID (formerly Azure Active Directory) is the identity backbone of most enterprise organisations — Azure DevOps engineers who understand identity and access management are immediately valuable in any enterprise environment
• Azure DevOps (Pipelines, Repos, Boards, Artifacts) is deeply embedded in enterprise development workflows — knowing it is a prerequisite for many corporate DevOps roles
• GitHub Actions is now Microsoft-owned and deeply integrated with Azure — engineers who know both have a significant advantage
• Bicep is Microsoft's official IaC language for Azure — clean, concise, and the replacement for ARM templates that enterprises are actively migrating to
• Azure's AI platform (Azure OpenAI Service, Azure AI Studio, Azure Machine Learning) is the enterprise default for AI workloads — creating massive demand for engineers who can provision and operate this infrastructure
• AZ-104, AZ-400, and AZ-305 certifications are among the most widely recognised in Pakistan's IT job market — this course aligns directly with all three

📚 Core Program — 4 to 5 Weeks

(Foundation every Azure DevOps engineer needs before specialising)

---

Week 1 — Linux, Networking & Shell Automation

Every Azure Virtual Machine, every AKS node, every GitHub Actions runner, and every Azure Container App runs on Linux. This week builds the operating system and networking knowledge that everything in Azure infrastructure sits on top of.

1. Linux fundamentals for DevOps: process management, systemd services, file permissions, user and group management, and the /proc and /sys virtual filesystems
2. Shell scripting in Bash: variables, conditionals, loops, functions, error handling with set -euo pipefail, and writing production-grade automation scripts for Azure operations
3. Text processing tools: grep, awk, sed, cut, sort, uniq, jq for JSON (essential for Azure CLI output), and yq for YAML — the DevOps data transformation toolkit
4. File system and storage: inodes, mount points, LVM, disk usage analysis, and Azure Managed Disk attachment on Linux VMs
5. Networking fundamentals: TCP/IP, subnets (CIDR notation), routing tables, DNS resolution, NAT, and how packets move through an Azure Virtual Network
6. Linux networking tools: ip, ss, netstat, curl, wget, dig, nslookup, tcpdump, and nc — debugging connectivity in Azure VNet environments
7. TLS/SSL: how certificates work, the certificate chain, and inspecting certificates with openssl — essential for Azure Application Gateway and App Service SSL configuration
8. SSH: key generation, SSH config files, agent forwarding, and hardening SSH — managing Azure Linux VMs securely
9. Azure CLI (az): installing, authenticating with service principals and Managed Identity, scripting resource operations, and querying with --query and JMESPath
10. PowerShell for Azure (Az module): for Windows-centric enterprise environments — Get-AzResource, New-AzResourceGroup, and common administrative cmdlets
11. Git advanced workflows: rebasing, cherry-picking, reflog, and monorepo patterns — working with Azure Repos and GitHub
12. Python for Azure automation: scripts with the azure-mgmt Python SDK, subprocess, pathlib, and argparse for complex infrastructure automation

Week 2 — Docker & Containers in Depth

Containers are the unit of deployment across every Azure container service: ACI, ACA, AKS, and App Service. This week covers Docker from OS fundamentals to production-quality builds optimised for Azure Container Registry and Azure deployment targets.

1. Container fundamentals: Linux namespaces, cgroups, and the kernel features that make containers possible — understanding what Azure Container Instances actually runs
2. Docker architecture: Docker daemon, containerd, runc, image layers, and the OverlayFS union filesystem
3. Writing production Dockerfiles: multi-stage builds, minimal base images (distroless, alpine, scratch), non-root users, and build cache optimisation
4. Docker image security: scanning with Trivy and Microsoft Defender for Containers (defender-for-containers), removing secrets from build context, and .dockerignore
5. Docker networking: bridge, host, overlay drivers — inter-container communication and Azure VNet integration
6. Docker volumes: bind mounts vs named volumes, and mapping to Azure Files shares for persistent container storage
7. Docker Compose: multi-container local development stacks — health checks, depends_on, environment files, and profiles
8. Azure Container Registry (ACR): creating registries, pushing and pulling images, geo-replication, repository permissions, and ACR Tasks for automated builds
9. ACR vulnerability scanning: Microsoft Defender for Containers integration — continuous image assessment in ACR
10. Container image tagging strategies: semver tags, Git SHA tags, and immutable tags for production registries
11. Multi-platform builds with buildx: building ARM64 + AMD64 images for Azure's Ampere-based Dsv5 VMs
12. Docker in Azure DevOps Pipelines and GitHub Actions: layer caching strategies, parallel builds, and pushing to ACR from CI

Week 3 — Azure Core Services & Infrastructure as Code

Azure from a DevOps engineer's perspective — provisioning everything as code with Bicep and Terraform, designing proper network topology, and managing identity and access at scale.

Azure fundamentals for DevOps:

1. Azure resource model: subscriptions, resource groups, resources, management groups, and the Azure Resource Manager (ARM) hierarchy
2. Azure Virtual Network (VNet): subnets, route tables, Network Security Groups (NSGs), Application Security Groups (ASGs), VNet peering, and Private Endpoints
3. Azure Virtual Machines: VM sizes, VM Scale Sets, Azure Spot VMs, custom VM images with Azure Image Builder, and VM extensions for automation
4. Azure Load Balancer vs Application Gateway vs Front Door: Layer 4 vs Layer 7 load balancing — when each applies, WAF integration, and SSL offloading
5. Azure Storage: Blob storage (Hot/Cool/Cold/Archive tiers), Azure Files, Azure Queues, and storage account security (private endpoints, SAS tokens, Managed Identity access)
6. Azure SQL Database and Azure Database for PostgreSQL: managed databases — elastic pools, Hyperscale, geo-replication, and point-in-time restore
7. Azure Cache for Redis: tiers, clustering, geo-replication, and access key vs Entra ID authentication
8. Microsoft Entra ID (Azure AD): tenants, service principals, Managed Identities (system-assigned and user-assigned), app registrations, and RBAC role assignments
9. Azure RBAC: built-in roles, custom role definitions, role assignments at different scopes (management group, subscription, resource group, resource)
10. Azure DNS: public and private DNS zones, record sets, DNS private resolver, and split-horizon DNS patterns
11. Azure Key Vault: secrets, keys, and certificates — access policies vs RBAC, Key Vault Firewall, and Private Endpoints for secrets
12. Azure CLI and Azure Portal: navigating the portal efficiently and scripting every operation with the CLI — no console-only knowledge

Infrastructure as Code — Bicep and Terraform:

1. Bicep fundamentals: the Azure-native IaC language — resources, parameters, variables, outputs, and the relationship between Bicep and ARM templates
2. Bicep modules: reusable, versioned building blocks — VNet modules, AKS modules, and App Service modules shared across projects
3. Bicep deployment scopes: resource group, subscription, management group, and tenant deployments
4. Bicep parameter files and bicepparam: environment-specific configuration for dev, staging, and production
5. What-if deployments: previewing Bicep changes before applying — the Bicep equivalent of Terraform plan
6. Azure Deployment Stacks: the new native mechanism for managing the lifecycle of a Bicep deployment as a single unit
7. Terraform with the AzureRM provider: provisioning Azure resources with Terraform — the industry standard IaC tool for multi-cloud teams
8. Terraform state on Azure: Azure Blob Storage backend + state locking with Azure Blob lease
9. Terraform modules for Azure: reusable VNet, AKS, and App Service modules — the Terraform Azure Verified Modules library
10. Bicep vs Terraform: when to use each — the Microsoft-first argument for Bicep vs the multi-cloud portability of Terraform
11. Checkov and tfsec for Azure: static analysis of Bicep and Terraform code for Azure security misconfigurations
12. Azure Deployment environments: developer self-service environment provisioning backed by Bicep or Terraform templates

Week 4 — CI/CD with Azure DevOps Pipelines & GitHub Actions

The complete pipeline: from code commit to production deployment on Azure Container Apps and App Service, automated, secure, and repeatable. Both Azure DevOps Pipelines and GitHub Actions are covered — enterprises use both and engineers need fluency in each.

Azure DevOps Pipelines in depth:

1. Azure DevOps organisation: projects, repos, pipelines, artifacts, boards, and test plans — understanding the full platform
2. YAML pipelines: stages, jobs, steps, triggers, and the pipeline execution model
3. Pipeline agents: Microsoft-hosted agents (Ubuntu, Windows, macOS), self-hosted agents on Azure VMs, and Azure Virtual Machine Scale Set agents for cost-efficient elastic capacity
4. Service connections: connecting Azure DevOps to Azure subscriptions, ACR, GitHub, and external services — Workload Identity Federation for keyless authentication
5. Variable groups and Azure Key Vault integration: storing pipeline secrets in Key Vault and referencing them in pipelines without storing values in pipeline YAML
6. Pipeline templates: reusable stage, job, and step templates in a central repository — the enterprise pipeline library pattern
7. Environments and deployment gates: requiring manual approval, automated quality gates, and deployment history per environment
8. Artifact feeds: Azure Artifacts for npm, NuGet, Python, Maven, and Universal Packages — internal package registries
9. Pipeline security: branch policies, required reviewers for pipeline changes, and least-privilege service connection permissions

GitHub Actions for Azure:

1. GitHub Actions architecture: workflows, jobs, steps, runners, and the event model
2. Azure login with OIDC: passwordless authentication from GitHub Actions to Azure using Workload Identity Federation — no stored client secrets
3. Azure-specific GitHub Actions: azure/login, azure/arm-deploy, azure/container-apps-deploy, azure/aks-set-context, and azure/webapps-deploy
4. Reusable workflows and composite actions: building a shared GitHub Actions library for Azure deployments across multiple repositories
5. GitHub Environments with Azure: deployment protection rules, required reviewers, and environment secrets for each Azure environment
6. Self-hosted GitHub Actions runners on Azure: Azure Container Instances or Azure VM Scale Sets for private network access

Azure deployment targets:

1. Azure Container Apps: the recommended serverless container platform — environments, container apps, revisions, replicas, and traffic splitting
2. Container Apps scaling rules: HTTP scaling, CPU/memory scaling, KEDA-based custom scaling (queue depth, Service Bus, Event Hubs)
3. Azure App Service: PaaS web hosting for containers and code — deployment slots, blue/green deployments, auto-scaling, and custom domains
4. Azure Container Instances (ACI): ephemeral containers for CI/CD jobs, batch processing, and sidecar patterns
5. Complete CI/CD pipeline: code push → Trivy scan → Docker build → push to ACR → Bicep what-if → Bicep deploy → Container Apps update → health check → notify Slack
6. Rollback strategy: Container Apps revision-based rollback and App Service slot swap reversal

Week 5 — Observability, Security Basics & Cost Management

The three operational disciplines that occupy the most time for working Azure DevOps engineers: understanding what your systems are doing with Azure Monitor, keeping them secure and compliant, and controlling the Azure bill.

Observability with Azure Monitor:

1. Azure Monitor architecture: the unified observability platform — metrics, logs, traces, alerts, and dashboards in one system
2. Log Analytics workspace: the central log store — Log Analytics agents, diagnostic settings, and querying with KQL (Kusto Query Language)
3. KQL in depth: the query language for Azure Monitor Logs — where, project, summarize, extend, join, render, and time-series analysis
4. Application Insights: APM for web applications — request tracking, dependency tracking, exception logging, custom events, and the Live Metrics stream
5. Azure Monitor Metrics: platform metrics, custom metrics, and metric alerts with dynamic thresholds
6. Azure Monitor Alerts: metric alerts, log query alerts, activity log alerts, and action groups (email, SMS, webhook, Azure Function, Logic App)
7. Azure Dashboards and Workbooks: building operational dashboards — Workbooks for parameterised, interactive reports
8. Container Insights: AKS and Container Apps monitoring — CPU/memory per pod, node status, and live container logs
9. OpenTelemetry with Azure Monitor: the Azure Monitor OpenTelemetry Distro — exporting OTel traces, metrics, and logs to Application Insights
10. Distributed tracing: end-to-end trace correlation across Azure Container Apps, App Service, and Azure Functions

Azure security fundamentals:

1. Azure Key Vault in production: secrets rotation, Key Vault references in App Service and Container Apps, and audit logging with diagnostic settings
2. Managed Identity in practice: assigning user-assigned Managed Identities to Container Apps, VMs, and Azure Functions — eliminating stored credentials entirely
3. Microsoft Defender for Cloud: the unified cloud security posture management platform — Secure Score, security recommendations, and defender plans
4. Microsoft Defender for Containers: runtime threat protection for AKS and Container Apps — vulnerability assessment and runtime anomaly detection
5. Azure Policy: defining and enforcing compliance rules — built-in policy definitions, custom policies, and policy initiatives (blueprints)
6. Azure Security Center recommendations: remediating the most impactful findings — NSG configuration, JIT VM access, and encryption enforcement
7. Private Endpoints: removing public internet exposure for Azure SQL, Storage, Key Vault, ACR, and other PaaS services
8. Azure Firewall: managed network security — application rules, network rules, DNAT, and threat intelligence-based filtering
9. Shift-left security in pipelines: Trivy for containers, Checkov for Bicep/Terraform, Semgrep for SAST, and credential scanning with git-secrets and GitHub secret scanning
10. Microsoft Entra ID Conditional Access: enforcing MFA, device compliance, and location-based access policies for Azure DevOps and GitHub access

Azure Cost Management:

1. Azure Cost Management + Billing: cost analysis, cost allocation by resource group and tag, and downloading invoices
2. Tagging strategy: mandatory cost allocation tags (environment, team, project, owner) enforced via Azure Policy
3. Azure Budgets: budget alerts and automated actions — stopping or deallocating resources when thresholds are exceeded
4. Azure Advisor: cost recommendations — rightsizing VMs, deleting unused resources, and Reserved Instance opportunities
5. Azure Reserved Instances and Savings Plans: committing to compute usage for 1 or 3 years — 30–72% savings over pay-as-you-go
6. Azure Spot VMs: using spot for CI/CD agents, batch jobs, and fault-tolerant stateless workloads — eviction handling
7. Container Apps and App Service scaling to zero: eliminating idle costs for non-production environments
8. Azure Storage cost optimisation: lifecycle management policies, Blob access tier transitions, and right-sizing storage accounts
9. Private Endpoint vs Service Endpoint pricing: understanding the cost implications of different network security approaches

---

🚀 Advanced Add-On Tracks

(Each track is 2–3 weeks — additional fee per track. Can be taken in any order after completing the core program.)

---

Advanced Track 1: Kubernetes & AKS (3 weeks)

Kubernetes on Azure Kubernetes Service is the most in-demand enterprise container platform — and the most complex. Three weeks are needed to cover it properly: the Kubernetes object model, AKS-specific operations, and the GitOps delivery layer on top.

Week 1 — Kubernetes fundamentals:

1. Kubernetes architecture: control plane components (API server, etcd, scheduler, controller manager) and worker node components (kubelet, kube-proxy, container runtime)
2. Core workload objects: Pods, ReplicaSets, Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs — when each is the right choice
3. Services: ClusterIP, NodePort, LoadBalancer, and ExternalName — DNS-based service discovery with CoreDNS
4. Ingress and Ingress Controllers: NGINX Ingress Controller and the Azure Application Gateway Ingress Controller (AGIC) — TLS termination, path routing, and host-based routing
5. ConfigMaps and Secrets: injecting configuration and sensitive data into Pods — the baseline before using Azure Key Vault integration
6. Persistent Volumes: PV, PVC, StorageClass — the Azure Disk CSI driver and Azure Files CSI driver for RWO and RWX storage
7. Namespaces and RBAC: isolating teams and workloads, ClusterRoles vs Roles, ServiceAccounts, and binding Azure AD groups to Kubernetes roles
8. Resource requests and limits: LimitRanges, ResourceQuotas, and the three QoS classes
9. Health checks: liveness, readiness, and startup probes — writing probes that avoid unnecessary restarts
10. Pod scheduling: nodeSelector, node affinity/anti-affinity, pod topology spread constraints, taints and tolerations, and PodDisruptionBudgets
11. Rolling updates, rollbacks, and Deployment strategies: maxUnavailable, maxSurge, and progressive delivery

Week 2 — AKS in production:

1. AKS cluster provisioning with Terraform and Bicep: system node pools, user node pools, and Spot node pools — network plugin selection (Azure CNI vs kubenet vs Azure CNI Overlay)
2. AKS authentication: Azure AD integration — local accounts, Azure AD-backed kubectl authentication, and disabling local accounts for compliance
3. Workload Identity for AKS: the replacement for AAD Pod Identity — assigning Azure RBAC permissions to Kubernetes ServiceAccounts via federated credentials
4. AKS networking deep dive: Azure CNI pod IP assignment, NSG rules for pods, Azure Network Policy, and Calico network policy
5. AKS node pool autoscaling: the Cluster Autoscaler and KEDA — scaling nodes and pods based on workload demand
6. AKS cluster upgrades: the upgrade sequence — control plane first, then node pools — node surge upgrades and zero-downtime strategies
7. AKS add-ons and extensions: AGIC, Azure Monitor for containers, Secrets Store CSI Driver, and Open Service Mesh
8. Secrets Store CSI Driver with Azure Key Vault: mounting Key Vault secrets directly as Kubernetes volumes — no Kubernetes Secrets needed
9. KEDA (Kubernetes Event-Driven Autoscaling): scaling deployments based on Azure Service Bus queue depth, Event Hubs consumer lag, and HTTP request rate
10. AKS cost optimisation: spot node pools for batch workloads, node pool right-sizing, Start/Stop cluster schedules for non-production, and AKS Cost Analysis
11. AKS observability: Container Insights with Managed Prometheus, Azure Managed Grafana, and Log Analytics for cluster and pod logs

Week 3 — GitOps and advanced delivery on AKS:

1. Helm: packaging Kubernetes applications — writing charts, values files, release management, and the Azure-specific Helm charts in the AKS documentation
2. Kustomize: environment-specific overlays without duplicating manifests — base + overlays for dev/staging/prod on AKS
3. Flux CD on AKS: the GitOps operator built into AKS as an extension — source controller, kustomize controller, helm controller, and image automation
4. ArgoCD on AKS: the alternative GitOps operator — Applications, ApplicationSets, the App of Apps pattern, and multi-cluster deployments
5. Azure GitOps with Azure DevOps: triggering Flux/ArgoCD sync from Azure DevOps Pipelines — the enterprise GitOps pattern
6. Sealed Secrets and External Secrets Operator with Azure Key Vault: managing secrets safely in a GitOps repository
7. Progressive delivery with Argo Rollouts: canary and blue/green deployments on AKS with automated analysis based on Application Insights metrics
8. Service mesh with Istio on AKS: the AKS Istio add-on — mTLS between services, traffic management, and Kiali for mesh observability
9. OPA Gatekeeper and Azure Policy for AKS: the built-in policy enforcement for AKS — restricting privileged containers, enforcing resource limits, and requiring specific labels

Advanced Track 2: Azure Security & Compliance Engineering (2 weeks)

Enterprise Azure environments operate under regulatory frameworks — GDPR, ISO 27001, SOC 2, PCI-DSS, and industry-specific compliance requirements. This track covers the Azure security tooling, DevSecOps pipeline integration, and compliance automation that regulated environments demand.

Week 1 — Azure security services in depth:

1. Microsoft Defender for Cloud in depth: Secure Score improvement, regulatory compliance dashboard (NIST, CIS, PCI-DSS), and Defender plans for VMs, SQL, Storage, Containers, and App Service
2. Microsoft Sentinel: the cloud-native SIEM — connecting data connectors (Azure AD, Office 365, Azure Activity), creating analytics rules, and building investigation playbooks
3. Azure DDoS Protection: Standard tier — adaptive tuning, attack telemetry, and integration with Azure Monitor alerts
4. Azure Bastion: browser-based SSH and RDP to VMs without public IP addresses — eliminating jump boxes
5. Just-in-time VM access: Microsoft Defender for Cloud JIT — time-limited NSG rules for administrative access
6. Azure Private Link and Private DNS: end-to-end private connectivity to PaaS services — DNS resolution from on-premises and hub-spoke networks
7. Customer-managed keys (CMK): bringing your own keys for Azure Storage, SQL, Cosmos DB, and AKS — key rotation and emergency key revocation
8. Azure Active Directory Identity Protection: risk-based Conditional Access — sign-in risk, user risk, and automated remediation
9. Privileged Identity Management (PIM): just-in-time elevation of Azure RBAC roles — approval workflows and access reviews

Week 2 — DevSecOps pipeline and compliance automation:

1. Shift-left security in Azure DevOps Pipelines: Trivy (containers), Checkov (Bicep/Terraform), Semgrep (SAST), OWASP Dependency-Check (SCA), and Microsoft Security DevOps extension
2. Microsoft Security DevOps GitHub Action: the official Microsoft action for running Credential Scanner, Template Analyzer, and Trivy in GitHub Actions
3. Software Bill of Materials (SBOM): generating SBOMs with Syft and storing in ACR — Microsoft SBOM Tool for .NET projects
4. Container image signing with Notation (CNCF): signing ACR images with Azure Key Vault-backed certificates and verifying signatures in AKS with Ratify
5. Supply chain security: SLSA framework on Azure — provenance attestation for container builds in Azure DevOps
6. Azure Policy as code: managing Azure Policy assignments with Terraform and Bicep — the policy-as-code DevOps workflow
7. Compliance frameworks on Azure: Azure Policy regulatory compliance initiatives for ISO 27001, SOC 2, PCI-DSS, and NIST SP 800-53 — mapping controls to Azure services
8. Microsoft Purview: data governance and data loss prevention — discovering sensitive data across Azure Storage, SQL, and Synapse
9. Azure Audit Logs and Activity Logs: retention, archiving to Storage, streaming to Microsoft Sentinel, and alerting on suspicious management operations
10. Incident response on Azure: isolating compromised resources (NSG lockdown, VM deallocate, identity revocation), forensic investigation with Activity Logs and Sentinel, and runbook automation with Azure Automation

Advanced Track 3: Serverless & Event-Driven Architecture on Azure (2 weeks)

Azure's serverless and event-driven services form a complete platform for building event-driven applications, real-time data pipelines, and API backends — all without managing servers.

1. Azure Functions deep dive: the execution model, cold starts, the Flex Consumption plan, Durable Functions orchestration patterns (chaining, fan-out/fan-in, human interaction, eternal orchestration)
2. Azure Functions triggers and bindings: HTTP, Timer, Service Bus, Event Hubs, Blob Storage, Cosmos DB, Queue Storage — the binding-based development model
3. Azure Functions deployment: Zip deploy, container-based deployment, and deploying Functions as containers in Container Apps
4. Azure Functions scaling: KEDA-based scaling on Container Apps vs Consumption plan automatic scaling
5. Azure Logic Apps: low-code workflow automation — connectors, triggers, actions, and enterprise integration patterns
6. Azure API Management (APIM): the enterprise API gateway — policies (rate limiting, transformation, caching, authentication), products, subscriptions, and the developer portal
7. Azure Event Grid: event routing across Azure services and custom applications — topics, subscriptions, event filtering, and dead-letter queues
8. Azure Service Bus: enterprise messaging — queues, topics, subscriptions, sessions for ordered processing, dead-letter queues, and message deferral
9. Azure Event Hubs: high-throughput event streaming — partitions, consumer groups, capture to Blob Storage, and the Kafka-compatible endpoint
10. Azure Queue Storage: simple reliable messaging for decoupled architectures — poison message handling and message lease patterns
11. Azure Cosmos DB: globally distributed NoSQL — partition key design, consistency levels, change feed for event-driven patterns, and serverless capacity mode
12. Azure Static Web Apps: hosting SPAs and static sites with integrated Azure Functions backends — GitHub Actions and Azure DevOps integration
13. Event-driven architecture patterns: choreography vs orchestration, the outbox pattern on Azure, and saga coordination with Durable Functions
14. Serverless observability: Application Insights for Azure Functions — request/dependency/exception tracking and distributed tracing across Service Bus and Event Grid

Advanced Track 4: Platform Engineering & Advanced IaC (2 weeks)

Platform Engineering on Azure means building the internal developer platform that enterprise development teams use to self-service environments, deployments, and infrastructure — reducing dependence on the central infrastructure team for every change.

1. Platform Engineering principles for enterprise: golden paths, paved roads, the platform team's mission, and measuring developer experience with DORA and SPACE metrics
2. Azure Landing Zones: Microsoft's reference architecture for enterprise-scale Azure — management groups, policy assignments, networking hub-spoke topology, and the Enterprise-Scale CAF (Cloud Adoption Framework)
3. Azure Landing Zone Bicep accelerator: deploying the Microsoft reference landing zone with Bicep modules from the ALZ Bicep repository
4. Terraform Azure Landing Zones module: the community and Microsoft-maintained Terraform equivalent — when to choose Terraform over Bicep for landing zones
5. Azure Deployment Environments: developer self-service environment provisioning backed by Bicep or Terraform templates in Azure DevOps Catalogs
6. Backstage with Azure: the internal developer portal — Azure DevOps plugin, ACR plugin, and Azure resource entity provider for service catalogue integration
7. Azure Developer CLI (azd): the new developer-focused CLI for deploying Azure applications — azd templates, pipelines, and the developer workflow
8. Bicep advanced patterns: modules registry with Azure Container Registry, Bicep extensibility providers, and porting ARM templates to Bicep with the decompile command
9. Terraform advanced patterns for Azure: module composition with Azure Verified Modules, provider aliasing for multi-subscription deployments, and the AzureRM backend with state encryption
10. Policy as code at enterprise scale: Azure Policy exemptions, remediation tasks, compliance reports in pipelines, and the Terraform azurerm_policy_assignment resource
11. Azure Cost Management at scale: Management Group-level cost analysis, chargeback and showback with cost allocation rules, and automated cost anomaly alerts
12. FinOps on Azure: the FinOps Foundation framework applied to Azure — Inform, Optimise, and Operate phases with Azure tooling

Advanced Track 5: Azure AI & ML Infrastructure (2 weeks)

Azure is the enterprise home for AI workloads — Azure OpenAI Service, Azure AI Studio, and Azure Machine Learning are the platforms that enterprise data science and AI teams depend on. This track covers the infrastructure engineering required to provision, operate, and secure these workloads in production.

1. Azure OpenAI Service infrastructure: deploying OpenAI models (GPT-4o, embedding models) in Azure regions — model deployments, capacity planning, PTU (provisioned throughput units) vs standard
2. Azure OpenAI private networking: Private Endpoints for Azure OpenAI, network isolation, and routing enterprise traffic through Azure Firewall
3. Azure AI Studio: the unified platform for Azure AI — hubs, projects, connections, and the compute infrastructure behind model deployments
4. Azure AI Search: provisioning the enterprise vector search service — indexes, indexers, skillsets, and the semantic ranking capability
5. Azure Machine Learning workspace infrastructure: compute clusters, compute instances, datastores, environments, and the MLflow tracking integration
6. AML compute targets: CPU and GPU compute clusters — NC-series and ND-series VMs for model training, autoscaling compute, and low-priority (spot) nodes
7. AML pipelines and components: building reusable ML pipeline steps as Docker containers — the infrastructure side of MLOps
8. Azure Container Registry for ML: storing and managing model container images — ACR Tasks for automated rebuilds on base image updates
9. Model deployment infrastructure: AML Online Endpoints (real-time) and Batch Endpoints — blue/green model deployments with traffic mirroring
10. Azure Data Factory: the managed ETL service — pipelines, datasets, linked services, and integration runtimes for on-premises data movement
11. Azure Synapse Analytics infrastructure: Spark pools, SQL pools, integration runtimes, and workspace networking with Managed VNet
12. Azure Databricks infrastructure: workspace provisioning with Terraform, Unity Catalog setup, instance pools, and cluster policies for cost control
13. Data platform security: Azure Purview data governance, row-level security in Synapse, and Unity Catalog fine-grained access control
14. MLOps pipeline CI/CD: deploying AML pipelines and model endpoints from Azure DevOps Pipelines — the responsible AI dashboard integration

Advanced Track 6: SRE & Advanced Observability on Azure (2 weeks)

Site Reliability Engineering principles applied to Azure infrastructure — defining SLOs backed by Application Insights data, automating toil with Azure Automation and Logic Apps, building chaos experiments with Azure Chaos Studio, and operating production systems at enterprise scale.

Week 1 — Advanced observability stack:

1. Azure Monitor Logs (Log Analytics) in depth: workspace design (centralised vs decentralised), data collection rules (DCR), table retention tiers, and cost management with commitment tiers
2. KQL mastery: advanced query patterns — time series analysis, anomaly detection with series_decompose_anomalies(), machine learning functions, and exporting results to Power BI
3. Azure Managed Grafana: the managed Grafana service with Azure Monitor, Prometheus, and Log Analytics data sources — building operational dashboards without managing Grafana infrastructure
4. Azure Monitor Managed Service for Prometheus: scraping Kubernetes (AKS) metrics into a fully managed Prometheus-compatible store — PromQL queries and Grafana integration
5. OpenTelemetry Collector on Azure: deploying the OTel Collector as a DaemonSet on AKS or as an Azure Container App — pipelines for receiving, processing, and exporting telemetry to Azure Monitor and Prometheus
6. Application Insights in depth: custom events, custom metrics, availability tests (URL ping, multi-step web tests), user flow analysis, and retention reports
7. Azure Monitor Workbooks: building interactive, parameterised reports — resource health reports, SLO dashboards, and incident review workbooks
8. Azure Monitor alerts at scale: alert rules, action groups, alert processing rules for maintenance windows, and programmatic alert management with Terraform

Week 2 — SRE practice on Azure:

1. SLIs, SLOs, and error budgets on Azure: defining SLIs from Application Insights availability and response time data — building SLO dashboards with KQL and Azure Monitor Workbooks
2. Multi-window multi-burn-rate alerting: implementing the Google SRE alerting approach with Azure Monitor metric alerts and Log Analytics scheduled query alerts
3. Azure Chaos Studio: the managed chaos engineering platform — fault library (VM shutdown, AKS pod delete, network latency, Service Bus outage), experiment design, and safety guards
4. Resilience testing scenarios: validating Container Apps scale-out, AKS node pool failover, Azure SQL failover group switchover, and Service Bus dead-letter handling under chaos conditions
5. Azure Automation: runbooks (PowerShell and Python), update management for VMs, and automated remediation triggered by Azure Monitor alerts
6. Azure Logic Apps for incident management: automated incident response workflows — alerting PagerDuty, creating Azure DevOps work items, and sending Teams notifications
7. Toil reduction on Azure: identifying repetitive manual operations and automating them with Azure Functions, Logic Apps, and Event Grid-triggered automation
8. Blameless post-mortems: Azure-specific incident timeline reconstruction using Activity Logs, Application Insights, and Sentinel — action item tracking in Azure DevOps Boards
9. Capacity planning on Azure: using Azure Advisor recommendations, Compute Optimizer signals, and historical metric trends to plan ahead of traffic growth
10. Azure Service Health: configuring service health alerts for Azure regional outages, planned maintenance, and health advisories — embedding service health in SRE dashboards

📅 Schedule & Timings

Choose one group only based on your availability. Max 5 candidates per group to ensure individual attention and hands-on lab support.

Weekday Groups:

• Group 1: Mon–Wed, 10 AM – 1 PM
• Group 2: Mon–Wed, 4 PM – 7 PM

Weekend Groups:

• Group 3: Sat & Sun, 10 AM – 2 PM
• Group 4: Sat & Sun, 4 PM – 8 PM

📍 Location: In-house training in Islamabad
📱 Online option may be arranged for out-of-city participants

🛠️ Core Program Tools & Technologies

• OS & Scripting: Ubuntu Linux, Bash, Azure CLI, PowerShell Az module, Python (azure-mgmt SDK)
• Containers: Docker, Docker Compose, Azure Container Registry, Trivy, Microsoft Defender for Containers
• Azure Services: VNet, NSG, VM/VMSS, ALB/AppGW/Front Door, Container Apps, App Service, ACI, Storage, SQL/PostgreSQL, Redis, Key Vault, Entra ID, DNS, ACM
• IaC: Bicep, Terraform (AzureRM provider), Terragrunt, Checkov, Azure Deployment Stacks
• CI/CD: Azure DevOps Pipelines (YAML, templates, environments), GitHub Actions (OIDC to Azure, azure/ actions)
• Observability: Azure Monitor, Log Analytics (KQL), Application Insights, Container Insights, OpenTelemetry
• Security: Key Vault, Managed Identity, Defender for Cloud, Azure Policy, Conditional Access
• Cost: Azure Cost Management, Azure Budgets, Azure Advisor, Reserved Instances

📋 Advanced Track Summary

• Track 1: Kubernetes & AKS — 3 weeks (Helm, Flux, ArgoCD, Workload Identity, KEDA, Istio, OPA Gatekeeper)
• Track 2: Azure Security & Compliance Engineering — 2 weeks (Sentinel, Defender, DevSecOps pipeline, Notation, SBOM, PIM)
• Track 3: Serverless & Event-Driven Architecture — 2 weeks (Functions, Durable Functions, APIM, Event Grid, Service Bus, Event Hubs)
• Track 4: Platform Engineering & Advanced IaC — 2 weeks (Landing Zones, Bicep Registry, Backstage, Deployment Environments, FinOps)
• Track 5: Azure AI & ML Infrastructure — 2 weeks (Azure OpenAI, AI Studio, AML, Databricks, Synapse, MLOps pipelines)
• Track 6: SRE & Advanced Observability — 2 weeks (Managed Prometheus, Managed Grafana, KQL mastery, Chaos Studio, SLOs)

🎯 Azure Certifications Aligned

• Core program: AZ-104 (Azure Administrator Associate), AZ-900 (Azure Fundamentals)
• Track 1 (AKS): Kubernetes CKA, AZ-104 advanced scenarios
• Track 2 (Security): AZ-500 (Azure Security Engineer Associate), SC-200 (Microsoft Security Operations)
• Track 3 (Serverless): AZ-204 (Azure Developer Associate)
• Track 4 (Platform): AZ-400 (Azure DevOps Engineer Expert), AZ-305 (Azure Solutions Architect Expert)
• Track 5 (AI/ML): AI-102 (Azure AI Engineer Associate), DP-100 (Azure Data Scientist Associate)
• Track 6 (SRE): AZ-400 (DevOps Engineer Expert) advanced scenarios

✅ Prerequisites

• Comfortable using the Linux command line (navigating, editing files, running commands)
• Basic understanding of how web applications and HTTP work
• Familiar with at least one scripting language (Bash or Python preferred)
• Git basics: clone, commit, push, pull, branch
• No prior Azure or DevOps experience required for the core program

🎯 Who This Is For

• Developers and system administrators transitioning into Azure DevOps and cloud engineering roles
• Engineers at Pakistani IT firms building or operating enterprise systems for international clients on Azure
• .NET and Microsoft-stack developers who want to own the infrastructure and deployment pipeline
• Engineers targeting remote Azure DevOps, platform engineering, or cloud architect roles
• Anyone pursuing AZ-104, AZ-400, AZ-305, or AZ-500 certification with hands-on lab training

💳 Course Fee & Booking

• ⌛ Core Program Duration: 4–5 Weeks
• ➕ Each Advanced Track: 2–3 additional weeks (additional fee per track)
• 📦 Available Advanced Tracks: Kubernetes & AKS · Security & Compliance · Serverless & Event-Driven · Platform Engineering · Azure AI & ML Infrastructure · SRE & Advanced Observability
• 🔒 Seats: 5 only per group

👉 Click here to book via WhatsApp