Microsoft Azure · Infrastruttura · YoctoIT tech page

Storage & Network

The foundations: Blob with immutability, Azure Files, VNet, ExpressRoute and Front Door — where the architecture plays its match.

FOCUS · THE FOUNDATIONSPrivate network, tiered storage and immutability: what holds everything else up
Request the Free Assessment Learn more
YoctoIT material for clients and partners · Microsoft, Azure, Entra, Defender and the other products mentioned are trademarks of Microsoft Corporation.
01 · What it is

Storage & Networking Azure, made clear.

Every Azure architecture rests here: Blob Storage with hot/cool/archive tiers and WORM immutability for backups, Azure Files for SMB shares, VNets and private endpoints for the perimeter, ExpressRoute for the direct wire to the data center, Front Door and Application Gateway to publish safely.

11 nove
data durability on geo-replicated storage (GRS)
WORM
immutability policies on Blobs: the backup ransomware can't rewrite
Private
private endpoints everywhere: PaaS services off the internet
Storage & Networking Azure
OFFICIAL MICROSOFT BRANDING · STORAGE & NETWORK
PORTALE AZURE REALE · VIRTUAL NETWORK · FONTE: MICROSOFT LEARN
REAL AZURE PORTAL · VIRTUAL NETWORK · SOURCE: MICROSOFT LEARN
02 · How to use it well

The things that make the difference.

The typical foundations

Applicazioni & utentiwhat gets published
Front Door/App GW
VNet & NSG
Private endpoint
entry · segments · private PaaS
ExpressRoute / VPNthe wire to the premises
Blob · Files · Disks (tiered)the data, at the right cost
First the network and the data, then everything else

Hub & spoke

The network topology that scales: a shared hub (firewall, ExpressRoute), spokes per environment.

Smart tiering

Lifecycle policies on Blobs: data slides from hot to archive on its own, the bill goes down.

Immutability for the backups

Time-based retention on the vaults: the copy no stolen credential can delete.

Governed egress

Egress and NAT under control: network costs are designed, not discovered on the invoice.

03 · In depth

Redundancies, tiers and hub&spoke

Storage accounts choose their redundancy (LRS→ZRS→GRS/GZRS with RA-*) and blob tiers (hot/cool/cold/archive) with automatic lifecycle; immutability (time-based/legal hold) armors the backups. The network is drawn hub&spoke: a hub with firewall/ExpressRoute, spokes per workload, private endpoints for the PaaS, centralized private DNS; ExpressRoute reaches 100G with FastPath, global peering connects the regions.

  • GZRS — zones + geo replication: data surviving both zone AND region
  • Lifecycle blob — hot→cool→archive by rules: hands-free tiering
  • Immutability — WORM on the containers: the copy ransomware can't touch
  • Private endpoint — PaaS with private IPs in the spoke: internet out of the flows
  • Hub & spoke — firewalls and circuits in the hub, workloads in the spokes: the topology that scales
  • ExpressRoute — up to 100G, with FastPath to bypass the gateway on the data path
04 · Numbers and lifecycle

The numbers that matter.

16
nines of durability with GZRS (by design)
4
the blob tiers: the cold costs cents
100G
maximum ExpressRoute Direct
1
one private DNS zone per service: centralized in the hub
Right foundations = everything easier: a hub&spoke landing zone, redundancies chosen by RPO and private endpoints everywhere — by design.
05 · Use cases

Where it really pays off.

Landing zones

The foundations of every well-done Azure adoption.

Backup off-site

The immutable shore of the 3-2-1 strategy.

Safe publishing

Apps exposed with WAF and network zero trust.

An architecture is judged by its foundations: our landing zones are born tidy.