Hands-on introduction to the two cloud platforms you are most likely to encounter in an enterprise IT support role.
Learning Objectives
Module Breakdown
Module A: Microsoft Azure Essentials
🕐 ~3 hours📚 5 topicsHands-on
Azure portal navigation and resource organization
Azure AD / Entra ID fundamentals
Creating and managing virtual machines
Azure Blob Storage basics
Azure Monitor essentials
Module B: AWS Essentials
🕐 ~3 hours📚 5 topicsHands-on
AWS Console navigation and regions/zones
EC2 instance lifecycle management
S3 bucket creation and access control
IAM users, groups, and policies
CloudWatch monitoring and alarms
Module C: Cost Management Across Clouds
🕐 ~1.5 hours📚 2 topicsPractical
Azure cost analysis and Budget alerts
AWS Cost Explorer and Budgets
Module A: Microsoft Azure Essentials
Azure Portal Navigation
The Azure portal (portal.azure.com) is the web-based management interface for all Azure services. All screenshots described below are based on the standard portal layout as of 2025.
Portal Layout Description
Top bar: Search box ("Search resources, services, and docs") spanning the width. To the right: notification bell, user profile, and settings gear. Left sidebar: Collapsible menu with Home, Resource groups, All services, Marketplace, Cost management. Main area: Dashboard tiles showing recently used resources, quick action buttons, and recommendation cards.
[Screenshot description: The Azure portal home screen shows a left sidebar with icons for Home, + Create a resource, Resource groups (2), Virtual machines (1), and Storage accounts (3). The main dashboard displays a "Quick Start" section with links to tutorials, and a "Resource groups" tile showing your organizational containers.]
Key navigation tip: Use the global search at the top for any service. Type the service name and press Enter to jump directly to it. For example, typing "virtual machines" shows the VM blade immediately.
Azure AD / Entra ID Basics
Azure Active Directory (now called Microsoft Entra ID) is Microsoft's cloud-based identity and access management service. It authenticates and authorizes users for Azure resources and hundreds of SaaS applications.
Entra ID Core Concepts
Tenant: Your organization's dedicated instance of Entra ID. Created when you sign up for Azure.
Users: Individual identities (employees, service accounts) assigned to the tenant.
Groups: Collections of users used for permission assignment (no passwords needed).
Conditional Access: Policies requiring MFA or compliant devices before granting access.
Enterprise Applications: SaaS apps integrated with Entra ID for single sign-on (SSO).
Common IT Support Scenarios
Password reset: Reset a user's password via the Entra ID portal (Admin Center > Users).
New employee: Create a user account, assign a license (Microsoft 365), and add to relevant groups.
Offboarding: Disable the account (don't delete), reassign licenses, remove from groups.
Group policy: Add users to "Finance Team" group to grant access to SharePoint finance site.
MFA enrollment: Guide users through the Microsoft Authenticator app setup.
Access review: Audit which users have access to sensitive applications quarterly.
Lab: Creating a Virtual Machine in Azure
Follow these steps to deploy your first Azure VM. Use the free-tier eligible B1s or Dsv2 series instances.
1
Go to the Azure portal and click + Create a resource > Virtual Machine.
2
Under Project details, select your subscription. Click Create new for Resource Group and name it rg-training-vm.
3
Under Instance details: VM name = win-test-01, Region = pick closest to you (e.g., East US), Image = Windows Server 2022 Datacenter or Windows 11 Enterprise, Size = B1s (1 vCPU, 1 GB RAM -- cheapest option).
4
Under Administrator account: Username = azureadmin, Password = create a strong password (must include uppercase, lowercase, number, special character). Authentication method = Password.
5
Under Inbound ports, select RDP (3389) from the dropdown. Allow from = My IP address (restricts access to only your current IP).
6
Review all settings, then click Create. Wait approximately 2-3 minutes for deployment to complete.
7
Once deployed, click Go to resource. Note the Public IP address shown on the Overview page.
[Screenshot description: The VM Overview blade in Azure shows the VM name "win-test-01", Status "Running" in green, the Public IP address (e.g., 20.85.xxx.xxx), and action buttons including Connect, Stop, Restart, Delete along the top.]
8
Click Connect > RDP. Download the RDP file, open it, and connect using the credentials you created.
Expected Outcome
You now have a Windows virtual machine running in Azure. You should see a remote desktop session showing the Windows desktop. From here, you could install software, test network connectivity, or configure the OS just like a physical machine.
Lab: Storing Files in Azure Blob Storage
In the Azure portal, click + Create a resource and search for "Storage account".
Create a new storage account named sttraining<random4chars> (storage names must be unique globally).
Once deployed, navigate to the storage account and click Containers under Data storage in the left menu.
Click + Container, name it logs, and set Public access level to Private (no anonymous access).
Click into the container, then Upload any small text file (e.g., a log file or CSV).
After upload completes, click the uploaded blob and copy its URL. Note that the URL ends with ?sp=r when accessed privately.
Blob Storage Access Levels
Private: Only authenticated users with keys can access. Safest option. Container: Anyone with the container URL can read but not modify. Blob: Anyone with the specific blob URL can read it. Never use public access for sensitive data.
Azure Monitor Basics
Azure Monitor collects telemetry from Azure resources and provides dashboards, alerts, and insights.
Feature
Purpose
IT Support Use Case
Metrics
Numeric values over time (CPU %, memory, disk)
Check if a VM is consuming excessive resources
Logs (Log Analytics)
Query structured event data with KQL
Search for error events across multiple VMs
Alerts
Notifications when thresholds are breached
Email when CPU exceeds 90% for 5 minutes
Diagnostics
Infrastructure-level health data
Investigate why a VM restarted unexpectedly
To set a simple metric alert: Navigate to your VM > Alerts > + Create > Metric alert. Set Condition = CPU Percentage > Greater than90 for Last 5 minutes. Add an action group with an email notification. Save and test by running a CPU-intensive process on the VM.
Module B: AWS Essentials
AWS Console Navigation
The AWS Management Console (console.aws.amazon.com) is organized differently from Azure but follows similar principles.
Console Layout Description
Top nav bar: AWS logo (left), service search bar (center), Regions dropdown (e.g., us-east-1), Account name (right), Notifications bell. Main content: Dashboard with widgets showing recent activity, cost estimates, and service quotas. Navigation: Left hamburger menu expands to show all AWS services grouped by category (Compute, Storage, Database, Networking, etc.).
Regions & Availability Zones: AWS organizes infrastructure into Regions (geographic areas like US East N. Virginia, EU West Ireland) and within each Region are multiple isolated Availability Zones (data centers). Always check your current region -- resources are created in the selected region only.
Open the AWS Console and search for "EC2" in the top search bar.
Click Launch Instance (yellow button near top right).
Name it aws-test-vm and select Amazon Linux 2023 as the AMI.
Instance type: t2.micro or t3.micro (eligible for free tier).
Key pair: Select Create new key pair, name it training-key, format .pem, then click Create and download.
Network settings: Ensure Security group allows SSH (port 22) from My IP only.
Click Launch Instance and wait for it to reach "running" status.
Click Connect > select the SSH tab. Copy the command provided.
Open Terminal/PowerShell and run: chmod 400 training-key.pem then ssh -i "training-key.pem" ec2-user@<public-ip>
Verify connection by running whoami and df -h.
Expected Outcome
You are logged into a live Amazon Linux instance via SSH. You can run Linux commands, install packages with sudo dnf install -y nginx, and manage the server. The session proves the VM is provisioned and network-accessible.
S3 Storage Basics
Amazon S3 (Simple Storage Service) is object storage designed for durability (99.999999999% = 11 nines) and availability.
This policy allows EC2 instances to read objects from the bucket but denies all other actions. Principle of least privilege in action.
IAM Fundamentals
IAM (Identity and Access Management) is AWS's way of controlling who can do what. This maps directly to Entra ID in the Azure world.
IAM Entity
What It Is
Best Practice
Root User
Account creator with unlimited access
Enable MFA, don't use for daily tasks
IAM Users
Individual people or services
One user per person, attach groups
IAM Groups
Collection of users
Add/remove users to grant/revoke permissions
IAM Roles
Temporary permissions for AWS services
Assign to EC2 instead of embedding credentials
Policies
JSON documents defining permissions
Use AWS-managed policies first, then customize
IAM Policy Structure
AWS IAM policies are JSON documents with four key elements: Version (policy language version, always "2012-10-17"), Statement (array of rules), Effect (Allow or Deny), Action (what API operations are permitted), and Resource (which AWS resources the action applies to). Always follow the principle of least privilege -- grant only the minimum permissions needed.
AWS CloudWatch Basics
CloudWatch is AWS's monitoring and observability service, analogous to Azure Monitor.
CloudWatch Components
CloudWatch Metrics -- numeric data points (CPU, disk, network) with graphs
CloudWatch Logs -- collect, store, and analyze log files from EC2, Lambda, etc.
CloudWatch Alarms -- trigger notifications or auto-actions when metrics cross thresholds
CloudWatch Events (EventBridge) -- react to state changes (e.g., instance stopped)
CloudWatch Dashboards -- custom panels combining multiple metrics and logs
Lab: Create a CloudWatch Alarm
Open the CloudWatch console and click Alarms > Create alarm.
Select metric: EC2 > By Instance > select your test VM.
Condition: CPUUtilization > 80 for 2 consecutive periods of 1 minute.
Action: Send notification to an SNS topic (create a new one with your email).
Name the alarm high-cpu-alert and create it.
Test: SSH into the VM and run dd if=/dev/zero of=/dev/null bs=1M to spike CPU.
Module C: Cost Management
Azure Cost Management
In the Azure portal, navigate to Cost management + Billing > Budgets to set spending limits.
Set budgets at 50%, 80%, and 100% thresholds to catch overspending early. Azure also provides Cost Analysis reports showing spend by service, resource, and tag.
AWS Cost Explorer & Budgets
Navigate to the Billing Dashboard > Budgets > Create budget. Choose Cost budget, set monthly amount (e.g., $25), and configure email alerts at 80% and 100% thresholds.
Cost Optimization Checklist
Before ending every cloud session: (1) Stop or terminate any VMs you no longer need, (2) Delete unattached EBS volumes and orphaned snapshots, (3) Release unused Elastic IPs, (4) Remove old snapshot images you won't reuse, (5) Turn off dev/test environments outside business hours.
Knowledge Check
1. Where in the Azure portal would you go to reset a user's password?
A) Azure Monitor > Diagnostics
B) Microsoft Entra ID > Users > Select user > Reset password
C) Virtual Machines > Restart
D) Cost Management > Budgets
Answer: B) Microsoft Entra ID > Users. Navigate to Entra ID, find the user, and click "Reset password" from the user's detail blade.
2. What is the minimum information required to connect to a Windows Azure VM via RDP?
A) SSH key pair and public DNS
B) Username, password, and public IP address
C) Subnet mask and gateway address
D) Resource group name and subscription ID
Answer: B) Username, password, and public IP address. Windows VMs in Azure use RDP (Remote Desktop Protocol) with username/password authentication. Linux VMs use SSH with key pairs.
3. In AWS, what does an IAM Role differ from an IAM User?
A) There is no difference; they are interchangeable
B) Roles are for humans, Users are for services
C) Users are permanent identities; Roles are temporary credentials assumed by services or trusted entities
D) Roles cannot have any permissions attached
Answer: C. IAM Users are long-lived identities bound to specific individuals or applications. IAM Roles are assumed temporarily and are the preferred way to grant permissions to AWS services (like EC2 instances accessing S3).
4. Which S3 storage class would be most cost-effective for storing backup archives that you rarely access?
A) S3 Standard
B) S3 Intelligent-Tiering
C) S3 Glacier Instant Retrieval
D) S3 Standard-IA
Answer: C) S3 Glacier Instant Retrieval (or S3 Glacier Deep Archive for even lower cost with longer retrieval times). Glacier classes are designed for archival data that is rarely accessed but must be retained.
5. What is the FIRST thing you should do in AWS before creating any IAM users or resources?
A) Launch an EC2 instance
B) Enable MFA on the root account
C) Create a CloudWatch alarm
D) Set up a VPC
Answer: B) Enable MFA on the root account. The root user has unrestricted access to everything in your account. Securing it with MFA is the single most important first step to protect your AWS account from compromise.
I can navigate the Azure portal and locate key services
I understand Entra ID users, groups, and roles
I have successfully created a Windows VM in Azure
I have uploaded a file to Azure Blob Storage
I have viewed metrics and created an alert in Azure Monitor
I can navigate the AWS Management Console
I have launched an EC2 instance and connected via SSH
I have created an S3 bucket and managed objects
I understand IAM users, groups, and roles in AWS
I have created a CloudWatch alarm for a CPU threshold
I have set up cost budget alerts in both Azure and AWS
I have scored at least 4 out of 5 on the knowledge check quiz
Next Steps
Where to Go From Here
Great job getting hands-on with both Azure and AWS! Now that you can navigate cloud portals and provision resources, the next logical step is to automate routine IT tasks using PowerShell scripting. PowerShell works natively with both Azure and AWS and is the backbone of cloud automation in enterprise environments. After mastering PowerShell, wrap up the phase with Bash scripting for Linux environments.