Many South African businesses still run important applications on a server in a back office or a rented rack: one machine, one copy of the database and backups that someone hopes are working. Microsoft Azure offers a different model. Microsoft runs the hardware, patching and much of the security, and you get building blocks that are designed to keep running, and keep your data, even when something fails. Here is what four of those building blocks do, and why they matter for a business application.
Azure App Service: run web applications without managing servers
Azure App Service hosts web applications and APIs on a fully managed platform. You deploy your application; Microsoft looks after the operating system, web server and patching underneath it.
- Scale when you need to. Add more instances manually or automatically when traffic rises, and scale back down when it quiets down.
- Safer releases. Deployment slots let you deploy a new version to a staging copy, test it, and swap it into production with no downtime. If something goes wrong, swap back.
- HTTPS by default. Free managed certificates, custom domains and modern TLS are built in.
- Built-in sign-in. App Service can require users to sign in with Microsoft Entra ID before they reach your application, without writing that code yourself.
- Private connections. Applications can connect privately to your databases and internal networks instead of over the public internet.
Azure SQL Database: a database that backs itself up
Azure SQL Database is the SQL Server engine run as a managed service. For applications built on SQL Server, moving to it is usually straightforward, and it removes most of the routine work of running a database server.
- Automatic backups. Full backups every week, differential backups every 12 or 24 hours and transaction log backups roughly every 10 minutes, with no backup jobs to manage.
- Point-in-time restore. Restore the database to how it looked at a specific minute, for example just before a bad import or an accidental delete. Retention is 7 days by default and can be set anywhere from 1 to 35 days.
- Long-term retention. Keep weekly, monthly or yearly backups for up to 10 years, useful for audit and record-keeping requirements.
- Encrypted by default. Transparent Data Encryption is switched on for new databases, so data files and backups are encrypted at rest.
- Patching and high availability handled. Microsoft applies updates and keeps the service running, with zone-redundant options in regions that support them.
Azure Blob Storage: files and documents, kept safe and affordable
Blob Storage holds unstructured data: documents, images, scans, exports, videos and backups. Applications store and retrieve files through it instead of on a file server.
- Pay for the right tier. Hot, cool, cold and archive tiers let you keep frequently used files fast and old records cheap, and lifecycle rules move data between tiers automatically.
- Undo mistakes. Soft delete and versioning let you recover files that were deleted or overwritten.
- Records that can’t be changed. Immutable storage keeps selected data in a write-once, read-many state for a set period, which helps with compliance and protects against ransomware.
- Encrypted at rest automatically, with the option to manage your own keys.
Microsoft Entra ID: one identity for every application
Microsoft Entra ID (previously Azure Active Directory) is the identity service behind Microsoft 365. If your staff already sign in to Outlook and Teams, they already have an Entra ID account. Connecting your own applications to it brings real benefits:
- Single sign-on. Staff use the same Microsoft account for your line-of-business applications as for Microsoft 365. There are no extra passwords to remember or reset.
- Multi-factor authentication applies to your applications too, not just to email.
- Instant joiners and leavers. Disable someone’s account once and they lose access to everything connected to it.
- Conditional access. With the right licence, you can set rules such as requiring a managed device or blocking sign-ins from unexpected countries.
- No secrets in code. Managed identities let your application connect to Azure SQL, Blob Storage and other services without storing passwords or keys in configuration files.
The security Microsoft adds
Security in the cloud is shared. Microsoft secures the data centres, hardware, network and platform services, and you remain responsible for your application, your users and how you configure things. What Azure gives you on its side of that line goes well beyond what most businesses can build themselves:
- Physically secured data centres with round-the-clock monitoring.
- Encryption of data at rest by default across SQL Database and Storage, and encryption in transit with TLS.
- Built-in protection against common network attacks such as distributed denial of service (DDoS).
- Azure Key Vault for storing certificates, keys and secrets securely.
- Microsoft Defender for Cloud, which assesses your configuration, flags weaknesses and alerts on threats.
- Detailed logs of who accessed what, for audits and investigations.
Keeping your data: availability zones and redundancy
An availability zone is a separate data centre, or group of data centres, within an Azure region, with its own power, cooling and networking. Microsoft’s South Africa North region in Johannesburg has three availability zones, and is paired with South Africa West in Cape Town for disaster recovery.
Zone-redundant deployments spread your application and data across those zones, so the failure of a whole data centre doesn’t take your system down or lose your data. Blob Storage, for example, offers several redundancy levels:
| Option | Where copies are kept | Designed durability per year |
|---|---|---|
| Locally redundant (LRS) | Within one data centre | At least 99.999999999% (11 nines) |
| Zone-redundant (ZRS) | Across three or more availability zones in the region | At least 99.9999999999% (12 nines) |
| Geo-redundant (GRS) | One data centre, plus a copy in a second region hundreds of kilometres away | At least 99.99999999999999% (16 nines) |
| Geo-zone-redundant (GZRS) | Across availability zones, plus a copy in a second region | At least 99.99999999999999% (16 nines) |
Azure SQL Database backups can be stored with the same choices. By default they are geo-redundant, so a copy sits in the paired region. Keeping primary data in South Africa North also helps with data residency and POPIA, because your data stays in the country. Not every Azure service supports every zone option in every region, so it’s worth checking support for the specific services you plan to use.
Is Azure right for your application?
Azure is a strong fit when an application is important to the business, needs to be available from anywhere, has to keep its data safe for years, or has outgrown a single server. Costs are usage-based, so the right design matters: the cheapest option is rarely the most resilient, and the most resilient is rarely needed everywhere. A sensible approach is to match each part of the system to how critical it is.
We are a Microsoft Partner and build secure web applications on .NET, SQL Server and Azure, from new systems to moving existing ones off ageing servers. See our services or talk to us about your application.