2.2.1. 💡 First Principle: Regions, Availability Zones, and Region Pairs
First Principle: Azure's global infrastructure is designed for high availability and resilience. Its core purpose is to enable customers to deploy applications close to their users for low latency, while also providing robust options for disaster recovery and compliance with data sovereignty laws.
What It Is: This refers to the physical and logical layout of Azure's datacenters around the world.
- Azure Regions: A Region is a geographic area on the planet containing at least one, but potentially multiple, datacenters that are networked together with a low-latency network.
- Use Case: You choose a region to deploy your resources into, often based on proximity to users, data residency requirements, or service availability.
- Availability Zones (AZs): Availability Zones are physically separate locations within an Azure region. Each AZ is made up of one or more datacenters with independent power, cooling, and networking.
- Use Case: Protects applications from datacenter-level failures. Deploying resources across multiple AZs provides high availability.
- Region Pairs: Most Azure regions are paired with another region within the same geography (e.g., East US is paired with West US).
- Use Case: Enables replication of resources (like storage) for disaster recovery. If one region in a pair is affected by a disaster, services can fail over to the other.
Scenario: You are designing a mission-critical application that must remain available even if an entire datacenter fails. The application also needs a disaster recovery plan in case of a large-scale regional outage.
Reflection Question: How would you use both Availability Zones and Region Pairs to design a solution that is both highly available (resilient to datacenter failure) and has a robust disaster recovery strategy (resilient to regional failure)?
💡 Tip: Remember the hierarchy: A Region contains multiple Availability Zones. Availability Zones protect against local failures; Region Pairs protect against regional disasters.
Sovereign Regions:
In addition to standard Azure regions, Microsoft provides sovereign regions—isolated instances of Azure designed to meet specific compliance, regulatory, and data residency requirements:
- Azure Government: A separate instance of Azure for US government agencies, contractors, and their partners. It meets strict US compliance requirements (FedRAMP High, DoD IL4/IL5, CJIS) and is operated by screened US personnel.
- Azure China (21Vianet): A physically separated instance of Azure operated by a local partner (21Vianet) to comply with Chinese regulations. Data stays within China, and it has a separate portal and identity system.
Sovereign regions have their own portals, subscriptions, and may have different service availability than global Azure regions. You cannot replicate data between sovereign regions and standard Azure regions.
Scenario: A US federal agency needs to deploy a cloud application that processes classified information. They require the cloud provider to meet strict government compliance standards and ensure data never leaves US jurisdiction.
Reflection Question: Why would this agency choose Azure Government over standard Azure regions, even if the nearest standard region is geographically closer?
💡 Tip: For the AZ-900 exam, know that sovereign regions exist for compliance reasons and are physically and logically isolated from standard Azure. Azure Government is for US government; Azure China is operated by 21Vianet.
