"The cloud" sounds like something without a place. In truth, every Azure resource runs in a real building, with power, cooling and network cables. Where that building stands and how Azure groups buildings determines how fast your application responds, where your data lives and what happens when something fails. This lesson explains the building blocks from the bottom up: from the datacenter through the availability zone and the region to the region pair and the sovereign regions.
Datacenters
An Azure datacenter is a facility in which servers stand in racks, with its own power supply, cooling and network equipment. In principle that is no different from a datacenter in your own building, only much larger.
As a customer you have nothing to do with an individual datacenter. You never choose "building 17." Instead, Azure groups datacenters into regions and availability zones, and these two terms are the ones you see in the portal and in every plan.
Regions and geographies
According to Microsoft, a region consists of one or more datacenters connected by a fast, resilient network with low latency. The datacenters of a region are typically located in a large metropolitan area. According to Microsoft, Azure has more than 70 regions worldwide.
Several regions belong to one geography, for example Europe or the US. A geography is a fixed boundary for where data stays (data residency): If you have to keep your data in Europe, you choose only regions from the matching geography.
When you create a resource, you usually choose a region yourself. Microsoft names three things that drive this choice:
- Latency: Choose a region close to your users so that responses arrive quickly.
- Availability zones: Not every region offers them. If you need resilience, choose a region that supports them.
- Data residency: The region must be in the geography that your organization requires.
In addition, some services or features are available only in certain regions, such as certain VM sizes. Some services, on the other hand, are global and don't require a region, for example Microsoft Entra ID, Azure Traffic Manager and Azure DNS.
Availability zones
An availability zone is a group of one or more datacenters within a region, with independent power, cooling and network. If one zone fails, for example because of a power outage, the others keep running. The zones of a region are connected by a fast network. They are close enough together for low latency and far enough apart that a storm or a local outage doesn't hit several at once.
You should remember two things:
- A region that offers availability zones has at least three of them. Not all regions offer them.
- Zones protect against the failure of part of the region, not against the failure of the whole region.
How a service uses the zones differs:
- Zonal resources you place yourself in a specific zone, for example a virtual machine. If that zone fails, you take care of the switch yourself, by having created resources in several zones beforehand.
- Zone-redundant resources are distributed or replicated across several zones by the service itself. If a zone fails, Microsoft takes over the switch. Examples from Microsoft's training material are zone-redundant storage and Azure SQL Database.
More zones also mean more effort and can cause additional costs, because you run resources twice.
Region pairs
Microsoft connects some regions into region pairs. Microsoft defines the pairs, you cannot choose them yourself. Examples from Microsoft's documentation: West US and East US, Southeast Asia and East Asia. A pair is almost always in the same geography so that the data stays within its legal jurisdiction.
This brings three benefits:
- In a large-scale outage, one region of the pair is restored first.
- Azure rolls out planned updates across the two regions one after the other, not at the same time.
- Some services use the pair for geo-replication. Geo-redundant storage can copy data automatically to the paired region.
The limits are important. Microsoft says explicitly: Using a region in a pair does not make your resources resilient automatically and does not trigger a failover by itself. Disaster plans remain your job. Many newer regions have no partner at all and rely on availability zones instead, for example Italy North and Poland Central. And not every pairing is symmetric: Brazil South is paired with South Central US, but not the other way around.
Sovereign regions
Besides the normal regions there are sovereign regions. These are instances separate from the rest of the Azure environment, for especially strict requirements. Microsoft names two examples: regions for US government agencies (for example US Gov Virginia), operated by screened personnel in the US, and regions in China, which Microsoft offers in partnership with 21Vianet, where Microsoft does not operate the datacenters itself. Sovereign regions work like other regions but often have fewer services and features.
The building blocks at a glance
| Building block | What it is | Important to know |
|---|---|---|
| Datacenter | building with servers, power, cooling, network | you don't choose an individual one |
| Availability zone | independent group of datacenters in a region | at least three per region with zones; does not protect against a region failure |
| Region | one or more datacenters in a metropolitan area | latency, features and data residency depend on it |
| Geography | several regions, fixed boundary of data residency | for example Europe |
| Region pair | two regions connected by Microsoft | no automatic protection, planning stays with you |
| Sovereign region | separate Azure instance for special requirements | often fewer services |
An example
The made-up company "Lindner Schuhe" runs a web shop. The customers are in Germany and Austria, and the customer data is to stay in Europe. The company therefore chooses a region in the Europe geography, close to the customers, and one that offers availability zones. It sets up the shop database as zone-redundant. If a datacenter fails, the shop keeps running. For the rare case that the whole region fails, the company also plans a second region, likewise in Europe.
Exercise 1
The made-up property management company "Krämer & Voss" has three requirements for its tenant portal:
- The data must stay in Europe.
- The failure of a single datacenter must not paralyze the portal.
- The failure of a whole region should not mean the end either.
Assign a building block from this lesson to each requirement. Also explain why it is not enough to simply pick a region that has a region pair.
Solution 1
- Data residency: That is the job of the geography. You choose a region in the Europe geography and create all resources there.
- Failure of a datacenter: Availability zones solve this. You choose a region that offers zones and use zone-redundant services or distribute zonal resources across several zones yourself.
- Failure of a whole region: Zones don't help against that, because they lie within one region. You need a second region, for example the paired one, if the service offers geo-replication across it.
To justify it: A region pair makes nothing resilient by itself. Microsoft says explicitly that using a pair brings neither a failover nor disaster recovery automatically. So the company has to decide itself what is copied to the second region and plan the switch. In addition, some regions have no partner. There, a second region would be a decision of its own.