Which service? Quick answers across all four domains.
One-screen answers to "which service?" questions. Each row links back to a topic page for the details.
| Need | Choose |
|---|
| Full OS control, lift and shift | Virtual machines (scale sets Flexible for scale, zones for HA) |
| Web app or API, least management | App Service |
| Event-driven code, pay per execution | Functions Flex Consumption (Windows needs the legacy Consumption plan) |
| Microservices, scale to zero, event scaling, no cluster | Container Apps |
| Kubernetes API, CRDs, Helm | AKS |
| Single short-lived container job, no orchestration | Container Instances |
| Large parallel or HPC jobs | Azure Batch (Spot for restartable work, dedicated for strict deadlines or MPI) |
| Single-tenant, compliance, more than 30 plan instances | App Service Environment v3 |
| Need | Choose |
|---|
| React to a state change (blob created) | Event Grid |
| Telemetry or streaming at high volume, Kafka clients | Event Hubs (Standard or higher) |
| Orders, ordering, transactions, dead-letter, duplicate detection | Service Bus Standard or Premium |
| Cheap background queue | Storage Queues |
| Messages up to 100 MB, JMS, geo-replication | Service Bus Premium |
| Publish an API to partners with throttling | API Management |
| Need | Choose |
|---|
| New cloud app, single database | Azure SQL Database (vCore; serverless if idle, Hyperscale beyond 4 TB) |
| SQL Agent, cross-database queries, CLR, instance-level features | SQL Managed Instance |
| OS access, SSRS on the same server | SQL Server on Azure VMs |
| Many tenant databases, varying peaks | Elastic pool |
| Open-source engines | PostgreSQL or MySQL Flexible Server |
| Hide data from DBAs | Always Encrypted |
| Need | Choose |
|---|
| Zone failure, one region | ZRS |
| Regional disaster | GRS or GZRS |
| Read the secondary before failover | RA-GRS or RA-GZRS |
| Rare access, instant reads | Cool or Cold |
| Compliance archive | Archive (hours to rehydrate) |
| WORM, even admins can't delete | Immutable storage, locked time-based policy |
| Cloud file shares with AD permissions | Azure Files SMB with identity-based auth |
| POSIX file share | Azure Files NFS (LRS or ZRS only) |
| Need | Choose |
|---|
| Survive a zone failure | Zones, ZRS, zone-redundant services |
| Fail VMs over to another region or zone | Azure Site Recovery |
| Restore deleted or corrupted data | Azure Backup (immutable vault + multi-user authorization against ransomware) |
| SQL regional DR, unchanged connection string | Failover group |
| SQL undo yesterday's mistake | Point-in-time restore |
| Keep SQL backups for years | Long-term retention |
| Cheapest regional SQL DR, RPO about 1 hour | Geo-restore |
| Need | Choose |
|---|
| Private, predictable, not over the internet | ExpressRoute |
| Encrypted, quick and cheap | Site-to-site VPN (also a backup path) |
| Connect two on-prem sites over Microsoft's network | ExpressRoute Global Reach |
| Other geopolitical regions | ExpressRoute Premium |
| Survive loss of a peering location | ExpressRoute Metro |
| Hub with many regions and branches | Virtual WAN |
| Need | Choose |
|---|
| Cloud sign-in that survives on-prem outage | Password hash sync |
| Enforce on-prem policy at sign-in | Pass-through authentication |
| Disconnected forests, multi-agent failover | Entra Cloud Sync |
| Customer sign-up app | Entra External ID (external tenant) |
| Partners in your tenant | B2B collaboration + entitlement management |
| Secrets without credentials | Managed identity + Key Vault (RBAC) |
| Single-tenant HSM | Managed HSM or Azure Cloud HSM (Dedicated HSM is retiring) |
| Just-in-time admin | PIM eligible assignment (P2) |