Network Security Groups are the fundamental, resource-level tool for filtering network traffic to and from Azure resources in a VNet. Creating inbound allow rules with the source set to the partner’s specific IP addresses (or a range) for ports 3389 (RDP) and 80 (HTTP) is the most direct and appropriate solution. It operates at the network layer, is managed centrally, and doesn’t require complex routing or on-VM configuration.

When blob soft delete is enabled, deleted blobs are transitioned to a soft deleted state for the duration of the retention period. They remain in the container and are visible when you choose to show deleted blobs. The administrator can directly undelete them, which restores the blob and its data, metadata, and properties. This is a self-service operation and does not require a support ticket or a full account restore.

Azure Policy is the core service for enforcing organizational standards and assessing compliance at scale. By creating a policy definition with a ‘Deny’ effect that checks for the existence of the required tags, you can prevent the creation of non-compliant VMs altogether. This provides proactive enforcement, whereas Resource Graph is for querying and Blueprints are for deployment orchestration (which can include policies).

While host-level metrics in the Azure portal provide some disk data, they are limited and aggregated. For detailed, guest OS-level performance data (like specific disk queue length, avg. disk sec/read, etc.), you need the Azure Diagnostics extension (or the newer Azure Monitor Agent). This agent collects performance counters from within the VM and sends them to a destination like Log Analytics, where you can create detailed queries and visualizations in Azure Monitor for true root-cause analysis.

For infrequently accessed data (once or twice a year) where cost is paramount, the Archive tier offers the lowest storage cost. However, it has high retrieval costs and latency. Since the data is logs for audit and not mission-critical live data, the durability provided by Locally-redundant storage (LRS) is often sufficient, and it is the lowest-cost redundancy option. Combining LRS with Archive provides the most cost-effective solution for this specific scenario.

Azure AD B2B collaboration is designed for this exact scenario. You can create guest user accounts in your Azure AD by inviting the contractors’ own email addresses (which can be from any identity provider like another Azure AD, MSA, or Google). You can then group these guest users and assign the group the appropriate Azure RBAC role (e.g., Contributor, Reader) on the target resources. This is secure, auditable, and doesn’t clutter your on-premises AD with external identities.

Azure Policy assignments are inherited down the Azure resource hierarchy. If a policy with a ‘Modify’ or ‘Append’ effect for tags is assigned at the subscription or a management group level, it will evaluate and apply to resources in all resource groups within that scope, regardless of whether they are user-created or platform-managed (like the AKS node resource group). There is no need for a separate assignment.

Data transfer between Azure services in different regions incurs an outbound bandwidth charge. The most direct way to eliminate this charge is to ensure the consuming service (the application) is in the same region as the data source (the storage account). Co-locating resources within the same region makes data transfer free. The other options improve redundancy or security but do not address the core issue of cross-region data transfer costs.

Azure Backup uses backup policies to define the schedule and, crucially, the retention of recovery points. The default policy typically retains points for a limited time (e.g., 30-180 days). To meet a 7-year requirement, you must create a custom backup policy. This policy defines long-term retention rules, such as retaining weekly backups for X years and monthly backups for Y years. You can also leverage the Archive tier for cost-effective retention of older recovery points beyond a certain age.

Network Security Groups are the fundamental, resource-level tool for filtering network traffic to and from Azure resources in a VNet. Creating inbound allow rules with the source set to the partner’s specific IP addresses (or a range) for ports 3389 (RDP) and 80 (HTTP) is the most direct and appropriate solution. It operates at the network layer, is managed centrally, and doesn’t require complex routing or on-VM configuration.0