Azure Account (Microsoft Account)
    └── Management Groups (optional, for large organizations)
            └── Subscriptions (billing boundary)
                    └── Resource Groups (logical container)
                            └── Resources (VMs, databases, storage accounts, etc.)

#!/bin/bash
# ── Microsoft Azure Tutorial: VM Deployment Script ──────────

# Step 1: Login to Azure
az login

# Step 2: Set your subscription (if you have multiple)
az account set --subscription "Your-Subscription-Name"

# Step 3: Create a Resource Group
az group create \
  --name elearncourses-rg \
  --location eastus \
  --tags Environment=Tutorial Project=AzureLearning

echo "✅ Resource group created: elearncourses-rg"

# Step 4: Create a Virtual Network
az network vnet create \
  --resource-group elearncourses-rg \
  --name elearn-vnet \
  --address-prefix 10.0.0.0/16 \
  --subnet-name elearn-subnet \
  --subnet-prefix 10.0.1.0/24

echo "✅ Virtual Network created: elearn-vnet"

# Step 5: Create a Network Security Group
az network nsg create \
  --resource-group elearncourses-rg \
  --name elearn-nsg

# Allow SSH (port 22) and HTTP (port 80)
az network nsg rule create \
  --resource-group elearncourses-rg \
  --nsg-name elearn-nsg \
  --name allow-ssh \
  --priority 100 \
  --protocol Tcp \
  --destination-port-range 22 \
  --access Allow

az network nsg rule create \
  --resource-group elearncourses-rg \
  --nsg-name elearn-nsg \
  --name allow-http \
  --priority 110 \
  --protocol Tcp \
  --destination-port-range 80 \
  --access Allow

echo "✅ Network Security Group configured"

# Step 6: Create a Public IP Address
az network public-ip create \
  --resource-group elearncourses-rg \
  --name elearn-public-ip \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

# Step 7: Create a Virtual Machine
az vm create \
  --resource-group elearncourses-rg \
  --name elearn-web-vm \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --vnet-name elearn-vnet \
  --subnet elearn-subnet \
  --nsg elearn-nsg \
  --public-ip-address elearn-public-ip \
  --admin-username azureuser \
  --generate-ssh-keys \
  --zone 1 \
  --tags Environment=Tutorial Role=WebServer

echo "✅ Virtual Machine created: elearn-web-vm"

# Step 8: Install Nginx web server on the VM
az vm extension set \
  --resource-group elearncourses-rg \
  --vm-name elearn-web-vm \
  --name customScript \
  --publisher Microsoft.Azure.Extensions \
  --settings '{"commandToExecute":"apt-get update && apt-get install -y nginx && systemctl start nginx && systemctl enable nginx"}'

# Step 9: Get the public IP address
PUBLIC_IP=$(az network public-ip show \
  --resource-group elearncourses-rg \
  --name elearn-public-ip \
  --query ipAddress \
  --output tsv)

echo ""
echo "🌐 Your web server is accessible at: http://$PUBLIC_IP"
echo "🔑 SSH access: ssh azureuser@$PUBLIC_IP"

# Step 10: VM Management commands
echo ""
echo "📋 Useful VM management commands:"
echo "  Stop VM:     az vm stop   --resource-group elearncourses-rg --name elearn-web-vm"
echo "  Start VM:    az vm start  --resource-group elearncourses-rg --name elearn-web-vm"
echo "  Restart VM:  az vm restart --resource-group elearncourses-rg --name elearn-web-vm"
echo "  VM Status:   az vm show   --resource-group elearncourses-rg --name elearn-web-vm --show-details"
echo "  Delete ALL:  az group delete --name elearncourses-rg --yes --no-wait"

# Deploy a Python web app to Azure App Service

# Create App Service Plan (defines pricing tier and region)
az appservice plan create \
  --name elearn-app-plan \
  --resource-group elearncourses-rg \
  --sku B1 \
  --is-linux

# Create Web App
az webapp create \
  --resource-group elearncourses-rg \
  --plan elearn-app-plan \
  --name elearncourses-webapp \
  --runtime "PYTHON:3.11" \
  --deployment-local-git

# Set environment variables
az webapp config appsettings set \
  --resource-group elearncourses-rg \
  --name elearncourses-webapp \
  --settings \
    FLASK_ENV=production \
    DATABASE_URL="your-db-connection-string" \
    SECRET_KEY="your-secret-key"

# Enable auto-scaling
az monitor autoscale create \
  --resource-group elearncourses-rg \
  --resource elearncourses-webapp \
  --resource-type Microsoft.Web/sites \
  --name elearn-autoscale \
  --min-count 1 \
  --max-count 5 \
  --count 1

# Auto-scale rule: Scale out when CPU > 70%
az monitor autoscale rule create \
  --resource-group elearncourses-rg \
  --autoscale-name elearn-autoscale \
  --scale out 1 \
  --condition "CpuPercentage > 70 avg 5m"

echo "✅ Web App deployed: https://elearncourses-webapp.azurewebsites.net"

# Azure Function Example — HTTP-triggered Python function
# File: function_app.py

import azure.functions as func
import json
import logging
from datetime import datetime

app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)

@app.route(route="analyze-student")
def analyze_student(req: func.HttpRequest) -> func.HttpResponse:
    """
    Azure Function: Analyze student performance data
    Trigger: HTTP POST request
    """
    logging.info('Student analysis function triggered')

    try:
        # Parse request body
        req_body = req.get_json()
        student_name = req_body.get('name', 'Unknown')
        scores = req_body.get('scores', [])
        course_name = req_body.get('course', 'Unknown Course')

        if not scores:
            return func.HttpResponse(
                json.dumps({"error": "No scores provided"}),
                status_code=400,
                mimetype="application/json"
            )

        # Compute analytics
        avg_score = sum(scores) / len(scores)
        max_score = max(scores)
        min_score = min(scores)
        passing_count = sum(1 for s in scores if s >= 60)
        pass_rate = (passing_count / len(scores)) * 100

        # Grade assignment
        if avg_score >= 90:
            grade = "A"
            status = "Excellent"
        elif avg_score >= 80:
            grade = "B"
            status = "Good"
        elif avg_score >= 70:
            grade = "C"
            status = "Satisfactory"
        elif avg_score >= 60:
            grade = "D"
            status = "Needs Improvement"
        else:
            grade = "F"
            status = "Failing"

        response = {
            "student": student_name,
            "course": course_name,
            "analysis": {
                "average_score": round(avg_score, 2),
                "highest_score": max_score,
                "lowest_score": min_score,
                "pass_rate_pct": round(pass_rate, 1),
                "grade": grade,
                "status": status,
                "total_assessments": len(scores)
            },
            "recommendation": (
                f"{student_name} is performing {status.lower()} in {course_name}. "
                f"Average score: {avg_score:.1f}% (Grade: {grade}). "
                + ("Keep up the excellent work!" if grade in ["A", "B"]
                   else "Additional study sessions recommended.")
            ),
            "processed_at": datetime.utcnow().isoformat()
        }

        return func.HttpResponse(
            json.dumps(response, indent=2),
            status_code=200,
            mimetype="application/json"
        )

    except ValueError:
        return func.HttpResponse(
            json.dumps({"error": "Invalid JSON in request body"}),
            status_code=400,
            mimetype="application/json"
        )
    except Exception as e:
        logging.error(f"Unexpected error: {str(e)}")
        return func.HttpResponse(
            json.dumps({"error": "Internal server error"}),
            status_code=500,
            mimetype="application/json"
        )

@app.timer_trigger(schedule="0 0 8 * * MON-FRI",
                   arg_name="timer",
                   run_on_startup=False)
def daily_report_generator(timer: func.TimerRequest) -> None:
    """
    Timer-triggered function: Runs every weekday at 8 AM UTC
    Generates and sends daily performance reports
    """
    logging.info(f'Daily report function triggered at: {datetime.utcnow()}')

    if timer.past_due:
        logging.warning('Timer trigger is running late!')

    # Report generation logic would go here
    logging.info('Daily student performance report generated successfully')


@app.blob_trigger(arg_name="inputblob",
                  path="course-uploads/{name}",
                  connection="AzureWebJobsStorage")
def process_course_upload(inputblob: func.InputStream) -> None:
    """
    Blob-triggered function: Process new course content uploads
    Trigger: New file uploaded to 'course-uploads' container
    """
    logging.info(f"Processing uploaded file: {inputblob.name}")
    logging.info(f"File size: {inputblob.length} bytes")

    # File processing logic (parse, validate, index) would go here
    logging.info(f"✅ Course content processed: {inputblob.name}")

# Deploy a containerized application to AKS

# Step 1: Create AKS Cluster
az aks create \
  --resource-group elearncourses-rg \
  --name elearn-aks-cluster \
  --node-count 3 \
  --node-vm-size Standard_DS2_v2 \
  --enable-addons monitoring \
  --enable-managed-identity \
  --generate-ssh-keys \
  --zones 1 2 3

echo "✅ AKS cluster created (this takes 3-5 minutes)"

# Step 2: Get credentials to connect kubectl to AKS
az aks get-credentials \
  --resource-group elearncourses-rg \
  --name elearn-aks-cluster

# Step 3: Verify cluster connection
kubectl get nodes
kubectl get namespaces

# Step 4: Deploy a web application
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: elearn-webapp
  namespace: default
  labels:
    app: elearn-webapp
    version: "1.0"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: elearn-webapp
  template:
    metadata:
      labels:
        app: elearn-webapp
    spec:
      containers:
      - name: webapp
        image: nginx:alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "250m"
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 15
          periodSeconds: 20
---
apiVersion: v1
kind: Service
metadata:
  name: elearn-webapp-service
spec:
  selector:
    app: elearn-webapp
  type: LoadBalancer
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: elearn-webapp-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: elearn-webapp
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
EOF

# Monitor deployment
kubectl get deployments
kubectl get pods -w
kubectl get service elearn-webapp-service

echo "✅ Application deployed to AKS with auto-scaling"

# Azure Blob Storage Python SDK Examples
# pip install azure-storage-blob azure-identity

from azure.storage.blob import (
    BlobServiceClient,
    BlobClient,
    ContainerClient,
    generate_blob_sas,
    BlobSasPermissions
)
from azure.identity import DefaultAzureCredential
from datetime import datetime, timedelta, timezone
import os
import json

# ── Connection Setup ────────────────────────────────────────
# Method 1: Connection string (development)
connection_string = os.environ.get("AZURE_STORAGE_CONNECTION_STRING")
blob_service_client = BlobServiceClient.from_connection_string(connection_string)

# Method 2: Managed Identity (production — no secrets needed!)
# credential = DefaultAzureCredential()
# account_url = "https://youraccountname.blob.core.windows.net"
# blob_service_client = BlobServiceClient(account_url, credential=credential)

CONTAINER_NAME = "course-content"
STUDENT_CONTAINER = "student-uploads"

# ── Container Management ────────────────────────────────────
def create_container_if_not_exists(client, container_name, public_access=None):
    """Create a blob container with optional public access"""
    try:
        container_client = client.create_container(
            container_name,
            public_access=public_access
        )
        print(f"✅ Container created: {container_name}")
        return container_client
    except Exception as e:
        if "ContainerAlreadyExists" in str(e):
            print(f"ℹ️  Container already exists: {container_name}")
            return client.get_container_client(container_name)
        raise

# Create containers
course_container = create_container_if_not_exists(
    blob_service_client, CONTAINER_NAME
)
student_container = create_container_if_not_exists(
    blob_service_client, STUDENT_CONTAINER
)

# ── Upload Operations ────────────────────────────────────────
def upload_course_material(container_client, local_file_path, blob_name,
                           metadata=None):
    """Upload course material with metadata tagging"""
    blob_client = container_client.get_blob_client(blob_name)

    default_metadata = {
        "upload_date": datetime.utcnow().strftime("%Y-%m-%d"),
        "uploader": "elearncourses-system",
        "status": "active"
    }
    if metadata:
        default_metadata.update(metadata)

    with open(local_file_path, "rb") as file_data:
        blob_client.upload_blob(
            file_data,
            overwrite=True,
            metadata=default_metadata,
            content_settings={
                'content_type': _get_content_type(local_file_path)
            }
        )

    print(f"✅ Uploaded: {blob_name}")
    return blob_client.url

def _get_content_type(file_path):
    """Determine content type from file extension"""
    ext = os.path.splitext(file_path)[1].lower()
    content_types = {
        '.pdf': 'application/pdf',
        '.mp4': 'video/mp4',
        '.jpg': 'image/jpeg',
        '.png': 'image/png',
        '.json': 'application/json',
        '.txt': 'text/plain'
    }
    return content_types.get(ext, 'application/octet-stream')

# ── Download Operations ─────────────────────────────────────
def download_blob(container_client, blob_name, local_path):
    """Download a blob to local file"""
    blob_client = container_client.get_blob_client(blob_name)
    with open(local_path, "wb") as file:
        download_stream = blob_client.download_blob()
        file.write(download_stream.readall())
    print(f"✅ Downloaded: {blob_name} → {local_path}")

# ── Secure Shared Access Signature (SAS) ───────────────────
def generate_secure_download_url(
    account_name, account_key,
    container_name, blob_name,
    expiry_hours=24
):
    """Generate a time-limited, secure SAS URL for blob access"""
    sas_token = generate_blob_sas(
        account_name=account_name,
        container_name=container_name,
        blob_name=blob_name,
        account_key=account_key,
        permission=BlobSasPermissions(read=True),
        expiry=datetime.now(timezone.utc) + timedelta(hours=expiry_hours)
    )

    url = (f"https://{account_name}.blob.core.windows.net/"
           f"{container_name}/{blob_name}?{sas_token}")

    print(f"🔗 Secure URL (valid {expiry_hours}h): {url[:80]}...")
    return url

# ── List and Search Blobs ───────────────────────────────────
def list_course_materials(container_client, prefix=None):
    """List all blobs with optional prefix filter"""
    print(f"\n📂 Course Materials in '{container_client.container_name}':")
    total_size = 0
    count = 0

    for blob in container_client.list_blobs(name_starts_with=prefix):
        size_mb = blob.size / (1024 * 1024)
        print(f"  📄 {blob.name}")
        print(f"     Size: {size_mb:.2f} MB | "
              f"Modified: {blob.last_modified.strftime('%Y-%m-%d %H:%M')}")
        total_size += blob.size
        count += 1

    print(f"\n  Total: {count} files | "
          f"{total_size/(1024*1024):.2f} MB")
    return count

# ── Lifecycle Management ────────────────────────────────────
def configure_lifecycle_policy(blob_service_client, account_name):
    """
    Configure automatic tiering and deletion policies.
    Reduces storage costs by automatically moving data to cheaper tiers.
    """
    policy = {
        "rules": [
            {
                "name": "move-to-cool-after-30-days",
                "enabled": True,
                "type": "Lifecycle",
                "definition": {
                    "filters": {"blobTypes": ["blockBlob"],
                                "prefixMatch": ["course-content/"]},
                    "actions": {
                        "baseBlob": {
                            "tierToCool": {"daysAfterModificationGreaterThan": 30},
                            "tierToArchive": {"daysAfterModificationGreaterThan": 180},
                            "delete": {"daysAfterModificationGreaterThan": 730}
                        }
                    }
                }
            }
        ]
    }
    print("✅ Lifecycle policy configured for automatic cost optimization")
    return policy

print("\n🎉 Azure Blob Storage SDK examples loaded successfully!")

# Complete Azure Networking Setup

# ── Create a Multi-Tier Network Architecture ───────────────
RESOURCE_GROUP="elearncourses-network-rg"
LOCATION="eastus"
VNET_NAME="elearn-vnet"

# Create Resource Group
az group create --name $RESOURCE_GROUP --location $LOCATION

# Create VNet with address space
az network vnet create \
  --resource-group $RESOURCE_GROUP \
  --name $VNET_NAME \
  --address-prefixes 10.0.0.0/16 \
  --location $LOCATION

# Create Subnets for each tier
# Web Tier (public-facing)
az network vnet subnet create \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name web-subnet \
  --address-prefix 10.0.1.0/24

# Application Tier (private)
az network vnet subnet create \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name app-subnet \
  --address-prefix 10.0.2.0/24

# Database Tier (most restricted)
az network vnet subnet create \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name db-subnet \
  --address-prefix 10.0.3.0/24

echo "✅ 3-tier VNet architecture created"

# ── Network Security Groups (NSG) ──────────────────────────
# NSG for Web Tier — allow HTTP/HTTPS from internet
az network nsg create \
  --resource-group $RESOURCE_GROUP \
  --name web-nsg

az network nsg rule create \
  --resource-group $RESOURCE_GROUP \
  --nsg-name web-nsg \
  --name allow-https \
  --priority 100 \
  --source-address-prefixes Internet \
  --destination-port-ranges 443 \
  --access Allow --protocol Tcp

az network nsg rule create \
  --resource-group $RESOURCE_GROUP \
  --nsg-name web-nsg \
  --name allow-http \
  --priority 110 \
  --source-address-prefixes Internet \
  --destination-port-ranges 80 \
  --access Allow --protocol Tcp

# NSG for Database Tier — only allow from App Tier
az network nsg create \
  --resource-group $RESOURCE_GROUP \
  --name db-nsg

az network nsg rule create \
  --resource-group $RESOURCE_GROUP \
  --nsg-name db-nsg \
  --name allow-from-app-tier \
  --priority 100 \
  --source-address-prefixes 10.0.2.0/24 \
  --destination-port-ranges 1433 5432 3306 \
  --access Allow --protocol Tcp

az network nsg rule create \
  --resource-group $RESOURCE_GROUP \
  --nsg-name db-nsg \
  --name deny-all-other \
  --priority 4000 \
  --source-address-prefixes "*" \
  --destination-port-ranges "*" \
  --access Deny

echo "✅ Network Security Groups configured"

# ── Azure Application Gateway (Layer 7 Load Balancer) ──────
# Application Gateway provides WAF, SSL termination, URL routing
az network application-gateway create \
  --resource-group $RESOURCE_GROUP \
  --name elearn-app-gateway \
  --location $LOCATION \
  --sku WAF_v2 \
  --capacity 2 \
  --vnet-name $VNET_NAME \
  --subnet web-subnet \
  --frontend-port 443 \
  --http-settings-port 80 \
  --http-settings-protocol Http \
  --public-ip-address elearn-gateway-ip

echo "✅ Application Gateway with WAF created"

# ── Azure Private Link ──────────────────────────────────────
# Access Azure PaaS services privately (no public internet)
az network vnet subnet update \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name db-subnet \
  --disable-private-endpoint-network-policies true

echo "✅ Private endpoint policies configured for DB subnet"

# Create a DNS zone and add records
az network dns zone create \
  --resource-group $RESOURCE_GROUP \
  --name "elearncourses.com"

# Add A record (domain → IP address)
az network dns record-set a add-record \
  --resource-group $RESOURCE_GROUP \
  --zone-name "elearncourses.com" \
  --record-set-name "@" \
  --ipv4-address "20.50.100.200"

# Add CNAME record (www → root domain)
az network dns record-set cname set-record \
  --resource-group $RESOURCE_GROUP \
  --zone-name "elearncourses.com" \
  --record-set-name "www" \
  --cname "elearncourses.com"

# Add MX record for email
az network dns record-set mx add-record \
  --resource-group $RESOURCE_GROUP \
  --zone-name "elearncourses.com" \
  --record-set-name "@" \
  --exchange "mail.elearncourses.com" \
  --preference 10

echo "✅ DNS zone configured for elearncourses.com"

# Azure SQL Database — Python Connection and Operations
# pip install pyodbc azure-identity

import pyodbc
import os
from contextlib import contextmanager
from azure.identity import DefaultAzureCredential
import struct

class AzureSQLDatabase:
    """
    Production-grade Azure SQL Database connection manager
    Uses Azure Managed Identity for passwordless authentication
    """

    def __init__(self, server, database):
        self.server = server
        self.database = database
        self.driver = "{ODBC Driver 18 for SQL Server}"

    def get_connection_string(self):
        """Build connection string"""
        return (
            f"DRIVER={self.driver};"
            f"SERVER={self.server};"
            f"DATABASE={self.database};"
            f"Authentication=ActiveDirectoryMsi;"
            f"Encrypt=yes;"
            f"TrustServerCertificate=no;"
        )

    @contextmanager
    def get_connection(self):
        """Context manager for database connections"""
        conn = None
        try:
            conn = pyodbc.connect(self.get_connection_string())
            conn.autocommit = False
            yield conn
            conn.commit()
        except Exception as e:
            if conn:
                conn.rollback()
            raise
        finally:
            if conn:
                conn.close()

    def initialize_schema(self):
        """Create eLearning platform database schema"""
        with self.get_connection() as conn:
            cursor = conn.cursor()

            # Create tables
            cursor.execute("""
                CREATE TABLE IF NOT EXISTS Courses (
                    CourseId      INT IDENTITY(1,1) PRIMARY KEY,
                    Title         NVARCHAR(200)  NOT NULL,
                    Description   NVARCHAR(MAX),
                    Category      NVARCHAR(100)  NOT NULL,
                    Level         NVARCHAR(50)   NOT NULL
                                  CHECK (Level IN ('Beginner','Intermediate','Advanced')),
                    Price         DECIMAL(10,2)  NOT NULL DEFAULT 0,
                    InstructorId  INT            NOT NULL,
                    IsPublished   BIT            NOT NULL DEFAULT 0,
                    CreatedAt     DATETIME2      NOT NULL DEFAULT GETUTCDATE(),
                    UpdatedAt     DATETIME2      NOT NULL DEFAULT GETUTCDATE()
                )
            """)

            cursor.execute("""
                CREATE TABLE IF NOT EXISTS Students (
                    StudentId     INT IDENTITY(1,1) PRIMARY KEY,
                    Email         NVARCHAR(255)  NOT NULL UNIQUE,
                    FullName      NVARCHAR(200)  NOT NULL,
                    Country       NVARCHAR(100),
                    JoinedAt      DATETIME2      NOT NULL DEFAULT GETUTCDATE()
                )
            """)

            cursor.execute("""
                CREATE TABLE IF NOT EXISTS Enrollments (
                    EnrollmentId  INT IDENTITY(1,1) PRIMARY KEY,
                    StudentId     INT            NOT NULL
                                  REFERENCES Students(StudentId),
                    CourseId      INT            NOT NULL
                                  REFERENCES Courses(CourseId),
                    EnrolledAt    DATETIME2      NOT NULL DEFAULT GETUTCDATE(),
                    CompletedAt   DATETIME2,
                    Progress      DECIMAL(5,2)   NOT NULL DEFAULT 0
                                  CHECK (Progress BETWEEN 0 AND 100),
                    UNIQUE (StudentId, CourseId)
                )
            """)

            print("✅ Database schema initialized successfully")

    def get_course_analytics(self):
        """Query comprehensive course performance analytics"""
        with self.get_connection() as conn:
            cursor = conn.cursor()
            cursor.execute("""
                SELECT
                    c.Title                                     AS CourseName,
                    c.Category,
                    c.Level,
                    c.Price,
                    COUNT(e.EnrollmentId)                       AS TotalEnrollments,
                    COUNT(e.CompletedAt)                        AS Completions,
                    ROUND(
                        COUNT(e.CompletedAt) * 100.0
                        / NULLIF(COUNT(e.EnrollmentId), 0), 1
                    )                                           AS CompletionRatePct,
                    ROUND(AVG(e.Progress), 1)                   AS AvgProgress,
                    SUM(c.Price)                                AS TotalRevenue
                FROM Courses c
                LEFT JOIN Enrollments e ON c.CourseId = e.CourseId
                WHERE c.IsPublished = 1
                GROUP BY c.CourseId, c.Title, c.Category,
                         c.Level, c.Price
                HAVING COUNT(e.EnrollmentId) > 0
                ORDER BY TotalEnrollments DESC
            """)
            columns = [col[0] for col in cursor.description]
            results = [dict(zip(columns, row)) for row in cursor.fetchall()]
            return results
# Usage example
db = AzureSQLDatabase(
    server="elearn-sql-server.database.windows.net",
    database="elearncourses-db"
)
analytics = db.get_course_analytics()
print(f"Retrieved analytics for {len(analytics)} courses")

# Azure AD and RBAC Configuration

# Create an Azure AD user
az ad user create \
  --display-name "John Developer" \
  --user-principal-name "john.developer@elearncourses.onmicrosoft.com" \
  --password "SecureP@ssword123!" \
  --force-change-password-next-sign-in true

# Create a custom RBAC role
cat <<EOF > custom-role.json
{
  "Name": "eLearning Developer Role",
  "Description": "Can read Azure resources and deploy to dev environment only",
  "IsCustom": true,
  "Actions": [
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Web/sites/read",
    "Microsoft.Web/sites/write",
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Sql/servers/databases/read"
  ],
  "NotActions": [
    "Microsoft.Authorization/*/Delete",
    "Microsoft.Authorization/*/Write"
  ],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/{subscription-id}/resourceGroups/elearncourses-dev-rg"
  ]
}
EOF

az role definition create --role-definition custom-role.json
echo "✅ Custom RBAC role created"

# Assign role to user
az role assignment create \
  --assignee "john.developer@elearncourses.onmicrosoft.com" \
  --role "eLearning Developer Role" \
  --scope "/subscriptions/{subscription-id}/resourceGroups/elearncourses-dev-rg"

echo "✅ Role assigned to John Developer"

# Enable MFA (via Conditional Access Policy)
# This is typically done via Portal or Microsoft Graph API
echo "📋 Remember to enable MFA via Conditional Access policies in Azure Portal"

# Azure Key Vault — Secrets Management
az keyvault create \
  --name elearn-key-vault \
  --resource-group elearncourses-rg \
  --location eastus \
  --enable-rbac-authorization true \
  --enable-soft-delete true \
  --retention-days 90

# Store secrets securely
az keyvault secret set \
  --vault-name elearn-key-vault \
  --name "DatabaseConnectionString" \
  --value "Server=elearn-sql.database.windows.net;Database=elearn-db;"

az keyvault secret set \
  --vault-name elearn-key-vault \
  --name "StorageAccountKey" \
  --value "your-storage-account-key"

# Retrieve a secret
DB_CONNECTION=$(az keyvault secret show \
  --vault-name elearn-key-vault \
  --name "DatabaseConnectionString" \
  --query value -o tsv)

echo "✅ Key Vault configured — secrets stored securely"
echo "🔐 Applications access secrets via Managed Identity (no passwords in code)"

# azure-pipelines.yml — Complete CI/CD Pipeline
# Builds, tests, and deploys a Python web application to Azure App Service

trigger:
  branches:
    include:
      - main
      - develop
  paths:
    exclude:
      - README.md
      - docs/*

pr:
  branches:
    include:
      - main

variables:
  pythonVersion: '3.11'
  azureSubscription: 'elearncourses-azure-connection'
  appServiceName: 'elearncourses-webapp'
  resourceGroup: 'elearncourses-rg'
  artifactName: 'elearncourses-app'

stages:
  # ── Stage 1: Build and Test ─────────────────────────────
  - stage: BuildAndTest
    displayName: '🔨 Build and Test'
    jobs:
      - job: BuildJob
        displayName: 'Build, Lint, and Test'
        pool:
          vmImage: 'ubuntu-latest'

        steps:
          - task: UsePythonVersion@0
            inputs:
              versionSpec: '$(pythonVersion)'
            displayName: '🐍 Set Python $(pythonVersion)'

          - script: |
              python -m pip install --upgrade pip
              pip install -r requirements.txt
              pip install pytest pytest-cov flake8 bandit safety
            displayName: '📦 Install dependencies'

          - script: |
              echo "🔍 Running code linting..."
              flake8 . --max-line-length=100 \
                       --exclude=.git,__pycache__,venv \
                       --statistics
            displayName: '✨ Lint with flake8'
            continueOnError: false

          - script: |
              echo "🔒 Running security scan..."
              bandit -r . -x ./tests -ll
              safety check
            displayName: '🛡️ Security scan'
            continueOnError: true

          - script: |
              echo "🧪 Running unit tests with coverage..."
              pytest tests/ \
                --cov=app \
                --cov-report=xml:coverage.xml \
                --cov-report=html:htmlcov \
                --junitxml=test-results.xml \
                --tb=short \
                -v
            displayName: '🧪 Run tests'

          - task: PublishTestResults@2
            inputs:
              testResultsFormat: 'JUnit'
              testResultsFiles: 'test-results.xml'
              testRunTitle: 'Unit Tests — $(Build.BuildNumber)'
            displayName: '📊 Publish test results'

          - task: PublishCodeCoverageResults@1
            inputs:
              codeCoverageTool: 'Cobertura'
              summaryFileLocation: 'coverage.xml'
              reportDirectory: 'htmlcov'
            displayName: '📈 Publish code coverage'

          - task: ArchiveFiles@2
            inputs:
              rootFolderOrFile: '$(System.DefaultWorkingDirectory)'
              includeRootFolder: false
              archiveType: 'zip'
              archiveFile: '$(Build.ArtifactStagingDirectory)/$(artifactName).zip'
              replaceExistingArchive: true
            displayName: '📦 Archive application'

          - task: PublishPipelineArtifact@1
            inputs:
              targetPath: '$(Build.ArtifactStagingDirectory)/$(artifactName).zip'
              artifact: '$(artifactName)'
            displayName: '🚀 Publish artifact'

  # ── Stage 2: Deploy to Staging ──────────────────────────
  - stage: DeployStaging
    displayName: '🚀 Deploy to Staging'
    dependsOn: BuildAndTest
    condition: >
      and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))
    jobs:
      - deployment: DeployToStaging
        displayName: 'Deploy to Staging Slot'
        environment: 'staging'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebApp@1
                  inputs:
                    azureSubscription: '$(azureSubscription)'
                    appType: 'webAppLinux'
                    appName: '$(appServiceName)'
                    deployToSlotOrASE: true
                    resourceGroupName: '$(resourceGroup)'
                    slotName: 'staging'
                    package: '$(Pipeline.Workspace)/$(artifactName)/$(artifactName).zip'
                  displayName: '🌐 Deploy to staging slot'

  # ── Stage 3: Deploy to Production ───────────────────────
  - stage: DeployProduction
    displayName: '🎯 Deploy to Production'
    dependsOn: BuildAndTest
    condition: >
      and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployToProduction
        displayName: 'Deploy to Production'
        environment: 'production'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebApp@1
                  inputs:
                    azureSubscription: '$(azureSubscription)'
                    appType: 'webAppLinux'
                    appName: '$(appServiceName)'
                    package: '$(Pipeline.Workspace)/$(artifactName)/$(artifactName).zip'
                    startUpCommand: 'gunicorn --bind=0.0.0.0 --timeout 600 app:app'
                  displayName: '🎯 Deploy to production'

                - task: AzureAppServiceManage@0
                  inputs:
                    azureSubscription: '$(azureSubscription)'
                    Action: 'Restart Azure App Service'
                    WebAppName: '$(appServiceName)'
                  displayName: '🔄 Restart App Service'

# Set up comprehensive monitoring

# Create Log Analytics Workspace
az monitor log-analytics workspace create \
  --resource-group elearncourses-rg \
  --workspace-name elearn-log-workspace \
  --location eastus \
  --sku PerGB2018 \
  --retention-time 90

# Create Application Insights for web app monitoring
az monitor app-insights component create \
  --app elearncourses-insights \
  --location eastus \
  --resource-group elearncourses-rg \
  --workspace elearn-log-workspace \
  --kind web

# Create metric alert — alert when CPU > 85%
az monitor metrics alert create \
  --name "High-CPU-Alert" \
  --resource-group elearncourses-rg \
  --scopes "/subscriptions/{sub-id}/resourceGroups/elearncourses-rg/providers/Microsoft.Web/sites/elearncourses-webapp" \
  --condition "avg Percentage CPU > 85" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --severity 2 \
  --description "CPU utilization exceeded 85% — investigate and consider scaling"

# Create log alert — detect application errors
az monitor scheduled-query create \
  --resource-group elearncourses-rg \
  --name "Application-Error-Alert" \
  --scopes "/subscriptions/{sub-id}/resourceGroups/elearncourses-rg/providers/microsoft.insights/components/elearncourses-insights" \
  --condition-query "exceptions | where timestamp > ago(5m) | summarize count()" \
  --condition-threshold 10 \
  --condition-operator GreaterThan \
  --evaluation-frequency 5m \
  --window-size 5m \
  --severity 1 \
  --description "More than 10 exceptions in the last 5 minutes"

echo "✅ Monitoring and alerting configured"

# Cost Management best practices

# Set a budget with alert
az consumption budget create \
  --budget-name "Monthly-Dev-Budget" \
  --amount 500 \
  --time-grain Monthly \
  --time-period-start 2025-01-01 \
  --time-period-end 2025-12-31 \
  --category Cost \
  --notifications '[
    {
      "enabled": true,
      "operator": "GreaterThan",
      "threshold": 80,
      "contactEmails": ["admin@elearncourses.com"],
      "thresholdType": "Actual"
    },
    {
      "enabled": true,
      "operator": "GreaterThan",
      "threshold": 100,
      "contactEmails": ["admin@elearncourses.com"],
      "thresholdType": "Forecasted"
    }
  ]'

echo "✅ Budget alert set — notifications at 80% actual and 100% forecasted"

# Tag all resources for cost tracking
az tag create --resource-id "/subscriptions/{sub-id}/resourceGroups/elearncourses-rg" \
  --tags Environment=Production Project=eLearnCourses CostCenter=Engineering

echo "✅ Resources tagged for cost allocation reporting"

AZ-900 (Fundamentals)
    ↓
AZ-104 (Administrator) OR AZ-204 (Developer)
    ↓
AZ-305 (Solutions Architect)