Skip to content

Learning Paths

Use this page to choose a reading path based on your role and goal. Each path is numbered, so read the pages in order for the best result. Every path ends with a checklist of concrete outcomes you should be able to demonstrate.

Pick one primary path first

If you fit multiple roles, pick the one that matches your current goal, complete that path, then read a second path opportunistically. Trying to follow every path in parallel dilutes progress.

Choose Your Path

Role Goal Time Budget Start With
Beginner Understand VNets, subnets, and basic connectivity 1-2 hours Overview, Networking vs Connectivity
Operator Run day-2 network operations: NSG, DNS, UDR, peering 3-4 hours Scenario Router, Operations Hub
Architect Design hub-spoke, private endpoints, and DNS topology 4-6 hours Platform Hub, Best Practices Hub
Troubleshooter Diagnose connectivity, DNS, and routing failures 2-4 hours + on-call reference Troubleshooting Hub

mermaid flowchart TD A[Start Here] --> B[Platform Concepts] B --> C{Choose your path} C --> D[Beginner: VNet Basics] C --> E[Operator: NSG and DNS] C --> F[Architect: Topology and PE] C --> G[Troubleshooter: Diagnostics] D --> H[Production Readiness] E --> H F --> H G --> H

Beginner Path

Understand what an Azure Virtual Network is, how subnets and addressing work, and how to deploy your first VNet and test basic connectivity.

Time: 1-2 hours

mermaid flowchart TD A[Overview] --> B[Networking vs Connectivity] B --> C[VNet and Subnet Basics] C --> D[IP Addressing] D --> E[First Deploy]

Read in order:

  1. Overview
  2. Networking vs Connectivity
  3. Platform Hub — VNet, subnet, IP addressing, DNS basics
  4. Scenario Router
  5. Reference Hub — glossary and cheatsheets

Outcomes

  • You can explain the difference between a VNet, subnet, and address space.
  • You can deploy a VNet with two subnets via portal or CLI.
  • You can name the four building blocks of Azure networking (VNet, NSG, UDR, DNS).
  • You know where to find CLI reference and a glossary.

Microsoft Learn anchors

Operator Path

Run day-2 network operations: create and manage NSGs and UDRs, configure DNS, wire private endpoints, and set up peering and diagnostics.

Time: 3-4 hours

mermaid flowchart TD A[Common Scenarios] --> B[NSG and UDR Ops] B --> C[DNS Configuration] C --> D[Private Endpoints] D --> E[Peering and Diagnostics]

Read in order:

  1. Scenario Router
  2. Operations Hub — NSG, UDR, DNS, PE, peering, diagnostics
  3. Best Practices Hub — DNS, NSG, PE production patterns
  4. Platform Hub — network security and private connectivity basics
  5. Reference Hub — DNS resolution and routing cheatsheets

Outcomes

  • You can create an NSG rule set that follows least-privilege and log to Log Analytics.
  • You can configure a User-Defined Route table and attach it to a subnet.
  • You can wire a Private Endpoint and validate DNS resolution through the Private DNS Zone.
  • You can capture packets with Network Watcher and interpret the results.

Microsoft Learn anchors

Architect Path

Design hub-spoke or Virtual WAN topology, choose between VNet peering and hybrid connectivity, and define DNS and Private Endpoint strategy before workloads land.

Time: 4-6 hours

mermaid flowchart TD A[Topology Choice] --> B[Hybrid Connectivity] B --> C[Private Endpoints and DNS] C --> D[Load Balancing] D --> E[Production Baseline]

Read in order:

  1. Platform Hub — VNet, DNS, hybrid, load-balancing, private connectivity
  2. Best Practices Hub — network design baseline, subnet design, hybrid, PE
  3. Reference Hub — connectivity decision guide, private connectivity options
  4. Operations Hub — operational implications of topology choices
  5. Troubleshooting Hub — architecture overview and evidence map

Outcomes

  • You can decide between hub-spoke and Virtual WAN for a workload portfolio.
  • You can design a Private DNS Zone strategy for Private Endpoints across VNets and on-prem.
  • You can pick between VPN Gateway, ExpressRoute, and public routing for a hybrid link.
  • You can document subnet sizing, NSG posture, and UDR intent for a new landing zone.

Microsoft Learn anchors

Troubleshooter Path

Diagnose connectivity, DNS, and routing failures on Azure networking. Focuses on evidence-first triage and playbook selection.

Time: 2-4 hours + on-call reference

mermaid flowchart TD A[Symptom Triage] --> B[First 10 Minutes] B --> C[Decision Tree] C --> D[Playbooks] D --> E[Post-Incident Notes]

Read in order:

  1. Troubleshooting Hub
  2. First 10 Minutes runbooks: Connectivity, DNS, Routing
  3. Decision Tree and Mental Model
  4. Playbooks Hub — connectivity, DNS, VPN, load balancer
  5. Reference Hub — DNS resolution and routing cheatsheets

Outcomes

  • You can run the First 10 Minutes runbook for a connectivity, DNS, or routing symptom.
  • You can select the right playbook from a symptom description.
  • You can use Network Watcher connection troubleshoot and packet capture to collect evidence.
  • You can interpret NSG flow logs to prove or refute a security-rule hypothesis.

Microsoft Learn anchors

Track Selection Matrix

Situation Start with Then continue to
First VNet in a subscription Beginner Path Operator Path
Landing-zone design Architect Path Operator Path
Preparing for launch Operator Path Troubleshooter Path
Active incidents Troubleshooter Path Architect Path (hardening)

Urgent outage? Skip the path.

If you are actively debugging a production outage, jump straight to Troubleshooting Hub and the First 10 Minutes runbooks.

See Also

Sources