Multi-Cloud Strategies with Azure

Multi-cloud means operating workloads across more than one cloud provider — for example, using Azure for most services while also using AWS for a specific machine learning platform or Google Cloud for BigQuery analytics. Organisations adopt multi-cloud to: avoid vendor lock-in, leverage each provider's best-in-class services, meet contractual or regulatory requirements to avoid single-provider dependency, or because mergers and acquisitions brought together companies that standardised on different clouds. Multi-cloud is the norm in large enterprises today.

Multi-cloud introduces significant operational challenges: Skill sprawl — teams need expertise in multiple cloud platforms. Inconsistent governance — each cloud has different IAM, policy, and compliance tooling. Security complexity — different threat models, different security services, different audit logs. Cost management — separate billing portals, different pricing units, and no unified cost view across providers. Network complexity — inter-cloud traffic incurs egress costs and latency. Microsoft addresses many of these with Azure Arc and multi-cloud support in Defender for Cloud.

The same Azure Arc connected machine agent that onboards on-premises servers also works on VMs running in AWS EC2, Google Cloud Compute Engine, or any other cloud. Once registered with Arc, these VMs appear alongside Azure-native resources in the ARM portal. You can apply Azure Policy, use Azure Monitor with the same KQL queries, and view Defender for Cloud security recommendations for AWS and GCP VMs — without leaving the Azure portal or learning AWS-specific tooling.

Microsoft Defender for Cloud supports native connectors for AWS and Google Cloud Platform. By connecting your AWS account or GCP project, Defender for Cloud can assess the security posture of EC2 instances, S3 buckets, RDS databases, and GCP resources using the same Secure Score framework it uses for Azure. It maps findings to standards like CIS AWS Foundations Benchmark and detects misconfigurations (publicly accessible S3 buckets, overly permissive IAM roles) alongside Azure recommendations in one dashboard.

Azure Cost Management + Billing can ingest AWS costs by connecting your AWS Cost and Usage Report (CUR) to an Azure Connector. This surfaces AWS spend alongside Azure spend in a unified cost analysis view, enabling cross-cloud cost comparisons and allocation. You can create budgets and alerts that span both providers and apply the same tagging strategy for showback/chargeback. This multi-cloud cost visibility is valuable for FinOps teams managing spend across several providers from a single pane.

Many multi-cloud strategies use Kubernetes as the abstraction layer that runs identically on any cloud. AKS on Azure, EKS on AWS, and GKE on GCP all run standard Kubernetes. Azure Arc-enabled Kubernetes can manage all of them from Azure, applying GitOps-based deployments and Azure Policy (OPA Gatekeeper) consistently. Container images stored in Azure Container Registry can be pulled from any cloud's Kubernetes cluster, making Azure ACR a natural multi-cloud image registry hub.

An Azure Landing Zone is a pre-configured environment that implements governance, identity, security, and networking best practices. When adopting multi-cloud, organisations extend the landing zone concept to define standards that apply across all providers. The Microsoft Cloud Adoption Framework (CAF) includes multi-cloud guidance for how to structure management group hierarchies, naming conventions, and tagging strategies that work consistently whether the resource lives in Azure, AWS, or on-premises.

Connecting Azure and AWS (or GCP) workloads requires inter-cloud networking. Common patterns: VPN tunnels between Azure VPN Gateway and an AWS Virtual Private Gateway or GCP VPN — straightforward but limited bandwidth and latency variability. Third-party SD-WAN (e.g. Megaport, Equinix Fabric) — creates private cross-cloud circuits similar to ExpressRoute. Application-layer integration — services communicate over HTTPS through public endpoints (the simplest option but uses the internet). Egress bandwidth costs in AWS and GCP make high-volume inter-cloud data transfer expensive.

Microsoft Entra ID can serve as the identity provider (IdP) for multi-cloud access. For AWS, you can configure Entra ID as the SAML 2.0 IdP for AWS IAM Identity Center, enabling users to access the AWS console with their Entra ID credentials and MFA — without separate AWS IAM users. For GCP, a similar federation is possible. This centralises identity governance — joiners, movers, and leavers are managed in Entra ID, and access propagates to all cloud providers automatically.

FinOps (Cloud Financial Operations) practices become more complex in multi-cloud because each provider has different pricing models, discount mechanisms, and billing granularity. Best practices: standardise tagging across all providers for cost allocation; use Azure Cost Management + Billing's AWS connector for unified visibility; establish a FinOps team that understands Reserved Instances (Azure), Savings Plans (AWS/Azure), and Committed Use Discounts (GCP); and conduct regular cross-provider cost reviews comparing the cost of equivalent workloads.

Multi-cloud can create problems if not managed carefully. Common anti-patterns to avoid: Accidental multi-cloud — using multiple clouds without a strategy leads to uncontrolled sprawl and cost. Skill overstretch — requiring all engineers to be expert in every cloud; designate cloud owners per platform instead. Inconsistent security — applying different security baselines per cloud; use Azure Arc and Defender for Cloud to enforce consistency. Ignoring egress costs — inter-cloud data transfer is charged at provider egress rates and can surprise FinOps teams.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure Arc extends Azure management to AWS and GCP VMs using the same connected machine agent, Microsoft Defender for Cloud multi-cloud connectors surface cross-provider security findings in a unified Secure Score, and Microsoft Entra ID federation enables single-sign-on to AWS and GCP consoles from one corporate identity. This completes the Azure Hybrid and Multi-Cloud course — next up is the Well-Architected Framework to evaluate and improve your Azure architectures.