01Owns
Choosing the hosting model
Matches each workload to App Service, Functions, Container Apps or AKS based on scaling, cold starts, networking and the team that will run it.
Hire · Microsoft cloud
Hire Azure Developers
Senior Azure developers who become part of your engineering group and run applications on Microsoft’s cloud: App Service and Azure Functions, containers on AKS or Container Apps, Entra ID sign-in and secrets in Key Vault. Shortlisted developers have deployed a small service with Bicep and a managed identity in a paid trial.
Trial deploys with Bicep and managed identity
Senior and lead levels only
Works in your tenant, subscriptions and pipelines
On your team
What an Azure developer owns on your team.
02Owns
Entra ID integration
Implements sign-in with MSAL, app registrations, scopes and app roles, and uses managed identities so code never holds a connection secret.
03Owns
Bicep templates
Describes resources in Bicep modules with parameters per environment, and deploys them through what-if previews before changes land.
04Owns
Pipelines into Azure
Builds Azure DevOps or GitHub Actions workflows with workload identity federation, deployment slots and approvals for production.
05Owns
Data and messaging services
Uses Azure SQL, Cosmos DB, Service Bus and Storage with sensible partitioning, retry policies and private endpoints.
Azure fluency is mostly about identity
Many developers can deploy a web app to Azure. Fewer can explain why their app should call Key Vault with a managed identity, what scope the role assignment needs and how that changes between subscriptions. Identity mistakes are the ones that turn into security findings, so test for them first.
Ask candidates how their last Azure service authenticated to its database. If the answer involves a password in app settings, probe further before moving on.
Vetting
Skills we test before an Azure developer joins.
01Tested
Azure Functions
Triggers and bindings, Durable Functions for long workflows, hosting plan trade-offs and avoiding cold-start surprises on the consumption plan.
02Tested
Identity on Azure
Managed identities, RBAC role assignments at the right scope, token acquisition with MSAL and Conditional Access implications for apps.
03Tested
Bicep and ARM
Modules, parameter files, what-if deployments, existing resource references and migrating older ARM JSON to readable Bicep.
04Tested
Containers on Azure
Azure Container Registry, Container Apps revisions and scaling rules, and AKS basics such as node pools and workload identity.
05Tested
Observability with Azure Monitor
Application Insights instrumentation, KQL queries over Log Analytics and alerts tied to service-level symptoms.
06Tested
.NET or Node on Azure
Productive in at least one of C# or TypeScript, using the Azure SDKs with DefaultAzureCredential rather than hand-built auth.
Work sample
How the Azure developer work sample runs.
- 01Step 1
Remove a stored secret
The candidate gets a Function app reading a storage connection string from settings and switches it to a managed identity with the narrowest RBAC role.
- 02Step 2
Deploy with Bicep
They write a Bicep module for an App Service, Key Vault and Application Insights with per-environment parameters, and run what-if. The hours are paid.
- 03Step 3
Wire up a pipeline
They configure a GitHub Actions or Azure DevOps workflow using federated credentials and a staging slot swap for zero-downtime release.
- 04Step 4
Explain a hosting choice
A short call justifying Functions versus Container Apps for a described workload, aimed at a non-technical budget holder.
Levels
Azure Developers: what changes at each level.
01Level 1
Senior
Builds and operates services inside existing subscriptions, templates and pipelines, and reviews Bicep and application changes from peers.
02Level 2
Lead
Sets hosting standards, identity patterns, template libraries and release gates for the team’s Azure estate.
03Level 3
Azure solutions architect
Designs subscription structure with management groups and Azure Policy, hybrid connectivity and Well-Architected reviews across applications.
Senior, lead or solutions architect
A senior Azure developer fits when subscriptions, templates and pipelines already exist. Pick a lead when each team deploys differently and nobody owns the Bicep library or identity conventions. A solutions architect is the right call for management group design, Azure Policy rollout, hybrid networking or preparing for a Well-Architected review.
Other options
When to hire someone other than an Azure developer.
01Consider
Several clouds or provider-neutral foundations
For landing zones and networking that must work across AWS, Google Cloud and Azure, hire a cloud engineer.
Open register02Consider
Mostly C# application logic
Once hosting is settled and the backlog is business features in C#, a .NET specialist suits it better.
Open register03Consider
CRM-centred work on another platform
If the core system is Salesforce and Azure is only an integration point, start with a Salesforce developer.
Open registerThe hosting decision shapes everything after
App Service, Functions, Container Apps and AKS overlap enough to confuse buyers and different enough to matter. Cold starts, VNet integration, scaling rules and operational burden vary widely. A strong Azure developer can lay out those differences for your specific workload rather than defaulting to whatever they used last.
Where to point the new developer
Start with an audit of secrets: connection strings in settings, service principals with expiring passwords and keys checked into pipelines. Replacing them with managed identities and federated credentials is concrete, low-risk work that teaches the developer your estate quickly.
FAQ
Questions to resolve before the build.
01Do your Azure developers use Bicep or Terraform?
They are vetted on Bicep because it is Azure-native and reads clearly, but most have also used Terraform with the AzureRM provider. They will follow whichever your team already maintains.
02Can an Azure developer work with our Entra ID setup?
Yes. App registrations, scopes, app roles and managed identities are central to the role. They will work with your identity administrators on consent and Conditional Access rather than around them.
03Azure DevOps or GitHub Actions?
Both are common and candidates are tested on at least one. Federated credentials are preferred over stored service principal secrets in either tool.
Works alongside
Roles an Azure developer works best alongside.
01Pair with
.NET developers
For deep application work in ASP.NET Core and Entity Framework while the Azure developer owns hosting and identity.
Open register02Pair with
DevOps engineers
When release engineering, on-call and observability span more than the Azure-hosted services.
Open register03Pair with
Data analysts
To build Power BI reporting on top of Azure SQL or Synapse data the developer exposes.
Open registerProduct delivery
Need the whole product built instead?
Primary sources
References behind this page
Dated official documentation, standards, and research that support the factual claims on this page.
- 01Microsoft Learn: What are managed identities for Azure resources?
How Azure services authenticate without stored credentials.
- 02Microsoft Learn: What is Bicep?
Official introduction to Azure’s declarative infrastructure language.
How to read this page
Scope, cost and timeline figures are planning guidance until confirmed in a written proposal. Diagrams and screens are illustrations, not client deliverables, and source-code rights and handover follow the signed agreement. See the delivery process and the full disclaimer.
Next decision
Turn the brief into an accepted product scope.
Define outcomes, constraints, evidence, rights and handover before delivery begins.
Commercial rights, repositories, environments, documentation, acceptance and handover remain contract-defined.