With the account created and protected, it is time to go in. The Azure portal is the web console from which you view, create and diagnose everything in your subscription. It is where you will spend most of your time in the first few weeks and, honestly, the place most people abandon later: the portal is unbeatable for exploring and diagnosing, but anything repeatable ends up being done with the command line or infrastructure as code.

In this lesson you will learn the anatomy of the portal, you will create Contoso Airlines' first real resources — the rg-contoso-reservas-dev group and a storage account for boarding passes — and you will pick up a set of productivity tricks that save hours.

1. Anatomy of the portal
2. Global search: your main shortcut
3. The dashboard and shared dashboards
4. Blades and the portal workflow
5. Creating a resource step by step: Contoso's resource group
6. Creating the boarding pass storage account
7. All resources: filters, columns and saved views
8. Favorites and menu customization
9. Cloud Shell and the Azure Mobile App
10. Activity history and access to support
11. When to use the portal and when not to
12. Common Mistakes and Tips
13. Exercises
14. Conclusion

You get in at portal.azure.com with the identity you set up in the previous lesson. The screen is divided into five areas:

This is the control that prevents the most mistakes and that most people ignore. It is in the top bar (a filter icon, or inside your profile) and it does two things:

• Switching directory (tenant): if your identity belongs to several tenants — your company, a client, your personal account — this is where you choose which one you are working in. If you "cannot see your resources", you are almost always in the wrong directory.
• Filtering subscriptions: you can limit the view to Contoso Airlines - Desarrollo while you practice, so that production does not even appear in the lists. It is a cheap defense against accidental deletion.

Professional tip: when working in production, leave only the production subscription selected and be consciously alert. Many incidents start with "I thought I was in development".

Every operation you launch (create, delete, modify) generates a notification with its status. Expanding it shows you the error detail if something fails, and there is a very useful link: "Download a template for automation", which shows you the JSON equivalent of what you have just done with clicks. It is an excellent way to learn infrastructure as code (module 5).

The search bar at the top searches simultaneously across:

• Services: type "storage" and it takes you to Storage accounts.
• Specific resources that already exist in your subscriptions (by name).
• Resource groups.
• Documentation and Marketplace.

It is faster than navigating the menu. The keyboard shortcut is the backslash \, or G followed by / (the shortcuts vary; check the portal's help menu, "Keyboard shortcuts" section). Internalize this: in the portal it is almost never worth navigating; you search.

The dashboard is the configurable home page. By default it shows recent resources and links to services, but its real value appears when you design it yourself.

How to build a useful one:

1. On the dashboard, click Edit (or create a new one with New dashboard → Blank dashboard).
2. Drag tiles from the tile gallery: metric charts, resource lists, links, markdown notes.
3. From any chart on a resource you can click Pin to dashboard, which adds it without leaving the resource.
4. Adjust the size and time range of each tile.
5. Save.

This detail surprises a lot of people: a shared dashboard is an Azure resource, with its own ID, its permissions and its location. It can be exported to JSON, versioned in Git and deployed again.

At Contoso: Marta Ríos creates a shared dashboard called Contoso Reservas - Operación, inside rg-contoso-reservas-pro, with the status of the website, database consumption and the error rate. The operations staff have it as their home page. We will add the actual charts when we reach module 7 (Azure Monitor).

A blade is the sliding panel that opens on the right when you select something. The portal stacks blades from left to right, so that you can drill down without losing context: resource group → resource → setting → sub-setting.

Practical points:

• The breadcrumb at the top takes you back to any previous level in one click.
• Every blade has its own URL: you can copy it from the browser and share it with a colleague, and it will open exactly that screen for them (if they have permissions). Very useful during incidents.
• Open in a new tab: Ctrl+click (Cmd+click on macOS) on a resource opens an independent tab. Working with two or three tabs (for example, the website and its database) is far more comfortable than going back and forth.
• Common resource structure: almost every resource has the same sections:

We are going to create the first real resource of the course. A resource group is a logical container; it costs nothing in itself. The full theory is in lesson 01-05; here we create it so that we have somewhere to put things.

1. In the portal menu, click Create a resource (or search for "Resource groups" and use Create).
2. Fill in the Basics tab:

A resource group's region indicates where its metadata is stored, not where the resources it contains must necessarily live: you can have a resource in North Europe inside a group whose region is West Europe. Even so, for consistency, use the same one.

3. Tags tab. Add Contoso's four mandatory tags right now:

4. Review + create. Azure validates the configuration and shows a summary.
5. Create. Within a few seconds, the notifications bell confirms the result.

This flow — Basics → service-specific tabs → Tags → Review + create — is identical for almost every Azure resource. Learn the pattern once and you will know how to create anything.

Now a real resource: the storage account where Contoso will keep its boarding passes in PDF. Here we only create it and check that it works; the concepts of blobs, containers, access tiers and redundancy belong to module 2.

Cost warning: a storage account on the cheapest tier costs cents if you store a few test files, but it is not free. At the end of the lesson you have instructions for deleting it.

1. Create a resource → Storage → Storage account.
2. Basics tab:

About the name, a rule that surprises everybody the first time: storage account names are globally unique across the whole of Azure, 3 to 24 characters, and they only allow lowercase letters and numbers. No hyphens. That is why the convention puts st right up against the name: sttarjetascontosodev. If somebody else in the world has already taken that name, add a suffix (for example sttarjetascontosodev01).

3. Advanced tab: leave the default values, but check two important things:
   • Require secure transfer (HTTPS): it must be enabled.
   • Allow blob public access: it must be disabled. Boarding passes contain personal data; they must never be accessible anonymously. This is exactly the kind of configuration that, under the shared responsibility model (lesson 01-02), is your responsibility, not Microsoft's.
4. Tags tab: the same four tags as the group. Yes, you have to repeat them: tags are not inherited from the resource group. We will look at this in detail in 01-05.
5. Review + create → Create. It takes less than a minute.

Go into the account you created and open Containers → + Container. Create one called tarjetas-embarque with public access level Private (no anonymous access). Upload any test PDF with Upload. You now have your first piece of Contoso data in Azure.

If you did this only to practice, get rid of the cost:

1. Go to the rg-contoso-reservas-dev resource group.
2. Click Delete resource group.
3. Type the exact name to confirm (Azure demands that you type it precisely so that nobody does it by accident).

Deleting the group deletes everything it contains, irreversibly. That is its virtue as a disposable container for exercises, and also its danger in production, which is why resource locks exist (lesson 01-05).

All resources is the inventory view. With twenty resources it is convenient; with two hundred, knowing how to filter it is essential.

• Filters: by subscription, resource group, type, location and — the most powerful one — tag. Filtering by proyecto = contoso-reservas gives you everything belonging to the project, wherever it is.
• Columns: click Manage view → Edit columns to add columns such as Tags, Location or Type. Seeing the propietario tag in the list saves a lot of questions.
• Group by: groups the listing by type or by resource group.
• Saved views: once filters and columns are configured, Manage view → Save view keeps them under a name. Marta Ríos saves two: Producción - todo and Desarrollo - solo cómputo.
• Export to CSV: useful for inventories and for cost reviews with Nuria Peña.

The side menu only shows what you decide it should:

1. Open All services.
2. Find the service and click the star to mark it as a favorite.
3. Reorder by dragging within the menu.

Recommended favorites for this course: Resource groups, All resources, Storage accounts, Virtual machines, App Services, Cost Management, Monitor, Microsoft Entra ID.

In Settings (gear) you can also adjust:

• Language and regional format (important: the regional format changes how dates and currencies are displayed).
• Startup page: dashboard or All resources, depending on how you work.
• Theme and high-contrast options.
• Menu behavior: docked or flyout.
• Sign out on inactivity: configure it if you share a computer. In production it is good practice to leave it at a short value.

• Cloud Shell is the terminal built into the top bar (the >_ icon). It gives you Bash or PowerShell already authenticated with your identity, with nothing to install, and it works from any browser. You will see it in detail in lesson 01-06, including the storage account it needs to create in order to persist your files.
• The Azure Mobile App (iOS and Android) lets you check the status of resources, receive alerts, run basic commands and even open a Cloud Shell from your phone. It is an on-call and lookup tool, not a working tool: nobody designs architectures on a phone. Marta Ríos has it installed to receive availability alerts.

Search for Activity log in the global search box, or open it inside any resource or resource group. It answers the most frequent question during an incident: "who touched this, and when?".

It records control plane operations (creating, modifying, deleting resources), along with who performed them, from which IP, with what result and with the detail in JSON. What it does not record is operations on the data (for example, who downloaded a specific PDF): that requires service-specific diagnostic logs, covered in module 7.

Useful filters: by time range, by severity, by operation and by who initiated it. From here you can also create an alert ("tell me if somebody deletes a resource in production").

You open incidents at Help + support → Create a support request. It is worth knowing that:

• Support for billing and subscription management is included in all plans.
• Technical support requires a paid support plan (Developer, Standard, Professional Direct…), with different response times.
• Before opening a case, the wizard itself offers you automatic diagnostics that resolve many problems.
• Service Health is a separate and very important section: it reports incidents on the Azure platform itself that affect you. Before spending three hours investigating why your application is failing, check whether Microsoft has already declared an incident in your region.

To show you the difference with a concrete example: everything you have just done in sections 5 and 6 — about twenty clicks spread across four screens — is these three lines, which you can also save, review in Git and run again whenever you want (we will study them thoroughly in lesson 01-06):

The sentence to take away: what you do once, do it in the portal; what you will do twice, write it down. The portal does not even argue with you: remember that every creation offers "Download a template for automation", which is literally the portal telling you "that thing you just did with clicks, here it is in code".

• Working in the wrong directory or subscription. Always check the filter at the top before creating or deleting. Filter to a single environment while you practice.
• Looking for services by navigating the menu. Use the global search box; it is several times faster.
• Trying to use uppercase letters or hyphens in the storage account name. Lowercase letters and numbers only, 3-24 characters, unique across the whole of Azure.
• Leaving blob public access enabled. It is the number one cause of data leaks in the cloud. Disable it unless you are deliberately serving public content.
• Creating resources without tags "because I'll add them later". They never get added later. Add them in the Tags tab during creation.
• Believing that the group's tags are inherited. They are not. It is the most repeated conceptual mistake in Azure and we take it apart in lesson 01-05.
• Losing your work by not pinning anything to the dashboard. If you check the same metric every morning, pin it.
• Forgetting resources that are left running. Before closing the browser, review All resources. If it is an exercise, delete the whole group.
• Tip: use Ctrl+click to open resources in new tabs, and keep the URL of the specific blade handy when you ask a colleague for help; you will save them five minutes of navigation.

1. Mark as favorites: Resource groups, All resources, Storage accounts and Cost Management.
2. Create a private dashboard called Contoso - Desarrollo with at least one resource list tile filtered by your resource group.
3. Configure the portal so that the startup page is All resources.
4. Explain in two sentences the difference between a private dashboard and a shared one, and why the shared one consumes permissions from a resource group.

1. Create the rg-contoso-reservas-dev group in West Europe with the four mandatory tags.
2. Create inside it a standard LRS storage account called sttarjetascontosodev (add a numeric suffix if the name is taken), with secure transfer enabled and blob public access disabled.
3. Create a private container tarjetas-embarque and upload a test PDF.
4. Go to All resources, filter by the tag proyecto = contoso-reservas and add the Tags column. Save the view as Contoso - desarrollo.
5. Delete the entire resource group and check in the activity log that the operation appears recorded under your user.

Using your subscription's activity log, answer:

1. How many creation ("Write") operations have occurred in the last 24 hours?
2. Which identity deleted the resource group, and at exactly what time?
3. What information will you not find in the activity log, even though you would need it for a personal data audit?

Solution 1:

1. All services → search for each service → click the star. Reorder by dragging.
2. Dashboard → New dashboard → Blank dashboard, name Contoso - Desarrollo, drag the Resource list tile from the gallery and configure the filter by resource group. Save.
3. Settings (gear) → Appearance + startup views → Startup page → All resources.
4. The private one lives in your user profile and only you see it, from any browser. The shared one is published as an Azure resource inside a resource group: that is why it has its own ID and its RBAC permissions, and anyone with read access on that resource can see it.

Solution 2: the steps are detailed in sections 5 and 6. Verification points:

• The storage account name can only contain lowercase letters and numbers; if Azure rejects it as a duplicate, that is because the namespace is global.
• When filtering by tag in All resources, you should see both the group and the storage account, because you tagged them separately (remember: there is no inheritance).
• Deleting the group requires you to type its exact name; it is a deliberate safeguard.

Solution 3:

1. In the activity log, filter by Timespan: last 24 hours and Operation: Write. The count appears in the listing (you can also group by operation).
2. The Initiated by column shows the identity (your user or a service principal) and the exact timestamp; opening the event shows you the JSON with the source IP.
3. Operations on the data: who downloaded, read or modified a specific PDF inside the container. The activity log covers the control plane (operations on the resource), not the data plane. For that you enable the service's diagnostic logs and send them to Log Analytics (module 7).

You can now find your way around the Azure portal: you know its anatomy (top bar, menu, blades, breadcrumb), you know that the global search box is faster than navigating, that the directory and subscription filter prevents accidents, and that shared dashboards are resources with their own permissions. You have walked through the universal Basics → Tags → Review + create flow and applied it to create Contoso Airlines' first real resources: the rg-contoso-reservas-dev group and the sttarjetascontosodev storage account for boarding passes, with secure transfer enabled and anonymous access disabled. You also know how to clean up what you created so you do not overpay, how to filter and save views in All resources, and where to look when something goes wrong: the activity log and Service Health.

And you take away the idea that shapes the rest of the course: the portal is for exploring and diagnosing; anything repeatable is done with the CLI (lesson 01-06) or with infrastructure as code (lesson 05-06).

We have created a resource group almost without explaining what it really is, we have talked about tags that are not inherited, and we have mentioned that deleting a group deletes everything it contains. It is time to understand the system underneath all of that. In the next lesson, Azure Resource Manager: Subscriptions, Resource Groups and Tags, we will look at the control plane that governs the whole of Azure, the complete hierarchy, the locks that protect production and Contoso Airlines' definitive tagging scheme.