Public, private and hybrid clouds

Not everything at Harrow & Finch can move at once, and some things may never move. The warehouse management system, for example, talks to scanners and conveyor controllers on the distribution centre floor; if the network link to head office drops, the warehouse must keep shipping. At the cloud lunch on September 22, Renata asks the group to sort the company's systems into three piles: those that could live entirely in a public cloud, those that must stay in the company's own buildings, and those that need a foot in both. The piles correspond to three cloud models: public, private and hybrid.

Public cloud

A public cloud is owned and operated by a provider, such as Microsoft, that sells services to many customers over the internet. The provider owns the buildings, hardware and network, and customers share that infrastructure while being isolated from one another. Customers do not buy equipment; they consume services and pay for what they use. Azure, Amazon Web Services and Google Cloud are public clouds.

Public clouds offer the widest choice of services and the fastest way to get started. A customer can use services in dozens of locations worldwide without building anything. The trade-off is control: the customer cannot choose the hardware, visit the data centre or change how the provider runs the platform. For most organizations and most workloads, that trade-off is worth making, but it means the customer must be comfortable with the provider's security, compliance and location options.

Private cloud

A private cloud is cloud infrastructure used by a single organization. It may sit in the organization's own data centre or be hosted for it by a third party, but no one else shares it. A private cloud is more than a server room: it offers the cloud characteristics from lesson 1, such as self-service, pooled resources and elasticity, to the organization's own departments. A university might run a private cloud from which researchers request virtual machines through a portal, for example.

Private clouds give the most control. The organization chooses the hardware, the location and every security setting, which can matter for regulated data or for workloads that need special hardware. They also cost the most. The organization buys and maintains all the equipment, pays for the space and power, and must have the staff to run the platform. Its capacity is limited to what it has bought, so it loses the near-unlimited scale of a public cloud.

Hybrid cloud

A hybrid cloud combines a public cloud and a private cloud or on-premises environment, connected so that workloads and data can move between them or work together. Most large organizations end up with a hybrid environment, at least for some years. Some workloads move to the public cloud, some stay on premises, and the two are linked by a secure network connection and shared identity and management tools.

Hybrid arrangements suit organizations that want public cloud benefits but cannot move everything. Common reasons to keep something on premises include low-latency needs on a factory or warehouse floor, older software that a vendor will not support in the cloud, data that rules or contracts require to stay in a particular place, and recent hardware investments that still have years of useful life. Hybrid setups also let an organization burst into the public cloud when on-premises capacity runs out, or use the cloud for backup and disaster recovery while production stays at home.

Multicloud

A fourth term often appears alongside these: multicloud. A multicloud organization uses two or more public cloud providers, for example Azure for most workloads and another provider for a particular analytics service. Organizations end up multicloud for many reasons: a company they acquired used a different provider, a software vendor only runs on one platform, or they want to avoid depending on a single provider. Multicloud adds flexibility but also complexity, because each provider has its own tools, skills and billing. Harrow & Finch is not multicloud today, though its e-commerce platform vendor runs part of its service on another provider.

Use cases: matching workloads to models

Renata's three piles end up looking like this. The public cloud pile includes the website, which has very uneven traffic; new projects such as the loyalty app rebuild; file shares; and reporting. The on-premises pile holds the warehouse floor systems, which must keep working if the internet link fails, and the store tills, which are physical devices in each store. The hybrid pile includes StockLine, which will move to Azure but must exchange data with the warehouse system and the tills, and the company's identity system, which already spans the on-premises Active Directory and Microsoft Entra ID in the cloud.

Questions to ask when choosing a model

Renata gives the team five questions to ask about each workload before choosing where it belongs. They are not part of the exam outline, but they explain the use cases the exam describes.

• Where are the users, and how sensitive is the workload to delay? Systems used on a factory or warehouse floor, where a few hundred milliseconds matter, may need to stay close to the equipment.
• What happens if the network link to the cloud fails? A store that cannot reach the cloud still needs to sell; a head office report can wait.
• Are there rules about where the data can be stored, or who can operate the infrastructure? Some contracts and regulations require particular locations or screened staff.
• Will the vendor support the software in the cloud? Many vendors now certify their products on Azure, but some older products are supported only on specific hardware.
• What has already been spent? A storage array bought last year may be worth using until it is due for replacement, even if the long-term plan is the public cloud.

For most of Harrow & Finch's systems, the answers point to the public cloud. For the warehouse floor and the store tills, they point to on-premises equipment that is connected to and managed from Azure. That combination, mostly public cloud with a deliberate on-premises edge, is the most common shape of a hybrid cloud today.

Hybrid is a stage as well as a design

Many organizations are hybrid for a period simply because migration takes time. Harrow & Finch will spend most of 2027 with some systems in Azure and some still in the server room, connected by the VPN described in lesson 10. During that period the two environments must share identities, monitoring and security rules, or the company will end up running two separate IT departments. Renata's plan treats the server room as a temporary on-premises site with an end date, and connects it to Azure Arc so that it can be watched from the same portal as everything else until it is switched off.

How Azure supports hybrid and multicloud

Microsoft offers several tools for organizations that run in more than one place. Azure Arc extends Azure's management to servers, Kubernetes clusters and databases that run outside Azure, whether on premises or in other clouds. A server in Harrow & Finch's distribution centre can be connected to Azure Arc and then appear in the Azure portal, receive Azure policies and be monitored with Azure tools, even though it never leaves the building. MSAZ-102 covers Azure Arc in more detail.

Azure Local, the product formerly called Azure Stack HCI, is a way to run selected Azure services on hardware in the customer's own data centre or branch, managed through Azure. It suits places that need cloud-style services close to where work happens, such as a factory or a hospital. Identity also spans both worlds: Microsoft Entra Connect and Microsoft Entra Cloud Sync synchronize users from an on-premises Active Directory to Microsoft Entra ID, so people use one account everywhere. Harrow & Finch has used this synchronization since it adopted Microsoft 365.

Networking connects the two sides. A site-to-site VPN sends encrypted traffic between an on-premises network and an Azure virtual network over the internet, and ExpressRoute provides a private connection through a connectivity provider. Lesson 10 covers both. Without a reliable link, a hybrid cloud is just two separate environments.

Sovereign and government clouds

Some customers need a cloud that is separate from the global public cloud for legal or security reasons. Microsoft runs sovereign regions for these cases. Azure Government serves United States government agencies and their partners, in data centres operated by screened staff and isolated from the public Azure regions. Azure operated by 21Vianet serves customers in China through a local operator, as Chinese law requires. These clouds look like Azure but are separate instances with their own portals and sometimes a smaller set of services.

Harrow & Finch does not need a sovereign cloud. Its requirement is simpler: company policy says personal information about Canadian customers and employees should stay in Canada. Azure has two Canadian regions, Canada Central in Toronto and Canada East in Quebec City, so the company can meet that policy within the public cloud by choosing where its resources live. PIPEDA itself does not forbid storing personal information outside Canada, but it holds the organization accountable and expects it to tell people when their information may be processed abroad, so keeping data in Canadian regions makes the company's privacy notices simpler.

Choosing the mix

Renata ends the session with a warning about doing hybrid by accident. Every workload left on premises keeps the costs and responsibilities of the server room, and every connection between the two sides is something to secure and monitor. Hybrid should be a deliberate choice for workloads that need it, with a date to revisit the decision, not the default for anything that seems hard to move. The Skylight plan lists each on-premises workload with a reason and a review date.

Theo leaves with a homework task: for each system in the company's inventory, record the model, the reason, and what would need to change for it to move. The list turns out to be useful well beyond the exam. It becomes the first draft of the migration plan.