Before your first class, meet the company you are about to spend forty-two classes working for. This is the whole brief on one page — who they are, what you help them build, and every technical word explained in plain English before you ever meet it in a lesson. Read it once now; everything you do afterwards adds up to exactly this.
Campux Retail is a small, seasonal online shop — the kind that sells hard for a few months and goes quiet the rest of the year. It has a physical head office, a website the public buys from, an internal app the staff use, and an old till system (the "point-of-sale", or POS) still running on a computer in the office. Six people run the whole of its technology. That last fact drives every decision: everything they build has to be simple enough for a stranger to understand and safe enough to leave alone, because there is nobody spare to fix it.
The course opens on their worst day. In Class One, two servers in an office closet fail on a busy November Saturday, and the shop goes dark in the one week it cannot afford to. That outage is why Campux moves to the cloud — renting computing from a provider (here, Microsoft Azure) instead of owning servers in a closet. It's also the thread the whole bootcamp pulls on: in Class Thirty-Six the same outage is re-fought, this time handled in twenty-three minutes, because by then you've built the tools to catch it.
Two servers in a closet became a platform.
Each term below gets one plain sentence and the class where you build it. Skim it now; it's here to return to.
| The term | In plain words | You'll build it in |
|---|---|---|
| Cloud · Azure | Renting computers, storage and services over the internet from a provider, instead of owning the hardware. Azure is Microsoft's version. | Class 1–6 |
| Tenant | Your organisation's identity space — the list of who is allowed to sign in. Campux already has one from its Microsoft 365 email. | Class 6–7 |
| Subscription | A billing container. Resources live inside one, and its invoice is what you pay. Campux keeps two — a live one and a testing one. | Class 7 |
| Resource group | A labelled folder for related things, so the whole set can be created — or deleted — in one clean move. | Class 7 |
| Policy · governance | Automatic rules Azure enforces for you — for example "only build in these regions" or "everything must be labelled". Rules that apply themselves. | Class 8 |
| RBAC (roles) | Role-Based Access Control — deciding who is allowed to do what, and where, so people get exactly the access they need and no more. | Class 8 |
| Managed identity | A login for software, so one program can talk to another with no password written down anywhere to leak. | Class 9 |
| Virtual network (VNet) | A private network inside Azure, divided into subnets (zones) — the floor plan every server and app sits inside. | Class 10 |
| App Service | Managed web hosting: you hand Azure your website's code and it runs it for you — no server to look after. | Class 11 |
| Storage · blob | A place to keep files — images, exports, backups. A "blob" is just one stored file. Cheaper "tiers" hold things you rarely open. | Class 12 |
| Front Door · WAF | A global front entrance for the website: it serves pages fast worldwide by caching them, and its firewall (WAF) blocks common attacks. | Class 13 |
| Private endpoint | A private door to a service so it can only be reached from inside your network — the public internet can't see it at all. | Class 14 |
| VPN | An encrypted bridge connecting the office to Azure, so the two can talk securely over the ordinary internet. | Class 15 |
| Infrastructure as Code · Bicep · Terraform | Describing your whole setup in text files instead of clicking buttons, so it can be reviewed, repeated exactly, and rebuilt from scratch. Bicep and Terraform are two languages for it. | Class 20–21 |
| Pipeline · CI/CD | Automation that checks and deploys your changes whenever you save them — the assembly line that ships your work without manual steps. | Class 22–24 |
| Container · Container Apps | A container packs an app with everything it needs so it runs the same anywhere. Container Apps runs them for you and can shrink to zero cost when idle. | Class 26–27 |
| Log Analytics · KQL | Log Analytics is the bin where all your logs (records of what happened) collect. KQL is the language you query them with — like asking a spreadsheet a question, but for logs. | Class 28–29 |
| Alert | A standing rule that notifies you the moment something crosses a line — so a problem pages you instead of a customer finding it first. | Class 30 |
| Budget · FinOps | Watching the bill on purpose: a budget warns you before spend runs away, which for a seasonal shop is the difference between a good year and a bad one. | Class 32 |
| RAG (AI) | Retrieval-Augmented Generation — an AI assistant that answers from your documents and cites them, instead of guessing from memory. | Class 33–34 |
Nothing below was invented for this page — each row is what a class actually does to Campux, in the order it happens. The middle column stays plain; the last tells you where you build it. Together, these are the system a graduate rebuilds as their own in the capstones. When a lab says "the storefront" or "the allowed-regions policy," it means this.
| Asset | What it is, plainly | Born in |
|---|---|---|
| Identity tenant | The one sign-in space for the six staff, carried over from their Microsoft 365 email. | Class 6–7 |
| Two subscriptions | A live one and a testing one, kept apart so an experiment can never touch the real shop and each bill is honest. | Class 7 |
| Governance rules | Every resource must be labelled (owner, environment, cost-centre) and may only be built in approved regions — enforced automatically by policy. | Class 8 |
| Managed identity | A password-free login for software, retiring a hard-coded secret — the "11pm secret" that haunts the course until it's finally removed. | Class 9 · 31 |
| The private network | The floor plan — a virtual network with zones — that every server and app is placed inside. | Class 10 |
| The storefront | The public shop, hosted on App Service. This is the workload most of the estate exists to serve. | Class 11 |
| The till batch | The nightly job that reconciles the tills — first on a right-sized server, later moved to a container that costs nothing when idle. | Class 11 · 27 |
| File storage | Product images kept ready-to-serve; old till exports moved to cheaper storage automatically as they age. | Class 12 |
| The front entrance | A fast, cached global entry point with a firewall for the public shop; a separate gateway for the internal admin app. | Class 13 |
| Private storage | The file storage taken off the public internet — and the classic "forgot the DNS step" mistake, made on purpose, then fixed. | Class 14 |
| Office-to-Azure bridge | A modest, encrypted link from the office to Azure — temporary, just for the last year of the old till system. | Class 15 |
| The estate as code | The whole setup written as text files in a protected repository, reviewed before anything ships — no more clicking buttons. | Class 17–23 |
| The single log bin | One place every resource sends its logs, so there's one window to watch the whole shop through. | Class 28–30 |
| Budget & alerts | A handful of alerts placed on purpose, and the budget that caught a runaway AI bill mid-month. | Class 30 · 32 · 35 |
| The real database | The till data moved off an office computer onto a proper managed database with backups and a guarantee. | Class 38 |
| The product bot | An AI assistant that answers shopper questions from Campux's own product information, with sources — the estate's first AI feature. | Class 33–35 |
These are the rules every lab assumes without restating them. If a step ever feels arbitrary, it traces back to one of these — the same way a real client's rules sit behind a real engineer's choices.
The estate doesn't appear all at once; it grows in the order a real one would. This is the story the case files tell across the course — and a preview of your own path through it.
The outage, who's responsible for what once you're in the cloud, and the honest reasons to move — and not to. Campux commits to Azure.
Sign-in, billing, rules, and the private network. Then the shop, its files, its front entrance, and going private — including the mistake that teaches why "green" isn't "working".
The estate gets a home in code, its main copy is locked, and an assembly line deploys every change automatically — with no passwords stored anywhere.
One place to watch everything, alerts placed on purpose, and a budget that catches a runaway bill. The closet is finally safe to walk away from.
The product bot, grounded and governed; the November outage re-fought in twenty-three minutes; and the case file closes as your job search opens.
From here on, Campux appears in a Case File beat in nearly every class — and each of those tabs links straight back to this page. They're rebuilt with your own hands in the four Builds and composed into one portfolio in the three Capstones.