Azure – VMFocus

3 x New Azure Exams with 80% Off

Posted on 17 July 2018 by Craig

Microsoft have launched three new Azure exams with 80% off, aimed at Azure Administrators, focused on depth rather than breadth.

Taking the AZ-100 and AZ-101 will lead to the certification Microsoft Azure Administrator.
If you have the 70-533 already, you can take the AZ-102 to achieve the certification Microsoft Azure Administrator.

AZ-100: Microsoft Infrastructure & Deployment

Measures knowledge and experience of:

Azure Subscriptions and Resources
Implementing and Managing Storage
Deploy and Manage Virtual Machines
Configure and Manage Virtual Networks
Manage Identities

More information can be found here and the 80% discount code is AZ100TRAVELING

AZ-101: Microsoft Azure Integration & Security

Measures knowledge and experience of:

Evaluate and Perform Server Migration to Azure
Implement and Manage Application Services
Implement Advanced Virtual Networking
Secure Identities

More information can be found here and the 80% discount code is AZ101HIKING

AZ-102: Microsoft Azure Administrator Certification Transition

Measures knowledge and experience of:

Evaluate and Perform Server Migration to Azure
Implement and Manage Application Services
Implement Advanced Virtual Networking
Manage Identities
Evaluate and Perform Server Migration to Azure
Implement and Manage Application Services
Implement Advanced Virtual Networking
Secure Identities

More information can be found here and the 80% discount code is AZ102PLANS

App Service Environment or Web App

Posted on 2 July 20182 July 2018 by Craig

I have been asked a couple of times when should you consider using an App Service Environment over a standard App Service Web App?

App Service Environment

An App Service Environment (ASE) provides an isolated and dedicated container to run a number of services such as:

Web Apps
Mobile Apps
Functions

An ASE does not replace an App Service Web App, it just provides a secure space for this to run.

At a high level you should consider using an ASE, if you meet one of the following conditions:

Access to the management plane is only available within your VNET and not from the internet
The Web App cannot be internet facing and therefore should be behind a Web Application Firewall
Communication from the Web App to PaaS DB Service should be secured within your VNET
Communication from the Web App to VM should be secured within your VNET

This can be logically explained in the diagram below.

App Service Web App

An App Service Web App is the PaaS service which without the ASE is accessible directly from the internet.

The instances you run sit on shared compute, which may or may not be on the same physical server or rack.

At a high level, an App Service Web App can be integrated into other Azure services such as:

VNET which has a Virtual Network Gateway
Can securely connect to a virtual machine back ends using a Point to Site Configuration

Final Thought

Depending on the requirements of the application and the business will determine if your App Service Web App should run on a standard PaaS tier or within an App Service Environment.

It should be noted that even though an App Service Web App running App Service Environment is considerably more expensive than a standard App Service Web App, you can run multiple App Services within the App Service Environment.

Azure AD: Transfer Subscriptions or Directory?

Posted on 2 May 20183 May 2018 by Craig

With the increased uptake of Azure across both public and private businesses, we are starting to see identity gaps across business divisions creating pockets of isolation.

In the diagram below we have a single Enterprise Enrollment which has two Azure Accounts, one for Online Services and the another for Retail Stores. Underneath these we then have two Azure Subscriptions, one for Development and the other for Production.

You might wonder what the issue is? Well in this scenario we have a single on-premises corporate directory that services ‘Online Services’ and ‘Retail Stores.

‘Online Services’ have setup their on-premises corporate directory to integrate with Azure AD, so that their starters and leavers process is controlled using their existing directory service.
Whereas ‘Retail Stores’ have no integration to the on-premises corporate directory and are using the default on.microsoft.com accounts

Both business divisions have rolled out Production & Development services, but we need to close the security gap to ensure that both divisions are using the corporate directory as part of their identity model.

To achieve this we have two choices available to us, Transfer Directory or Subscription.

A subscription can only be associated to a single directory

The next part of this blog post has been written by my colleague Graham Lindsay, Lead Architect and one of our identity experts.

Transfer Directory

This will not change the Account Admin or the billing, it purely modifies which directory the subscription is linked and can be completed using portal.azure.com.

Create Guest B2B account in the receiving directory using the email address of the Service Admin of the subscription to be switched . This can be a standard non admin user.

From the service admin account accept the B2B invite.

Once the service admin account has accepted the B2B invite it will now be able to view the receiving directory within the directory switcher.

Staying within the subscription hosting directory (TestCorp) locate the subscription to be transferred and choose change directory.

From the drop choose the receiving directory being (GrahamLab).

Once the change has occurred, the subscription will no longer be accessible in the in the TestCorp Directory.

Using the directory switcher specify the receiving directory.

Open Subscriptions and you will now see that the subscription has now moved. You can now rebuild the RBAC on the subscription.

Transfer Subscription

First of all it’s worth noting that only the following Subscriptions can be transferred.

Enterprise Agreement (EA) MS-AZR-0017P
Microsoft Partner Network MS-AZR-0025P
MSDN Platforms MS-AZR-0062P
Pay-As-You-Go MS-AZR-0003P
Pay-As-You-Go Dev/Test MS-AZR-0023P
Visual Studio Enterprise MS-AZR-0063P
Visual Studio Enterprise: BizSpark MS-AZR-0064P
Visual Studio Professional MS-AZR-0059P
Visual Studio Test Professional MS-AZR-0060P

Subscriptions can only be transferred to someone in the same country

When transferring the subscription this changes the entire subscription including billing.

For Enterprise Agreements this is done in the EA portal
For Non-Enterprise Agreements this is done in the billing portal

Within the billing portal locate the subscription to be transferred and choose transfer subscription.

From here you can just change just the Account Admin or you can change the Account Admin and where the subscription is linked to. To transfer the whole thing and change the service administrator as well untick the retain this subscription with my AzureAD.

Enter the name of the account who will be taking over the subscription (I chose to switch the AzureAD directory too)

The following screen is shown saying that the transferred has started.

The receiving party will also receive an email will a link to initiate the transfer. Clicking this link the following is shown with the following screens shown.

The subscription is now shown as transferred in the sending portal as transferred.

The subscription is now showing as active in the receiving portal.

As you can see the service admin is updated too.

Resizing Azure Virtual Machines

Posted on 4 April 2018 by Craig

I’m regularly asked two questions when it comes to Azure virtual machines which are:

Can I resize a VM to give it more CPU and RAM?
What is the impact on the VM?

We are used to daily operations using on-premises features such as ‘hot add’ which can increase a VM’s RAM, CPU and HDD capacity without downtime, but can we do the same in Azure?

Can I Resize an Azure VM?

The answer is yes you can within the same series of VM e.g. an ‘A’ to a larger or smaller ‘A’.

When it comes to resizing a VM between different series of VMs the answer is it depends whether the resize is to same hardware or different hardware e.g. a change in chipsets

Undertaking a resize operation is a simple procedure, select your VM and then from the blade select size.

Select your desired size and finally hit select. You will then see the Notification ‘Resizing virtual machine’

Whats the impact to the VM if I can resize it?

The typical impact to resizing a VM is a restart which can take up to five minutes for the end to end operation to complete. Therefore I would suggest an outage window is used and a known good working backup before you start!

If you are resizing to a VM onto new hardware (e.g. change in chipset), then the VM will need to be powered off first before the resize operation can begin.

It’s worth noting that if you are resizing VM’s onto new hardware which are in an Availability Set, then all the VMs need to be powered off for the operation to begin.

Final Thoughts

Microsoft have clearly made strides to ensure that resizing a VM within Azure is smoother and easier than ever before. However ensure that you plan for downtime and perhaps more importantly have a known good working backup before you start work resizing VMs.

Azure Announcements March 2018

Posted on 5 March 2018 by Craig

It’s been a few months since I wrote my last ‘Azure Announcements’ blog post so thought it would be worth sharing a number of features which I have my eye on.

Reserved Instances

VM’s we all love them, and guess what they will probably continue to be part of all public cloud deployments.

Certain IaaS VM’s that run applications such as Active Directory Domain Services will be on 24x7x365, why not reserve these instances and enjoy up to 82% savings versus Pay As You Go.

Essentially you commit to either a year or three years upfront. The good news is, if anything changes you get an adjusted refund.

More details here.

Azure Network Watcher

Azure Network Watcher went GA on 29th January 2018. A great tool to have in your toolkit, features include:

Connectivity Checks
Hop by hop latency
A graphical view from source to destination
Number of packets dropped

It also enables a connectivity check for ExpressRoute which is in preview.

More details here.

Cost Management

Monitoring spend in the cloud has always been a pain. With the acquisition of Cloudyn last year, Microsoft have made consumption insights much easier.

Ability to schedule reports to be emailed to recipents
Carry Tags across to view application service or grouped component cost
Review ‘heavy hitters’ in terms of consumption

Great news is until June 2018, Cost Management is free.

More details here.

Azure Availability Zones (Preview)

This is a key features that customer have been crying out for (shame it’s still in preview). Essentially Availability Zones protect from data centre level failures, something with Availability Sets do not currently do.

More details here.

Azure Migrate

To start the journey to public cloud services, you need to understand your application estate. This is a process which should not be under estimated as many customer environments are poorly documented, application owners have left the business, operations and IT don’t really understand how an application is coupled together so trying to migrate anything but low hanging fruit often gets placed into the ‘too hard to deal with bucket’.

To counter act this, Microsoft have announced Azure Migrate which uses an application based approach for the following:

Discovery and assessment for on-premises virtual machines
Inbuilt dependency mapping for high-confidence discovery of multi-tier applications
Intelligent rightsizing to Azure virtual machines
Compatibility reporting with guidelines for remediating potential issues
Integration with Azure Database Management Service for database discovery and migration

More details here.

Just in Time Access (Preview)

Consider for a moment, the attack vector on your virtual machines. You may have some ports exposed to the public internet , however these are likely to be protected using Next Generation Firewalls and perhaps even a DDoS scrubbing service from your ISP.

Perhaps the largest attack vector are your management ports such as SSH, RDP and WMI to name but a few. When these ports are open, it allows anyone to try and obtain access whether it is a authorised or not.

This is where ‘Just in Time Virtual Machine Access’ steps in to reduce your overall attack surface. Access to management ports are closed and access is only granted from either trusted IP’s or per request.

More details here.