AZ-900 Azure Fundamentals

AZ-900 Azure Fundamentals

  1. Skill Required for the certification
  2. Exam Weights
  3. What is Cloud Computing:
  4. Cloud computing characteristics:
    1. Scalability:
    2. Elasticity
    3. Agility
    4. Fault Tolerance
    5. Disaster Recovery
    6. High Availability
  5. Principles of economics of scale
  6. CapEx VS OpExp:
  7. Consumption Based Model
  8. IaaS vs PaaS vs SaaS cloud service models
  9. Cloud Deployment Models
    1. Public Cloud
    2. Private Cloud
    3. Hybrid Cloud
  10. Geographies, Regions & Availability Zones
    1. Data Center
    2. Region
    3. Availability Zone
    4. Region Pair
    5. Geographies
  11. Resources, Resource Groups & Resource Manager
  12. Compute Services
  13. Azure Networking Services
  14. Azure Storage Services
  15. Azure Database Services
  16. Azure IoT Services
  17. Azure Big Data & Analytics Services
  18. Azure Artificial Intelligence (AI) Services
  19. Azure Serverless Computing Services
  20. Azure DevOps Solutions
  21. Azure Tools
  22. Azure Advisor
  23. Azure Security Groups
  24. User-defined Routes (UDR) with Route Tables
  25. Azure Firewall
  26. Azure DDoS Protection
  27. Azure Identity Services
  28. Azure Security Center
  29. Azure Key Vault
  30. Azure Role-based Access Control (RBAC)
  31. Azure Resource Locks
  32. Azure Resource Tags
  33. Azure Policy
  34. Azure Blueprints
  35. Cloud Adoption Framework for Azure
  36. Core tenets of Security, Privacy, Compliance
  37. Cost Affecting Factors
  38. Cost Reduction Methods
  39. Azure Cost Management
  40. SLA and Composite SLA in Azure
  41. Service Lifecycle in Azure

Skill Required for the certification

  • Cloud concepts
  • Core azure services
  • Security, privacy, compliance and trust
  • Azure pricing and support

Exam Weights

AreaWeights
Cloud concepts15-20%
Core azure services30-35%
Security, privacy, compliance and trust25-30%
Azure pricing and support20-25%

What is Cloud Computing:

Cloud computing is a service delivery model over the internet like storage, compute power, networking, analytics and many more.

  • Compute power meaning servers such as windows, linux, hosting environment etc
  • Storage like files and/or databases
  • Networking in azure but also outside when connecting to your company network
  • Analytics services for visualization and telemetry data

Cloud computing characteristics:

  • Scalability
  • Elasticity
  • Agility
  • Fault Tolerance
  • Disaster Recovery
  • High Availability

Scalability:

Scalability is the ability to scale. Scaling is a process of allocating(adding) or deallocating(removing) resources.
Increasing/decreasing size of the resource is called vertical scaling (scaling up/scaling down)
Adding/removing amount of resources is called horizontal scaling (scaling out/scaling in)

Elasticity

Elasticity is the ability to scale dynamically

Agility

Agility is the ability to react fast (scale quickly). Requesting resources at cloud my take seconds, minutes or hours.

Fault Tolerance

Fault tolerance is the ability to maintain system uptime while physical and service component failures happen

Disaster Recovery

Disaster recovery is the process and design principle which allows a system to recovers from natural or human induced disasters

High Availability

High availability is the agreed level of operational uptime for the system. It is a simple calculation of system uptime versus the whole lifetime of the system.
availability = uptime/(uptime + downtime)

Principles of economics of scale

Principles which explain the cost of Azure services. Cost per unit(service) lowers as the size of the company grows.

CapEx VS OpExp:

Capital expenditure means buying your own infrastructure. It needs the big initial investment.
Operational expenditure means renting infrastructures or buying services. Cloud perfectly fits with this model.

Cap ExpOpExp
Up front costSignificantNone
Ongoing costLowBased on usage
Tax DeductionOver timeSame year
Early TerminationNoAnytime
MaintenanceSignificantLow
Value over timeLowersNo change

Consumption Based Model

The consumption-based model is a pricing model used in the cloud so that customers are only charged based on their resource usage.

  • No associated upfront cost
  • No wasted resources as such no charges are incurred for unused resources
  • Pay for what you need
  • Stop paying when you don’t

IaaS vs PaaS vs SaaS cloud service models

  • Infrastructure-as-a-Service (IaaS) (Hardware, networking and visualization)
    (Ex: Virtual Machine, Virtual Network, Managed Disk)
  • Platform-as-a-Service (PaaS) (Operating system, middleware, runtime)
    (Ex: SQL, App Service, Logic Apps, Function Apps)
  • Software-as-a-Service (SaaS) (Application and data)
    (Ex: One Drive, Outlook, Skype, all business application)

Service Model Responsibilities:

  • Software layer consists the application (application code and set) & the application data
  • Platform layer means all the supporting software and the operating system required to host the application
  • Infrastructure layer consists hardware the infrastructure and virtualization required to host the platform

Cloud Deployment Models

Cloud Deployment Model is simple a separation which describes where are the company resources deployed. Whenever this is in public cloud provider environment or private datacenter.

Public Cloud

Key Characteristics

  • Everything runs on cloud provider hardware
  • No local hardware
  • Some services share hardware with other customers

Advantages

  • No CapEx (No initial investment)
  • High Availability
  • Agility
  • Pay as you Go (PAYG) pricing
  • No hardware maintenance
  • No deep technical skills required

Disadvantages

  • Not all security and compliance policies can be met
  • No ownership over the physical infrastructure
  • Rare specific scenarios can’t be done

Private Cloud

Key Characteristics

  • Everything runs on your own datacenter
  • Self-service should be provided
  • You maintain the hardware

Advantages

  • Can support any scenario
  • Total control over security and infrastructure
  • Can meet any security and compliance policy

Disadvantages

  • Initial investment is required (CapEx)
  • Limited agility constrained by server capacity and team skills
  • Very dependent on IT skills & expertise

Hybrid Cloud

Key Characteristics

  • Combines both Public & Private cloud

Advantages

  • Great flexibility
  • You can run any legacy apps in private cloud
  • Can utilize existing infrastructure
  • Meet any security& compliance requirements
  • Can take advantage of all public cloud benefits

Disadvantages

  • Can be more expensive
  • Complicated to manage due to larger landscape
  • Most dependent on IT skills & expertise from all three models

Geographies, Regions & Availability Zones

Data Center

  • Physical facility that holds the servers
  • Hosting for group of networked servers
  • Own powercooling & networking infrastructure

Region

  • Geographical area on the planet
  • One or more datacenters connected with low-latency network (<2 milliseconds)
  • Location for your services
  • Some services are available only in certain regions
  • Some services are global services, as such are not assigned/deployed in specific region
  • Globally available with 50+ regions
  • Special government regions (US DoD Central, US Gov Virginia, etc.)
  • Special partnered regions (China East, China North)
  • “Azure speed test” to check service speed based on your location
  • “Products available by region” can compare different region available services

Availability Zone

  • Regional feature, logical groupings over data centers
  • Grouping of physically separate facilities
  • Designed to protect from data center failures
  • If zone goes down others continue working
  • Two service categories
    • Zonal services (Virtual Machines, Disks, etc.)
    • Zone-redundant services (SQL, Storage, etc.)
  • Not all regions are supported
  • Supported region has three or more zones
  • zone is one or more data centers

Region Pair

  • Each region is paired with another region making it a region pair
  • Region pairs are static and cannot be chosen
  • Each pair resides within the same geography*
    • Exception is Brazil South
  • Physical isolation with at least 300 miles distance (when possible)
  • Some services have platform-provided replication
  • Planned updates across the pairs
  • Data residency maintained for disaster recovery
REGION PAIR AREGION PAIR B
East USWest US
UK WestUK South
North Europe (Ireland)West Europe (Netherlands)
East Asia (Hong Kong)Southeast Asia (Singapore)

Geographies

  • Discrete market
  • Typically contains two or more regions
  • Ensures data residencysovereigntyresiliency, and compliance requirements are met
  • Fault tolerant to protect from region wide failures
  • Broken up into areas like AmericasEuropeAsia PacificMiddle East and Africa
  • Each region belongs only to one Geography

Resources, Resource Groups & Resource Manager

Azure Resource

  • Object used to manage services in Azure
  • Represents service lifecycle
  • Saved as JSON definition (Four common properties is Type. APIVersion, Name and Location)

Resource Groups

  • Logical Grouping of resources
  • Holds logically related resources
  • Typically organizing by
    • Type
    • Lifecycle (app, environment)
    • Department
    • Billing,
    • Location or
    • combination of those

Resource Manager

  • Management Layer for all resources and resource groups
  • Unified language
  • Controls access and resources
    Untitled

Additional Info

  • Each resource must be in one, and only one resource group
  • Resource groups have their own location assigned
  • Resources in the resource groups can reside in a different locations
  • Resources can be moved between the resource groups
  • Resource groups can’t be nested
  • Organize based on your organization needs but consider
    • Billing
    • Security and access management
    • Application Lifecycle
  • Azure Resource Explorer” will show the details about resources.

Compute Services

Category of on-demand services used to run cloud based applications. Azure compute services includes…

  1. Virtual Machines
  2. Virtual Machine Scale Sets
  3. Container Instances (ACI)
  4. Kubernetes Service (AKS)
  5. App Services
  6. Functions

Virtualization (Definition)

  • Emulation of physical machines
  • Different virtual hardware configuration per machine/app
  • Different operating systems per machine/app
  • Total separation of environments like file systems, services, ports, middleware, configuration.

Untitled

1. Virtual Machines

  • Infrastructure as a Service (IaaS)
  • Total control over the operating system and the software
  • Supports marketplace and custom images
  • No auto scaling feature
  • Best suited for
    • Custom software requiring custom system configuration
    • Lift-and-shift scenarios
  • Can run any application/scenario
    • web apps & web services,
    • databases,
    • desktop applications,
    • jumpboxes,
    • gateways, etc.

2. Virtual Machine Scale Sets

  • Infrastructure as a Service (IaaS)
  • Set of identical virtual machines
  • Built-in auto scaling features
  • Designed for manual and auto-scaled workloads like web services, batch processing, etc.

 Containers (Definition)

  • Use host’s operating system
  • Emulate operating system (VMs emulate hardware)
  • Lightweight (no O/S)
    • Development Effort
    • Maintenance
    • Compute & storage requirements
  • Respond quicker to demand changes
  • Designed for almost any scenario

Untitled

3. Azure Container Instances

  • Simplest and fastest way to run a container in Azure
  • Platform as a Service (PaaS)
  • Not mandatorily exposed to users if needed
  • Treated as Serverless Containers
  • No auto scaling feature
  • Designed for
    • Small and simple web apps/services
    • Background jobs
    • Scheduled scripts

4. Azure Kubernetes Service (AKS)

  • Open-source container orchestration platform
  • Platform as a Service (PaaS)
  • Highly scalable and customizable
  • Designed for high scale container deployments (anything really!)

5. App Service (Web App)

  • Designed as enterprise grade web application service
  • Platform as a Service (PaaS)
  • Supports multiple programming languages and containers

6. Azure Functions (Function Apps)

  • Platform as a Service
  • Serverless
  • Two hosting/pricing models
    • Consumption-based plan
    • Dedicated plan
  • Designed for micro/nano-services

Summary

  • Virtual Machines (IaaS) – Custom software, custom requirements, very specialized, high degree of control
  • VM Scale Sets (IaaS) – Auto-scaled workloads for VMs
  • Container Instances (PaaS) – Simple container hosting, easy to start
  • Kubernetes Service (PaaS) – Highly scalable and customizable * container hosting platform
  • App Services (PaaS) – Web applications, a lot of enterprise web * hosting features, easy to start
  • Functions (PaaS) (Function as a Service) (Serverless) – micro/nano-services, excellent consumption-based pricing, easy to start

Untitled

Azure Networking Services

Azure Networking Capability

  • Connect cloud and on-premises resources
  • On-premise networking functionality
  • Protect and monitor services
  • Help with application delivery
  • Allows to draw a diagram of your full infrastructure (Using Diagram)

Products available for Networking is given below….

    1. Virtual Network,
    2. Load Balancer,
    3. VPN Gateway,
    4. Application Gateway and
    5. Content Delivery Network

1. Azure Virtual Network

  • Emulation of physical networking infrastructure
  • Logically isolated networking components
  • Segmented into one or more subnets
  • Subnets are discrete sections used for effective address allocation and network filtering via Network Security Groups(NSG) or Application Security Groups(ASG)
  • Enable communication of resources with each-other, internet and on-premises
  • Scoped to a single region
  • VNet Peering allow cross region communication (Also use VPN Gateway)
  • Designed for Isolation, Segmentation, Communication, Filtering, Routing between resources

2. Azure Load Balancer

  • Even traffic distribution among multiple resources (Non-Web traffic)
  • Supports both inbound and outbound scenarios
  • High-availability scenarios
  • Both TCP (transmission control protocol) and UDP (user datagram protocol) applications
  • Internal and External traffic
  • Port Forwarding
  • High scale with up to millions of flows

3. VPN Gateway

  • Specific type of virtual network gateway for on-premises to azure traffic over the public internet (Encrypted)
  • Cross regional communication of azure virtual networks

4. Application Gateway

  • Web traffic load balancer (HTTP traffic) (Design to support only web traffic)
  • Web application firewall
  • Redirection
  • Session affinity
  • URL Routing
  • SSL termination

5. Content Delivery Network (CDN)

  • Define and deliver web content to users (JavaScript, CSS, Static Page, Images)
  • Minimize latency (User will connect with closest location of the content)
  • POP (points of presence) with many locations

Azure Storage Services

Data Types

  • Structured: Data that can be represented using tables with very strict schema. Each row must follow defined schema. Some tables have defined relationships between them. Typically used in relational databases.
  • Semi-structured: Data that can be represented using tables but without strict defined schema. Rows must only have unique key identifier.
  • Unstructured:  Any files in any format. Like binary files, application files, images, movies, etc.

Storage Account

  • Group of services which include
    1. Blob storage, Storage tiers
    2. Queue storage,
    3. Table storage, and
    4. File storage
    5. Disk storage
  • Used to store
    • files,
    • messages, and
    • semi-structured data
  • Highly scalable (up to petabytes of data)
  • Highly durable (99.999999999% – 11 nines, up to 16 nines)
  • Cheapest per GB storage

1. Azure Blob Storage

  • BLOB – Binary Large Object – file
  • Designed for storage of files of any kind (Unstructured data)
  • Three storage tiers
    • Hot – frequently accessed data
    • Cool – infrequently accessed data (lower availability, high durability)
    • Archive – rarely (if-ever) accessed data
  • Many programming interfaces and SDKs

2. Azure Queue Storage

  • Storage for small pieces of data (messages)
  • Designed for scalable asynchronous processing (Application multiple task output is stored at queue which is picked up by other process)

3. Azure Table Storage

  • Storage for semi-structured data (NoSQL)
    • No need for foreign joins, foreign keys, relationships or strict schema
    • Designed for fast access
  • Many programming interfaces and SDKs

4. Azure File Storage

  • Similar to azure blob storage but it works as a remote drive at local machine
  • Storage for files accessed via shared drive protocols (SMB)
  • Designed to extend on-premise file shares or implement lift-and-shift scenarios

5. Disk Storage

  • Disk emulation in the cloud
  • Persistent storage for Virtual Machines
  • Different
    • sizes,
    • types (SSD, HDD)
    • performance tiers
  • Disk can be unmanaged or managed

Azure Database Services

Azure Databases

  • Azure Cosmos DB
  • Azure SQL Database
  • Azure Database for MySQL
  • Azure Database for PostgreSQL
  • Azure SQL Managed Instance
  • Azure SQL on VM
  • Azure SQL Datawarehouse(DW)

Azure Cosmos DB

  • Globally distributed NoSQL (semi-structured data) Database service
  • Schema-less
  • Multiple APIs (SQL, MongoDB, Cassandra, Gremlin, Table Storage)
  • Designed for
    • Highly responsive (real time) applications with super low latency responses <10ms
    • Multi-regional applications

Azure SQL Database

  • Relational database service in the cloud (PaaS) (DBaaS – Database as a Service)
  • Structured data service defined using schema and relationships
  • Rich Query Capabilities (SQL)
  • High-performance, reliable, fully managed and secure database for building – applications

Azure SQL product family

  • Azure SQL Database – Reliable relational database based on SQL Server
  • Azure Database for MySQL – Azure SQL version for MySQL database engine
  • Azure Database for PostgreSQL – Azure SQL version for PostgreSQL database engine
  • Azure SQL Managed Instance – Fully fledged SQL Server managed by cloud provider
  • Azure SQL on VM – Fully fledged SQL Server on IaaS
  • Azure SQL Data Warehouse(DW) (Synapse) – Massively Parallel Processing (MPP) version of SQL Server

Azure IoT Services

What is Internet of Things?

Internet of Things (IoT) is a network of internet connected devices (IoT Devices) embedded in everyday objects enabling sending and receiving data such as settings and telemetry.

Service Includes:

  1. Azure IoT Hub
  2. Azure IoT Central
  3. Azure Sphere

Azure IoT Hub

  • Managed service for bi-directional communication
  • Platform as a Service (PaaS)
  • Highly secure, scalable and reliable
  • Integrates with a lot of Azure Services
  • Programmable SDKs for popular languages (C, C#, Java, Python, Node.js)
  • Multiple protocols (HTTPS, AMQP, MQTT)

Azure IoT Central

  • IoT App Platform  (IoT Central)- Software as a Service (SaaS)
  • Industry specific app templates
  • No deep technical knowledge required
  • Service for connecting, management and monitoring IoT devices
  • Highly secure, scalable and reliable
  • Built on top of the IoT Hub service and 30+ other services

Azure Sphere

  • Set of components allowing you to build secure IoT application. Hardware vendor creates sphere chips based on custom specification, Azure sphere provides OS and then build your application on top of that.
  • Secure end-2-end IoT Solutions
    • Azure Sphere certified chips (microcontroller units – MCUs)
    • Azure Sphere OS based on Linux
    • Azure Security Service trusted device-to-cloud communication

Azure Big Data & Analytics Services

What is Big Data?

Big Data is a field of technology that helps with the extractionprocessing and analysis of information that is too large or complex to be dealt with by traditional software.

Service Includes:

  1. Azure Synapse Analytics
  2. Azure HDInsight
  3. Azure Databricks

The three V’s rule

Big data typically has one of the following characteristics

  • Velocity – how fast the data is coming in or how fast we are processing it
    • Batch
    • Periodic
    • Near Real Time
    • Real Time
  • Volume – how much data we are processing
    • Megabytes
    • Gigabyte
    • Terabytes
    • Petabytes
  • Variety – how structured/complex the data is
    • Tables
    • Databases
    • Photo, Audio
    • Video, Social Media

Azure Synapse Analytics

  • Big data analytics platform (PaaS)
  • Multiple components
    • Apache Spark
    • Synapse SQL
      • SQL pools (dedicated – pay for provisioned performance)
      • SQL on-demand (ad-hoc – pay for TB processed)
    • Synapse Pipelines (Data Factory – ETL)
    • Synapse Studio (unified experience)
  • Modern workspace for end-2-end enterprise data warehousing & analytics with lot of integrated tools like Data Factory, Spark, SQL etc.

Azure HDInsight

  • Flexible multi-purpose big data platform (PaaS)
  • Provide big data clusters including existing open source technologies
  • Multiple technologies supported (Hadoop, Spark, Kafka, HBase, Hive, Storm, Machine Learning)
  • Fully managed open source analytics service with a lot of supported frameworks and tools.

Azure Databricks

  • Big data collaboration platform (PaaS)
  • Unified workspace for notebook, cluster, data, access management and collaboration
  • Based on Apache Spark only.
  • Integrates very well with common Azure data services
  • Apache spark based analytics platform for data transformation and collaboration.

Azure Artificial Intelligence (AI) Services

What is Artificial Intelligence:

Artificial Intelligence (AI) is the simulation of human intelligence & capabilities by computer software.

What is Machine Learning:

Machine Learning is a subcategory of AI where a computer software is “taught” to draw conclusions and make predictions from data.
The process of teaching the software is called Building a Model.

Azure Machine Learning

  • Cloud-based platform for creating, managing and publishing machine learning models
  • Platform as a Service (PaaS)
  • Machine Learning Workspace – top level resource
  • Machine Learning Studio – web portal for end-2-end development
  • Features / Tools
    • Notebooks – using Python and R
    • Automated ML – run multiple algorithms/parameters combinations, choose the best model
    • Designer – graphical interface for no-code development
    • Data & Compute – management of storage and compute resources
    • Pipelines – orchestrate model training, deployment and management tasks

Azure Serverless Computing Services

What is Serverless?

Serverless computing is cloud-hosted execution environment that allows customers to run their applications in the cloud while completely abstracting underlying infrastructure.
Service includes…

  1. Azure Functions
  2. Logic Apps
  3. Event Grid

Azure Functions (Function Apps)

  • Serverless coding platform (Functions as a Service, FaaS) (Serverless compute resource)
  • Designed for nano-service architectures and event-based applications
  • Scales up and down very quickly
  • Highly scalable
  • Supports popular languages and frameworks (.NET & .NET Core, Java, Node.js, Python, PowerShell, etc.)
  • Application development platform for nano services and event based applications using popular languages

Azure Logic Apps

  • Serverless enterprise integration service (PaaS)
  • 200+ connectors for popular services
  • Designed for orchestration of
    • business processes,
    • integration workflows for applications, data, systems and services
  • No-code solution
  • Enterprise integration services for orchestration of business and application workflows using visual interface.

Untitled

Azure Event Grid

  • Fully managed serverless event routing service (Routing messages)
  • Uses publish-subscribe model
  • Designed for event-based and near-real time applications
  • Supports dozen of built-in events from most common Azure services
  • Services send custom events/message (Topics) to Event Grid and Event Grid has lot of other services (Subscriber of topics) to deliver this message.

Untitled

Azure DevOps Solutions

What is DevOps?

DevOps is a set of practices that combine both development (Dev) and operations (Ops).

DevOps aims to shorten the development life cycle by providing continuous integration and delivery (CI/CD) capabilities while ensuring high quality of deliverables.

Azure DevOps

  • Collection of services for building solutions using DevOps practices
  • Services included
    • Boards – tracking work
    • Pipelines – building CI/CD workflows (build, test and deploy apps)
    • Repos – code collaboration and versioning with Git
    • Test Plans – manual and exploratory testing
    • Artifacts – manage project deliverables
  • Extensible with Marketplace – over 1000 of available apps
  • Evolved from TFS (Team Foundation Server), through VSTS (Visual Studio Team Services)

Azure DevTest Labs

  • Service for creation of sandbox environments for developers/testers (PaaS)
  • Quick setup of self-managed virtual machines
  • Preconfigured templates for VMs
  • Plenty of additional artifacts (tools, apps, custom actions)
  • Lab policies (quotas, sizes, auto-shutdowns)
  • Share and automate labs via custom images
  • Premade plugins/API/tools for CI/CD pipeline automation

Azure Tools

Azure Portal

  • Public web-based interface for management of Azure platform
  • Designed for self-service
  • Customizable
  • Simple tasks

Azure PowerShell

  • PowerShell and module
  • Designed for automation
  • Multi-platform with PowerShell Core
  • Simple to use
    • Connect-AzAccount – log into Azure
    • Get-AzResourceGroup – list resource groups
    • New-AzResourceGroup – create new resource group
    • New-AzVm – create virtual machine

Azure CLI

  • Command Line Interface for Azure
  • Designed for automation
  • Multi-platform (Python)
  • Simple to use
    • az login – log into Azure
    • az group list – list resource groups
    • az group create – create new resource group
    • az vm create – create virtual machine
  • Native OS terminal scripting

Azure Cloud Shell

  • Cloud-based scripting environment
  • Completely free
  • Supports both Azure PowerShell and Azure CLI
  • Dozen of additional tools
  • Multiple client interfaces
    • Azure Portal integration (portal.azure.com)
    • Shell Portal (shell.azure.com)
    • Visual Studio Code Extension
    • Windows Terminal
    • Azure Mobile App
    • Microsoft Docs integration

Azure Advisor

  • Personalized consultant service
  • Designed to provide recommendations and best practices for
    • Cost (SKU sizes, idle services, reserved instances, etc.)
    • Security (MFA settings, vulnerability settings, agent installations, etc.)
    • Reliability (redundancy settings, soft delete on blobs, etc.)
    • Performance (SKU sizes, SDK versions, IO throttling, etc.)
    • Operational Excellence (service health, subscription limits, etc.)
  • Actionable recommendations
  • Free!

Azure Security Groups

Network Security Groups

  • Designed to filter traffic to (inbound) and from (outbound) Azure resources located in – Azure Virtual Network
  • Filtering controlled by rules
  • Ability to have multiple inbound and outbound rules
  • Rules are created by specifying
    • Source/Destination (IP addresses, service tags, application security groups)
    • Protocol (TCP, UDP, any)
    • Port (or Port Ranges, ex. 3389 – RDP, 22 – SSH, 80 HTTP, 443 HTTPS)
    • Direction (inbound or outbound)
    • Priority (order of evaluation)

Application Security Groups

  • Logical grouping of virtual network resources for easier maintenance
  • Designed to reduce the maintenance effort (assign ASG instead of the explicit IP address)

User-defined Routes (UDR) with Route Tables

Routing

Process of finding/selecting a path between two or more servers for traffic in one or across multiple networks. Azure routing is set up by default.

User-defined Routes

  • Custom (user-defined, static) routes (UDRs)
  • Designed to override Azure’s default routing or add new routes
  • Managed via Azure Route Table resource
  • Associated with a zero or more Virtual Network subnets

Azure Firewall

Firewall

Firewall is a network security service that monitors and controls incoming and outgoing traffic.

Azure Firewall

  • Managed, cloud-based firewall service (PaaS, Firewall as a Service)
  • Built-in high availability
  • Highly Scalable
  • Inbound & outbound traffic filtering rules
  • Support for FQDN (Fully Qualified Domain Name), ex. microsoft.com
  • Fully integrated with Azure monitor for logging and analytics

Azure DDoS Protection

DoS – Denial of Service

Cyber-attack with intent to cause temporary or indefinite disruption of service

DDoS – Distributed Denial of Service

DoS attack that is originating from multiple servers

Azure DDoS Protection

  • DDoS protection service in Azure
  • Designed to
    • Detect malicious traffic and block it while allowing legitimate users to connect
    • Prevent additional costs for auto-scaling environments
  • Two tiers
    • Basic – automatically enabled for Azure platform
    • Standard – additional mitigation & monitoring capabilities for Azure Virtual Network resources
  • Standard tier uses machine learning to analyze traffic patterns for better accuracy

Azure Identity Services

Identity

  • A user with a username and password.
  • Also applications or other servers with secret keys or certificates.
  • The fact of being something or someone.

Authentication

The process of verification/assertion of identity

Authorization

The process of ensuring that only authenticated identities get access to the resources for which they have been granted access.

Access Management

The process of controllingverifyingtracking and managing access to authorized users and applications.

Azure Active Directory

  • Identity and Access Management service in Azure
  • Identities management – users, groups, applications
  • Access management – subscriptions, resource groups, roles, role assignments, authentication & authorization settings, etc.
  • Used by multiple Microsoft cloud platforms
    • Azure
    • Microsoft 365
    • Office 365
    • Live.com services (Skype, OneDrive, etc.)
  • Need global administrator role to manage azure active directory

Multi-factor Authentication (MFA)

  • Process of authentication using more than one factor (evidence) to prove identity
  • Factor types
    • Knowledge Factor – “Something you know”, ex. password, pin
    • Possession Factor – “Something you have”, ex. phone, token, card, key
    • Physical Characteristic Factor – “Something you are”, ex. fingerprint, voice, face, eye iris
    • Location Factor – “Somewhere you are”, ex. GPS location
  • Supported by Azure AD by default (simple on-off switch)

Azure Security Center

  • Centralized/unified infrastructure and platform security management service
  • Continuously scan active services and helps to protect azure environment.
  • Natively embedded in Azure services
  • Integrated with Azure Advisor
  • Two tiers
    • Free (Azure Defender OFF) – included in all Azure services, provides continuous assessments, security score, and actionable security recommendations
    • Paid (Azure Defender ON) – hybrid security, threat protection alerts, vulnerability scanning, just in time (JIT) VM access, etc.

Azure Key Vault

All the stored data at disk is encrypted using keys. So that if some one get the disk, they are not able to decrypt the information. All the keys are stored at azure key vault.

  • Managed service for securing sensitive information (application/platform) (PaaS)
  • Secure storage service for
    • Keys,
    • Secrets and 
    • Certificates
  • Highly integrated with other Azure services (VMs, Logic Apps, Data Factory, Web Apps, etc.)
  • Centralization (Multiple services can store their application secret in a single place)
  • Access monitoring and logging
  • Can create custom keys and get that keys from different application.

Untitled

Azure Role-based Access Control (RBAC)

What is a Role?

Role (role definition) is a collection of actions that the assigned identity will be able to perform.

Role definition is an answer to a question “What can be done?”

What is a Security Principal?

Security Principal is an Azure object (identity) that can be assigned to a role (ex. users, groups or applications).

Security Principal assignment is an answer to a question “Who can do it?”

What is a Scope?

Scope is one or more Azure resources that the access applies to.

Scope assignment is an answer to a question “Where can it be done?”

What is a Role Assignment?

Role assignment is a combination of the role definitionsecurity principal and scope.

Azure Role-based Access Control (RBAC)

  • Authorization system built on Azure Resource Manager (ARM)
  • Designed for fine-grained access management of Azure Resources
  • Role assignment is combination of
    • Role definition – list of permissions like create VM, delete SQL, assign permissions, etc.
    • Security Principal – user, group, service principal and managed identity and
    • Scope – resource, resource groups, subscription, management group
  • Hierarchical
    • Management Groups > Subscriptions > Resource Groups > Resources
  • Built-in and Custom roles are supported

Azure Resource Locks

What is an Azure Resource Lock?

  • Designed to prevent accidental deletion and/or modification
  • Used in conjunction with RBAC
  • Two types of locks
    • Read-only (ReadOnly) – only read actions are allowed
    • Delete (CanNotDelete) – all actions except delete are allowed
  • Scopes are hierarchical (inherited)
    • Subscriptions > Resource Groups > Resources
  • Management Groups can’t be locked
  • Only Owner and User Access Administrator roles can manage locks (built-in roles)

Azure Resource Tags

  • Tags are simple Name (key) – Value pairs
  • Designed to help with organization of Azure resources (No way to rename resource group)
  • Allows you to add extra information to your resources
  • Used for resource governancesecurityoperations managementcost managementautomation, etc.
  • Typical tagging strategies
    • Functional – mark by function ( ex: environment = production )
    • Classification – mark by policies used ( ex: classification = restricted )
    • Finance/Accounting – mark for billing purposes ( ex: department = finance )
    • Partnership – mark by association of users/groups ( ex: owner = adam )
  • Applicable for resourcesresource groups and subscriptions
  • NOT inherited by default

Azure Policy

  • Create policy(policy definition) which will check certain azure properties before creating a resource.
  • Designed to help with resource governancesecuritycompliancecost management, etc.
  • Policies focus on resource properties (RBAC focused on user actions)
  • Policy definition – Defines what should happen
    • Define the condition (if/else) and the effect (deny, audit, append, modify, etc.)
    • Examples include allowed resource typesallowed locationsallowed SKUsinherit resource tags
  • Built-in and custom policies are supported
  • Policy initiative – a group of policy definitions
  • Policy assignment – assignment of a policy definition/initiative to a scope
    • Scopes can be assigned to
      • management groups,
      • subscriptions,
      • resource groups, and
      • resources
  • Policies allow for exclusions of scopes
  • Checked during resource creation or updates and existing ones with remediation tasks

Azure Blueprints

  • A blueprint is a guide, pattern or design for making something identical. (No need to create script)
  • Package of various Azure components (artifacts) (To replicate in another subscription or resource group)
    • Resource Groups
    • ARM Templates
    • Policy Assignments
    • Role Assignments
  • Centralized storage for organizationally approved design patterns
  • Blueprint definition – describing what should happen (reusable package) (Collection of azure components)
  • Blueprint assignment – describing where it should happen (package deployment) (Go to new subscription and create new blueprint assignment)

Cloud Adoption Framework for Azure

Cloud adoption is a strategic move by an organization to leverage cloud in their business

Cloud Adoption Framework

Cloud Adoption Framework for Azure is a set of

  • tools,
  • best practices,
  • guidelines and
  • documentation

prepared by Microsoft to help companies with their cloud adoption journey.

Strategy

1. Understand your motivation

  • Answer the question WHY MOVE?
  • Common Motivation Triggers include
    • Migration
      • Cost Savings on infrastructure
      • Reduction in complexity
      • Operation optimization
      • Increased business agility
    • Innovation
      • Reaching a global scale
      • Customer experience improvements
      • Transformation of products or services
      • Market disruption

2. Business Outcome

  • Answer the question WHAT TO MEASURE?
  • Defined, concise and observable outcome captured by a specific measure, for example
    • Increase in revenue
    • Increase in profit
    • Cost reduction
    • Global access to customers
    • Reaching new markets

3. Business Justification

  • Answer the question WHAT’S MY RETURN ON INVESTMENT?
  • Develop a business case to validate the financial model that supports your motivations and outcomes
  • Tools that support this process are
    • Azure TCO (Total Cost of Ownership) calculator – estimate current on-prem costs
    • Azure Pricing Calculator – estimate future Azure costs
    • Azure Cost Management – see current Azure costs

4. First Project

  • Choose first project to validate your strategy (Proof of concept – POC) based on
    • Business Criteria
      • Currently operating
      • Dedicated owner
      • Strong motivation to move
    • Technical Criteria
      • Minimum dependencies and assets

Plan

  1. Digital Estate (INVENTORY OF ASSETS)
    • Review current landscape and list all projects/solutions (digital assets)
    • Choose one of the five (5) R’s of rationalization
      • Rehost – move as is; typically into containers or IaaS (virtual machines)
      • Refactor – make small code changes and move to PaaS (ex. Azure SQL, Azure App Service, etc.)
      • Rearchitect – make complex code changes to introduce new features or fix incompatible apps
      • Rebuild – create a new application using cloud first design
      • Replace – review available SaaS solutions and replace legacy or unneeded applications
  2. Initial Organization Alignment
    • Align people so they will support your adoption plan
    • Map people to capabilities
  3. Skills Readiness Plan
    • Review current skills and address the gaps
  4. Cloud Adoption Plan – combine everything from steps 1 to 3 into a single cloud adoption plan

Ready

  1. Azure Setup Guide – Review the Azure setup guide to become familiar with the tools and approaches you need to use to create a landing zone.
  2. Azure Landing Zone – Choose an appropriate Azure Subscription type that best suits your needs and establish an initial Azure environment.
  3. Extend Landing Zone – Expand the initial landing zone to fit your business needs.
  4. Best Practices – Review everything and ensure best practices are followed.

Adopt

1. Migrate

  1. First Migration – migrate your first application to familiarize yourself with the cloud, guidelines and tools
  2. Migration Scenarios – review and prepare migration scenarios/guidelines for your company
    • Virtual Machines – Linux, Windows, etc.
    • Apps – Java, .NET, NodeJS web apps, etc.
    • Data – SQL Server, PostreSQL, File Servers, etc.
    • Other – VMware, Azure Stack, etc.
  3. Best Practices – address common migration needs through the application of consistent best practices.
  4. Process Improvements – important part of this porcess heavy activity is to identify bottlenecks and improve with every migration

2. Innovate

  1. Business Value Consensus (VALUE TO STRATEGY)
    1. Create hypothetical customer need
    2. Decide on solution that solves it
    3. Map this to your strategy
  2. Innovation Guide (TOOLS) – choose available Azure tools that will help your build this application
  3. Best Practices – verify that best practices are followed for all tools in the toolchain
  4. Process Improvements – gather feedback from the users and the customers to improve architectural decisions and future products

3. Govern & Manage

  1. Define governance solutions – Choose solutions to maintain compliance, security and ensure total control of the environment.
    • Those solutions should focus to
      • Address Business Needs
      • Provide Agility
      • Control Risks
  2. Manage cloud environment (CLOUD OPERATIONS) – Hand over solutions and environment to cloud operations team for maintenance. Team should ensure that stability and costs are always in perfect balance to meet business commitments. Team should allow environment to grow, evolve and adapt to changing business needs.

4. Organize

Ensure that everyone knows what to do and when to do it for every stage in this process. One of the ways to achieve this is via RACI (Responsible, Accountable, Consulted, and Informed) matrix.

Core tenets of Security, Privacy, Compliance

Describe the purpose of the

  • Document and Websites
    • Microsoft Privacy Statement,
    • Online Services Terms (OST)
    • Data Protection Amendment (DPA) (Amendment)
    • Trust Center
    • Azure compliance documentation
  • Azure Sovereign Regions
    • Azure Government cloud services and
    • Azure China cloud services
DOCUMENT/WEBSITEINFOOFFERSAUDIENCE
Microsoft Privacy StatementCollection, Purpose and Usage of Personal DataAll Microsoft offers including services, applications, websites, software, servers, devicesEveryone – end customers or companies
Online Services Terms (OST)Licensing Terms (legal agreement) – usage rights about Azure services. What can be done and what is forbidden.Microsoft Online Services like Azure, Microsoft 365 services, Bing Maps, etc.Organizations – legal teams
Data Protection AddendumAppending to OST describing obligations by both parties (Microsoft and you) with regards to the processing of customer and personal dataMicrosoft Online Services like Azure, Microsoft 365 services, Bing Maps, etc.Organizations – legal teams, security teams
Trust CenterOne stop shop web portal for everything related to security, compliance, privacy, policies, best practices, etc.Microsoft Online Services like Azure, Microsoft 365 services, Bing Maps, etc.Organizations – legal teams, security teams, business managers, administrators
Azure Compliance DocumentationWeb portal focusing on compliance offerings in Azure, simmilar to the trust center but narrowed downAzureOrganizations – legal teams, security teams, business managers, Azure administrators

Azure Sovereign Regions

Azure Sovereign Regions provide Azure services in markets with very strict regulatory requirements

  • Azure Government designed for the US government
    • Separate instance of Azure (lifecycle, services, portal, etc.)
    • Physically isolated from other Azure regions
    • Only autorized scanned personel can get access
  • Azure China designed for the Chinese market
    • Separate instance of Azure (lifecycle, services, portal, etc.)
    • Physically isolated from other Azure regions
    • Operated by a Chinese telecom company called 21Vianet

Cost Affecting Factors

  • Base Cost
    • Resource Types – All Azure services (resources) have resource-specific pricing models. Typically consisting of one or more metrics. (Metrics includes CPU, Memory, Storage, Uptime etc.)
    • Services – Azure specific offers (Enterprise, Web Direct, Cloud Solution Provider(CSP), etc.) have different cost and billing components like prepaids, billing cycles, – discounts, etc.
    • Location – running Azure services vary between Azure regions
    • Bandwidth – network traffic when uploading (inbound/ingress) data to Azure or downloading (outbound/egress) from Azure. Inbound is usually free but outbound not.
  • Savings (next discussion)
    • Reserved Instances
    • Hybrid Benefits
  • Logical objects don’t have any charge like subscription and resource group.
  • Azure Pricing Calculator allows you to estimate the cost of your azure environment before you purchase services.

Cost Reduction Methods

Azure Reservations

Purchase Azure services for 1 or 3 years in advance with a significant discounts

  • Reserved instances – Azure Virtual Machines
  • Reserved capacity – Azure Storage, SQL Database vCores, Databricks DBUs, Cosmos DB RUs
  • Software plans – Red Hat, Red Hat OpenShift, SUSE Linux, etc.
  • Reservations are made for 1 or 3 years

Azure Spot VMs

Purchase unused Virtual Machine capacity for significant discount

  • How it works
    • Significant discount for Azure VMs
    • Capacity can be taken away at any time
    • Customer can set maximum price after discount to keep or evict the machine
  • Best for interruptible workloads (batch processing, dev/test environments, large compute workloads, non-critical tasks, etc.)

Hybrid use Benefit

Use existing licenses in the cloud

  • Use existing licenses in the Azure (Using Hybrid Benefit)
    • Windows Server
      • Azure VM
    • RedHat
      • Azure VM
    • SUSE Linux
      • Azure VM
    • SQL Server
      • Azure SQL Database
      • Azure SQL Managed Instance
      • Azure SQL Server on VM
      • Azure Data Factory SQL Server Integration Services

Tools

  • Pricing calculator – estimate the cost of Azure services
    • Select service
    • Adjust parameters (usage)
    • View the price
  • Total Cost of Ownership (TCO) calculator – estimate and compare the cost of running workloads in datacenter versus Azure
    • Define your workloads
    • Adjust assumptions
    • View the report

Azure Cost Management

Azure Cost Management service (Cost Management + Billing)

  • A centralized service for reporting usage and billing of Azure environment
  • Self-service cost exploration capabilities
  • Budgets & alerts
  • Cost recommendations
  • Automated exports

Minimizing Costs in Azure

  1. Azure Pricing Calculator to choose the low-cost region
    • Good latency
    • All required services are available
    • Data sovereignty/compliance requirements
  2. Hybrid use benefit and Azure Reservations
  3. Azure Cost Management monitoring, budgets, alerts and recommendations
  4. Understand service lifecycle and automate environments
  5. Use autoscaling features to your advantage
  6. Azure Monitor to find and scale down underutilized resources
  7. Use tags & policies for effective governance

SLA and Composite SLA in Azure

Service Level Agreement (SLA) is a formal agreement between a service provider and a customer.

SLA is a promise of a service’s availability (uptime & connectivity). Availability is a measure of time that a service remains operational.

  • Each Service has its own SLA
  • Ranges from 99% to 99.999%
  • Free services typically don’t have an SLA
  • Broken SLA means service credit return (discount)
SLAMONTHLY DOWNTIME
99%7h 18m 17s
99.5%3h 39m 8s
99.9%43m 49s
99.95%21m 54s
99.99%4m 22s
99.999%26s

Composite SLA: 

Composite SLA is a combined SLA of all components in your application

Formulas

Logical AND – adding dependency

Availability of S1 AND S2 = Availability(S1) * Availability(S2)

Scenario – Azure website with SQL backend db

  • Availability = Availability(web) app * Availability(sql)
  • Availability = 99.95% * 99.95%
  • Availability = 0.9995 * 0.9995
  • Availability = 0.99900025
  • Availability ~ 99.9%

Logical OR – adding redundancy

Availability of S1 OR S2 = 100% – ( Unvailability(S1) * Unvailability(S2) )

Scenario – Two redundant web apps behind a load balancer

  • Availability(both-web) = 100% – ( Unvailability(web1) * Unvailability(web2) )
  • Availability(both-web) = 100% – ( 0.05% * 0.05% )
  • Availability(both-web) = 1 – ( 0.0005 * 0.0005 )
  • Availability(both-web) = 1 – 0.00000025
  • Availability(both-web) = 0.99999975
  • Availability(both-web) ~ 99.9999%

Key Items

  • Formal agreement between Microsoft & the customer
  • Calculated as a percentage of service availability (uptime & connetivity) (a promise)
  • Breaking the SLA provides a discount from the final monthly bill (Service Credit)
  • Higher tier services offer better SLAs
  • Free services typically have no SLA (0% SLA)
  • Preview services have no SLA
  • Composite SLA is a combined SLA of all application components

Service Lifecycle in Azure

Service Lifecycle

  • Every service in Azure follows its own service lifecycle
  • Public preview is a ‘beta’ stage of the service available to general public use
  • Features can also be in preview stages
  • Designed for testingnot production solutions
  • General availability is a ‘production’ release of the service

Untitled

Public Preview Key Info

  • No SLA
  • Some services have no support coverage
  • Limited region availability
  • Limited functionality
  • Pricing changes
  • Direction changes
  • Azure Portal Previews (https://preview.portal.azure.com)

Comments