More Related Content
Similar to AZ-900 Microsoft Azure Fundamentals.pptx (20)
AZ-900 Microsoft Azure Fundamentals.pptx
- 1. 1 AZ 900: Microsoft Azure Fundamentals Presented By: K P Verma
- 2. 2 Part 1 Describe Cloud Concepts Presented By: K P Verma
- 3. 3 Microsoft Azure Fundamentals • Microsoft Azure is a cloud computing platform with an ever-expanding set of services to help you build solutions to meet your business goals. • Azure has simple web services for hosting your business presence in the cloud. • Azure provides a wealth of cloud-based services like remote storage, database hosting, and centralized account management. • Azure also offers new capabilities like Artificial intelligence (AI) and Internet of Things (IoT) focused services. • Microsoft Azure Fundamentals contains: • Describe cloud concepts • Describe Azure architecture and services • Describe Azure management and governance
- 4. 4 What is cloud computing • Cloud computing is the delivery of computing services over the internet. • Computing services include common IT infrastructure such as virtual machines, storage, databases, and networking. • Cloud services also expand the traditional IT offerings to include things like Internet of Things (IoT), machine learning (ML), and artificial intelligence (AI).
- 5. 5 Shared Responsibility Model Traditional Model: The company is responsible for maintaining the physical space, ensuring security, and maintaining or replacing the servers if anything happens. • The IT department is responsible for maintaining all the infrastructure and software needed to keep the data center up and running. • They’re also likely to be responsible for keeping all systems patched and on the correct version. Shared Responsibility Model: these responsibilities get shared between the cloud provider and the consumer. • Physical security, power, cooling, and network connectivity are the responsibility of the cloud provider. • The consumer isn’t collocated with the data center, so it wouldn’t make sense for the consumer to have any of those responsibilities.
- 6. 6 Shared Responsibility Model • With an on-premises datacenter, you’re responsible for everything (Physical security, power, cooling, and network connectivity). • With cloud computing, those responsibilities shift. The shared responsibility model is heavily tied into the cloud service types (IaaS, PaaS, SaaS). • IaaS places the most responsibility on the consumer, with the cloud provider being responsible for the basics of physical security, power, and connectivity. • SaaS places most of the responsibility with the cloud provider. • PaaS, being a middle ground between IaaS and SaaS, rests somewhere in the middle and evenly distributes responsibility between the cloud provider and the consumer.
- 8. 8 Cloud Models • The cloud models define the deployment type of cloud resources. The three main cloud models are private, public, and hybrid. Public Cloud: A public cloud is built, controlled, and maintained by a third-party cloud provider. With a public cloud, anyone who wants to purchase cloud services can access and use resources. • The general public availability is a key difference between public and private clouds. Private Cloud: It’s a cloud that’s used by a single entity. It is hosted in a dedicated data center offsite. • Private cloud provides much greater control for the company and its IT department. • However, it also comes with greater cost and fewer of the benefits of a public cloud deployment. • A private cloud may be hosted from your on site datacenter. It may also be hosted in a dedicated datacenter offsite, potentially even by a third party that has dedicated that datacenter to your company. Hybrid Cloud: A hybrid cloud is a computing environment that uses both public and private clouds in an inter-connected environment. • Users can flexibly choose which services to keep in the public cloud and which to deploy to their private cloud infrastructure. So it provides an extra layer of security. • A hybrid cloud environment can be used to allow a private cloud to surge for increased, temporary demand by deploying public cloud resources. • Hybrid cloud can be used to provide an extra layer of security. For example, users can flexibly choose which services to keep in public cloud and which to deploy to their private cloud infrastructure.
- 9. 9 Cloud Models • Multi Cloud: in a multi-cloud environment you deal with two (or more) public cloud providers and manage resources and security in both environments. • Azure Arc: Azure Arc is a set of technologies that helps manage your cloud environment. Azure Arc can help manage your cloud environment, whether it's a public cloud solely on Azure, a private cloud in your datacenter, a hybrid configuration, or even a multi-cloud environment running on multiple cloud providers at once.
- 10. 10 Public vs. Private vs Hybrid Cloud
- 11. 11 Consumption Model • When comparing IT infrastructure models, there are two types of expenses to consider. Capital expenditure (CapEx) and operational expenditure (OpEx). CapEx is typically a one-time, up-front expenditure to purchase or secure tangible resources. A new building, repaving the parking lot, building a datacenter, or buying a company vehicle are examples of CapEx. OpEx is spending money on services or products over time. Renting a convention center, leasing a company vehicle, or signing up for cloud services are all examples of OpEx. • Cloud computing falls under OpEx because cloud computing operates on a consumption-based model. With cloud computing, you don’t pay for the physical infrastructure, the electricity, the security, or anything else associated with maintaining a datacenter. Instead, you pay for the IT resources you use. If you don’t use any IT resources this month, you don’t pay for any IT resources. Benefit of Consumption Model • No upfront costs. • No need to purchase and manage costly infrastructure that users might not use to its fullest potential. • The ability to pay for more resources when they're needed. • The ability to stop paying for resources that are no longer needed.
- 12. 12 Availability and Scalability in the cloud • When building or deploying a cloud application, two of the biggest considerations are uptime (or availability) and the ability to handle demand (or scale). High Availability focuses on ensuring maximum availability, regardless of disruptions or events that may occur. • Azure is a highly available cloud environment with uptime guarantees depending on the service. These guarantees are part of the service-level agreements (SLAs). • Scalability refers to the ability to adjust resources to meet demand. If you suddenly experience peak traffic and your systems are overwhelmed, the ability to scale means you can add more resources to better handle the increased demand. • The other benefit of scalability is that you aren't overpaying for services. Because the cloud is a consumption-based model, you only pay for what you use. If demand drops off, you can reduce your resources and thereby reduce your costs. • Vertical scaling is focused on increasing or decreasing the capabilities of resources. • Horizontal scaling is adding or subtracting the number of resources.
- 13. 13 Benefit on Cloud Computing High availability focuses on ensuring maximum availability, regardless of disruptions or events that may occur. • Azure is a highly available cloud environment with uptime guarantees depending on the service. These guarantees are part of the service-level agreements (SLAs). Scalability refers to the ability to adjust resources to meet demand. If you suddenly experience peak traffic and your systems are overwhelmed, the ability to scale means you can add more resources to better handle the increased demand. • Vertical Scaling: Vertical scaling is focused on increasing or decreasing the capabilities of resources. Ex. increasing processing power, CPU, RAM, etc. • Horizontal Scaling: Scaled in or out additional virtual machines or containers, Reliability: Reliability is the ability of a system to recover from failures and continue to function. It's also one of the pillars of the Microsoft Azure Well-Architected Framework. Predictability: Predictability can be focused on performance predictability (Autoscaling, load balancing, and high availability ) or cost predictability. • Both performance and cost predictability are heavily influenced by the Microsoft Azure Well-Architected Framework. • Tools for cost checking like the Total Cost of Ownership (TCO) or Pricing Calculator
- 14. 14 • Security and governance in the cloud • Whether you’re deploying IaaS or Saas, it ensures that all your deployed resources meet corporate standards and government regulatory requirements. • Management of the cloud: Management of the cloud speaks to managing your cloud resources. In the cloud, you can: • Automatically scale resource deployment based on need. • Deploy resources based on a preconfigured template, removing the need for manual configuration. • Monitor the health of resources and automatically replace failing resources. • Receive automatic alerts based on configured metrics, so you’re aware of performance in real time. • Management in the cloud: Management in the cloud speaks to how you’re able to manage your cloud environment and resources. You can manage these: • Through a web portal. • Using a command line interface. • Using APIs. • Using PowerShell. Benefit on Cloud Computing
- 15. 15 Cloud Service types • IaaS (Infrastructure as a Service) • In an IaaS model, the cloud provider is responsible for maintaining the hardware, network connectivity (to the internet), and physical security. • You’re responsible for everything else: operating system installation, configuration, and maintenance; network configuration; database and storage configuration; and so on. • It is the most flexible category of cloud services, as it provides you the maximum amount of control for your cloud resources. • In IaaS, you’re essentially renting the hardware in a cloud datacenter, but what you do with that hardware is up to you. • Ex. : Lift-and-shift migration, Testing and development, Amazon Web Services, Microsoft Azure • IaaS places the largest share of responsibility with you. The cloud provider is responsible for maintaining the physical infrastructure and its access to the internet. You’re responsible for installation and configuration, patching and updates, and security.
- 16. 16 • PaaS (Platform as a Service) • In a PaaS environment, the cloud provider maintains the physical infrastructure, physical security, and connection to the internet. • They also maintain the operating systems, middleware, development tools, and business intelligence services that make up a cloud solution. • PaaS is a middle ground between renting space in a data center (Iaas) and paying for a complete and deployed solution (software as a service). • Cloud provider is responsible for licensing or patching for operating systems and databases. • Ex. : Development Framework, Analytics or business intelligence • PaaS is well suited to provide a complete development environment without the headache of maintaining all the development infrastructure. • PaaS splits the responsibility between you and the cloud provider. The cloud provider is responsible for maintaining the physical infrastructure and its access to the internet, just like in IaaS. In the PaaS model, the cloud provider will also maintain the operating systems, databases, and development tools. Cloud Service types
- 17. 17 • SaaS (Software as a Service) • SaaS is the most complete cloud service model from a product perspective. It is renting or using a fully developed application. • SaaS model is the least flexible and requires the least amount of technical knowledge to use it. • Ex.: Email, Microsoft Office 365, financial software, messaging applications, and connectivity software, Business productivity applications. • While the SaaS model may be the least flexible, it’s also the easiest to get up and running. It requires the least amount of technical knowledge or expertise to fully employ. • SaaS is the model that places the most responsibility with the cloud provider and the least responsibility with the user. • In a SaaS environment you’re responsible for the data that you put into the system, the devices that you allow to connect to the system, and the users that have access. • Nearly everything else falls to the cloud provider. The cloud provider is responsible for physical security of the datacenters, power, network connectivity, and application development and patching. Cloud Service types
- 18. 18 Part II : Azure architecture and services
- 19. 19 Microsoft Azure • Azure gives you the freedom to build, manage, and deploy applications on a massive global network using your favorite tools and frameworks. • Azure Sandbox: Azure Sandbox is a collection of interdependent cloud computing configurations for implementing common Azure services on a single subscription. This collection provides a flexible and cost-effective sandbox environment for experimenting with Azure services and capabilities. • Create Azure Sandbox https://azure.microsoft.com/free
- 21. 21 • The core architectural components of Azure are: the physical infrastructure, and the management infrastructure. • Physical Infrastructure: The physical infrastructure for Azure starts with datacenters. • Azure has datacenters around the world. However, these individual datacenters aren’t directly accessible. • Datacenters are grouped into Azure Regions or Azure Availability Zones that are designed to help you achieve resiliency and reliability for your business-critical workloads. • Regions: A region is a geographical area on the planet that contains at least one, but potentially multiple datacenters that are nearby and networked together with a low-latency network. • Some services or virtual machine (VM) features are only available in certain regions, such as specific VM sizes or storage types. • There are also some global Azure services that don't require you to select a particular region, such as Microsoft Entra ID, Azure Traffic Manager, and Azure DNS. Azure Physical Infrastructure
- 22. 22 Availability Zones: Availability zones are physically separate datacenters within an Azure region. Each availability zone is made up of one or more datacenters equipped with independent power, cooling, and networking. • An availability zone is set up to be an isolation boundary. If one zone goes down, the other continues working. Availability zones are connected through high-speed, private fiber-optic networks. • To ensure resiliency, a minimum of three separate availability zones are present in all availability zone-enabled regions. However, not all Azure Regions currently support availability zones. Region Pairs: Most Azure regions are paired with another region within the same geography (such as US, Europe, or Asia) at least 300 miles away. • Not all Azure services automatically replicate data or automatically fall back from a failed region to cross-replicate to another enabled region. In these scenarios, recovery and replication must be configured by the customer. Azure Physical Infrastructure
- 23. 23 • Advantages of Region Pairs • If an extensive Azure outage occurs, one region out of every pair is prioritized to make sure at least one is restored as quickly as possible for applications hosted in that region pair. • Planned Azure updates are rolled out to paired regions one region at a time to minimize downtime and risk of application outage. • Data continues to reside within the same geography as its pair (except for Brazil South) for tax- and law-enforcement jurisdiction purposes. Most regions are paired in two directions, meaning they are the backup for the region that provides a backup for them (West US and East US back each other up). some regions, such as West India and Brazil South, are paired in only one direction. In a one-direction pairing, the Primary region does not provide backup for its secondary region. West India’s secondary region is South India, South India does not rely on West India. West India's secondary region is South India, but South India's secondary region is Central India. Brazil South is unique because it's paired with a region outside of its geography. Brazil South's secondary region is South Central US. The secondary region of South Central US isn't Brazil South. Sovereign regions are instances of Azure that are isolated from the main instance of Azure. Azure Physical Infrastructure
- 24. 24 Resource: A resource is the basic building block of Azure. Anything you create, provision, deploy, Virtual Machines (VMs), virtual networks, databases, cognitive services, etc. are all considered resources within Azure. Resource groups: Resource groups are simply groupings of resources. When you create a resource, you’re required to place it into a resource group. • Resource groups can't be nested, Subscriptions: subscriptions are a unit of management, billing, and scale. Similar to how resource groups are a way to logically organize resources, subscriptions allow you to logically organize your resource groups and facilitate billing. • An Azure subscription links to an Azure account, which is an identity in Microsoft Entra ID or in a directory that Microsoft Entra ID trusts. • An account can have multiple subscriptions, but it’s only required to have one. • There are two types of subscription boundaries Billing boundary and Access control boundary • Additional Azure subscriptions: Environments, Organizational structures, Billing Azure Management Infrastructure
- 25. 25 Azure Virtual Machines • With azure virtual machines (vms), you can create and use vms in the cloud. • Vms provide infrastructure as a service (iaas) in the form of a virtualized server and can be used in many ways. • Vms are an ideal choice when you need: • Total control over the operating system (OS). • The ability to run custom software. • To use custom hosting configurations. • An Azure VM gives you the flexibility of virtualization without having to buy and maintain the physical hardware that runs the VM. • However, as an IaaS offering, you still need to configure, update, and maintain the software that runs on the VM. • You can run single VMs for testing, development, or minor tasks. Or you can group VMs together to provide high availability, scalability, and redundancy.
- 26. 26 when to use VMs • During testing and development • When running applications in the cloud • When extending your data center to the cloud • During disaster recovery
- 27. 27 Azure Virtual Desktop • Another type of virtual machine is the Azure Virtual Desktop. • Azure Virtual Desktop is a desktop and application virtualization service that runs on the cloud. • It enables you to use a cloud-hosted version of Windows from any location. • Azure Virtual Desktop works across devices and operating systems, and works with apps that you can use to access remote desktops or most modern browsers. • Azure Virtual Desktop provides centralized security management for users' desktops with Microsoft Entra ID. • You can enable multifactor authentication to secure user sign-ins. • You can also secure access to data by assigning granular role-based access controls (RBACs) to users.
- 28. 28 Azure Containers • Containers are a virtualization environment. • Much like running multiple virtual machines on a single physical host, you can run multiple containers on a single physical or virtual host. • Unlike virtual machines, you don't manage the operating system for a container. • Virtual machines appear to be an instance of an operating system that you can connect to and manage. • Containers are lightweight and designed to be created, scaled out, and stopped dynamically. • It's possible to create and deploy virtual machines as application demand increases, but containers are a lighter-weight, more agile method. • Containers are designed to allow you to respond to changes on demand. • With containers, you can quickly restart if there's a crash or hardware interruption. • One of the most popular container engines is Docker, and Azure supports Docker.
- 29. 29 application hosting options Azure App Service • App Service enables you to build and host web apps, background jobs, mobile back- ends, and RESTful APIs in the programming language of your choice without managing infrastructure. • It offers automatic scaling and high availability. • App Service supports Windows and Linux. • It enables automated deployments from GitHub, Azure DevOps, or any Git repo to support a continuous deployment model. • Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. • It supports multiple languages, including .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. It also supports both Windows and Linux environments. • Types of app services: Web apps, API apps, WebJobs, Mobile apps
- 30. 30 Azure Virtual Networking • Azure virtual networks and virtual subnets enable Azure resources, such as VMs, web apps, and databases, to communicate with each other, with users on the internet, and with your on-premises client computers. • You can think of an Azure network as an extension of your on-premises network with resources that link other Azure resources • Azure virtual networks provide the following key networking capabilities: • Isolation and segmentation : Azure virtual network allows you to create multiple isolated virtual networks. • Internet communications : You can enable incoming connections from the internet by assigning a public IP address to an Azure resource, or putting the resource behind a public load balancer.
- 31. 31 Azure Virtual Networking • Communicate between Azure resources: Virtual networks can connect not only VMs but other Azure resources, such as the App Service Environment for Power Apps, Azure Kubernetes Service, and Azure virtual machine scale sets. Service endpoints can connect to other Azure resource types, such as Azure SQL databases and storage accounts. • Communicate with on-premises resources: Azure virtual networks enable you to link resources together in your on-premises environment and within your Azure subscription. • Route network traffic: By default, Azure routes traffic between subnets on any connected virtual networks, on-premises networks, and the internet. • Filter network traffic: Azure virtual networks enable you to filter traffic between subnets using Network security groups and Network virtual appliances • Connect virtual networks: You can link virtual networks together by using virtual network peering. Peering allows two virtual networks to connect directly to each other. Network traffic between peered networks is private, and travels on the Microsoft backbone network, never entering the public internet. Peering enables resources in each virtual network to communicate with each other.
- 32. 32 Azure Virtual Private Networking • A virtual private network (VPN) uses an encrypted tunnel within another network. • VPNs are typically deployed to connect two or more trusted private networks to one another over an untrusted network (typically the public internet). Traffic is encrypted while traveling over the untrusted network to prevent eavesdropping or other attacks. • VPNs can enable networks to safely and securely share sensitive information. • A VPN gateway is a type of virtual network gateway. Azure VPN Gateway instances are deployed in a dedicated subnet of the virtual network and enable the following connectivity: • Connect on-premises datacenters to virtual networks through a site-to-site connection. • Connect individual devices to virtual networks through a point-to-site connection. • Connect virtual networks to other virtual networks through a network-to-network connection. • All data transfer is encrypted inside a private tunnel as it crosses the internet. • You can deploy only one VPN gateway in each virtual network. However, you can use one gateway to connect to multiple locations, which includes other virtual networks or on-premises datacenters.
- 33. 33 Azure VPN Types • Policy-based VPN gateways specify statically the IP address of packets that should be encrypted through each tunnel. • This type of device evaluates every data packet against those sets of IP addresses to choose the tunnel where that packet is going to be sent through. • Route-based gateways: IPSec tunnels are modeled as a network interface or virtual tunnel interface. IP routing (either static routes or dynamic routing protocols) decides which one of these tunnel interfaces to use when sending each packet. • Route-based VPNs are the preferred connection method for on-premises devices. They're more resilient to topology changes such as the creation of new subnets. • Use a route-based VPN gateway if you need any of the following types of connectivity: • Connections between virtual networks • Point-to-site connections • Multisite connections • Coexistence with an Azure ExpressRoute gateway
- 34. 34 Azure ExpressRoute • Azure ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection, with the help of a connectivity provider. This connection is called an ExpressRoute Circuit. • With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Microsoft 365. • This feature allows you to connect offices, datacenters, or other facilities to the Microsoft cloud. Each location would have its own ExpressRoute circuit. • Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a colocation facility. • ExpressRoute connections don't go over the public Internet. • This setup allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet.
- 35. 35 Features & Benefits of Azure ExpressRoute • Connectivity to Microsoft cloud services across all regions in the geopolitical region. • Global connectivity to Microsoft services across all regions with the ExpressRoute Global Reach. • Dynamic routing between your network and Microsoft via Border Gateway Protocol (BGP). • Built-in redundancy in every peering location for higher reliability. • ExpressRoute enables direct access to the following services in all regions: Microsoft Office 365, Microsoft Dynamics 365, Azure compute services (such as Azure Virtual Machines), Azure cloud services (such as Azure Cosmos DB and Azure Storage) • ExpressRoute uses the BGP. BGP is used to exchange routes between on-premises networks and resources running in Azure. • ExpressRoute connectivity models: CloudExchange colocation, Point-to-point Ethernet connection, Any-to-any connection, Directly from ExpressRoute sites
- 36. 36 Azure DNS • Azure DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure. • Benefits of Azure DNS: Reliability and performance, Security, Ease of Use, Customizable virtual networks, Alias records • You can't use Azure DNS to buy a domain name. For an annual fee, you can buy a domain name by using App Service domains or a third-party domain name registrar. Once purchased, your domains can be hosted in Azure DNS for record management.
- 37. 37 Azure Storage Services • A storage account provides a unique namespace for your Azure Storage data that's accessible from anywhere in the world over HTTP or HTTPS. Data in this account is secure, highly available, durable, and massively scalable. • Azure Storage Services Types : • Locally redundant storage (LRS) • Geo-redundant storage (GRS) • Read-access geo-redundant storage (RA-GRS) • Zone-redundant storage (ZRS) • Geo-zone-redundant storage (GZRS) • Read-access geo-zone-redundant storage (RA-GZRS) • Storage account endpoints: The combination of the account name and the Azure Storage service endpoint forms the endpoints for your storage account. • Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only. • Your storage account name must be unique within Azure. No two storage accounts can have the same name. This supports the ability to have a unique, accessible namespace in Azure.
- 38. 38 Azure Storage Services End Points •
- 39. 39 Azure Storage Services • Azure Blobs: Azure Blob storage is an object storage solution for the cloud. It can store massive amounts of data, such as text or binary data. Azure Blob storage is unstructured, meaning that there are no restrictions on the kinds of data it can hold. Blob storage can manage thousands of simultaneous uploads, massive amounts of video data, constantly growing log files, and can be reached from anywhere with an internet connection. • Azure Files: Azure File storage offers fully managed file shares in the cloud that are accessible via the industry standard Server Message Block (SMB) or Network File System (NFS) protocols. Azure Files file shares can be mounted concurrently by cloud or on-premises deployments. • Azure Queues: A messaging store for reliable messaging between application components. Azure Queue storage is a service for storing large numbers of messages. Once stored, you can access the messages from anywhere in the world via authenticated calls using HTTP or HTTPS. A queue can contain as many messages as your storage account has room for (potentially millions). Each individual message can be up to 64 KB in size. Queues are commonly used to create a backlog of work to process asynchronously. • Azure Disks: Block-level storage volumes for Azure VMs. • Azure Tables: NoSQL table option for structured, non-relational data.
- 40. 40 Azure file movement options • AzCopy: AzCopy is a command-line utility that you can use to copy blobs or files to or from your storage account. With AzCopy, you can upload files, download files, copy files between storage accounts, and even synchronize files. AzCopy can even be configured to work with other cloud providers to help move files back and forth between clouds. • Synchronizing blobs or files with AzCopy is one-direction synchronization. When you synchronize, you designated the source and destination, and AzCopy will copy files or blobs in that direction. It doesn't synchronize bi-directionally based on timestamps or other metadata. • Azure Storage Explorer is a standalone app that provides a graphical interface to manage files and blobs in your Azure Storage Account. It works on Windows, macOS, and Linux operating systems and uses AzCopy on the backend to perform all of the file and blob management tasks. With Storage Explorer, you can upload to Azure, download from Azure, or move between storage accounts. • Azure File Sync is a tool that lets you centralize your file shares in Azure Files and keep the flexibility, performance, and compatibility of a Windows file server. It’s almost like turning your Windows file server into a miniature content delivery network. Once you install Azure File Sync on your local Windows server, it will automatically stay bi-directionally synced with your files in Azure.
- 41. 41 Azure directory services • Microsoft Entra ID is a directory service that enables you to sign in and access both Microsoft cloud applications and cloud applications that you develop. Microsoft Entra ID can also help you maintain your on-premises Active Directory deployment. It is Microsoft's cloud-based identity and access management service. With Microsoft Entra ID, you control the identity accounts, but Microsoft ensures that the service is available globally. • It is for IT administrators, App developers, Users, Online service subscribers. • It provides services such as: Authentication, Single sign-on, Application management, Device management • Microsoft Entra Domain Services is a service that provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication. • Microsoft Entra Domain Services integrates with your existing Microsoft Entra tenant. This integration lets users sign into services and applications connected to the managed domain using their existing credentials.
- 42. 42 Azure authentication methods Single sign-on (SSO) enables a user to sign in one time and use that credential to access multiple resources and applications from different providers. For SSO to work, the different applications and providers must trust the initial authenticator. Multifactor authentication is the process of prompting a user for an extra form (or factor) of identification during the sign- in process. MFA helps protect against a password compromise in situations where the password was compromised but the second factor wasn’t. • Microsoft Entra multifactor authentication is a Microsoft service that provides multifactor authentication capabilities. It enables users to choose an additional form of authentication during sign-in, such as a phone call or mobile app notification. Passwordless authentication needs to be set up on a device before it can work. For example, your computer is something you have. Once it’s been registered or enrolled, Azure now knows that it’s associated with you. Now that the computer is known, once you provide something you know or are (such as a PIN or fingerprint), you can be authenticated without using a password. Microsoft global Azure offer three passwordless authentication options that integrate with Microsoft Entra ID: • Windows Hello for Business: it is ideal for information workers that have their own designated Windows PC. The biometric and PIN credentials are directly tied to the user's PC, which prevents access from anyone other than the owner. • Microsoft Authenticator app: Users can sign-in to any platform or browser by getting a notification to their phone, matching a number displayed on the screen to the one on their phone, and then using their biometric (touch or face) or PIN to confirm. • FIDO2 security keys: The FIDO (Fast IDentity Online) security keys are typically USB devices, but could also use Bluetooth or NFC. With a hardware device that handles the authentication, the security of an account is increased as there's no password that could be exposed or guessed.
- 43. 43 Azure external identities An external identity is a person, device, service, etc. that is outside your organization. Microsoft Entra External ID refers to all the ways you can securely interact with users outside of your organization. It may sound similar to single sign-on. The following capabilities make up External Identities: Business to business (B2B) collaboration - Collaborate with external users by letting them use their preferred identity to sign-in to your Microsoft applications or other enterprise applications (SaaS apps, custom-developed apps, etc.). B2B collaboration users are represented in your directory, typically as guest users. B2B direct connect - Establish a mutual, two-way trust with another Microsoft Entra organization for seamless collaboration. B2B direct connect currently supports Teams shared channels, enabling external users to access your resources from within their home instances of Teams. B2B direct connect users aren't represented in your directory, but they're visible from within the Teams shared channel and can be monitored in Teams admin center reports. Microsoft Azure Active Directory business to customer (B2C) - Publish modern SaaS apps or custom- developed apps (excluding Microsoft apps) to consumers and customers, while using Azure AD B2C for identity and access management.
- 44. 44 Azure conditional access Conditional Access is a tool that Microsoft Entra ID uses to allow (or deny) access to resources based on identity signals. These signals include who the user is, where the user is, and what device the user is requesting access from. Conditional Access helps IT administrators: Empower users to be productive wherever and whenever. Protect the organization's assets. • Conditional Access is useful when you need to: • Require multifactor authentication (MFA) to access an application depending on the requester’s role, location, or network. For example, you could require MFA for administrators but not regular users or for people connecting from outside your corporate network. • Require access to services only through approved client applications. For example, you could limit which email applications are able to connect to your email service. • Require users to access your application only from managed devices. A managed device is a device that meets your standards for security and compliance. • Block access from untrusted sources, such as access from unknown or unexpected locations.
- 45. 45 Other accesses Role-based access control is applied to a scope, which is a resource or set of resources that this access applies to. This Scopes include: A management group (a collection of multiple subscriptions), A single subscription, A resource group, A single resource. Zero Trust is a security modelthat assumes the worst case scenario and protects resources with that expectation. Zero Trust assumes breach at the outset, and then verifies each request as though it originated from an uncontrolled network. A defense-in-depth strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data. Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure. This approach removes reliance on any single layer of protection. It slows down an attack and provides alert information that security teams can act upon, either automatically or manually Layers are : Physical Securoty, Identity & Access, Perimeter, Network, Compute, Application, Data Defender for Cloud is a monitoring tool for security posture management and threat protection. It monitors your cloud, on-premises, hybrid, and multi-cloud environments to provide guidance and notifications aimed at strengthening your security posture.
- 46. 46 Part III : Azure management and governance
- 47. 47 Azure Cost Factor That OpEx (capital expense) cost can be impacted by many factors. Like : Resource type, Consumption, Maintenance, Geography, Subscription type, Azure Marketplace The pricing calculator and the total cost of ownership (TCO) calculator are two calculators that help you understand potential Azure expenses. Both calculators are accessible from the internet, and both calculators allow you to build out a configuration. The pricing calculator is designed to give you an estimated cost for provisioning resources in Azure. The pricing calculator’s focus is on the cost of provisioned resources in Azure. The Pricing calculator is for information purposes only. The prices are only an estimate. Nothing is provisioned when you add resources to the pricing calculator, and you won't be charged for any services you select. The TCO calculator (total cost of ownership) is designed to help you compare the costs for running an on- premises infrastructure compared to an Azure Cloud infrastructure.
- 48. 48 Microsoft Cost Management tool • Cost Management provides the ability to quickly check Azure resource costs, create alerts based on resource spend, and create budgets that can be used to automate management of resources. • Cost analysis is a subset of Cost Management that provides a quick visual for your Azure costs. Using cost analysis, you can quickly view the total cost in a variety of different ways, including by billing cycle, region, resource, and so on. • Cost alerts provide a single location to quickly check on all of the different alert types that may show up in the Cost Management service. Like Budget alerts, Credit alerts, Department spending quota alerts.
- 49. 49 Microsoft Purview • Microsoft Purview is a family of data governance, risk, and compliance solutions that helps you get a single, unified view into your data. Microsoft Purview brings insights about your on-premises, multicloud, and software-as-a-service data together. • Two main solution areas comprise Microsoft Purview: risk and compliance and unified data governance. Microsoft Purview, by managing and monitoring your data (Risk and Compliance) • Protect sensitive data across clouds, apps, and devices, • Identify data risks and manage regulatory compliance requirements, • Get started with regulatory compliance. Microsoft Purview’s unified data governance helps your organization: • Create an up-to-date map of your entire data estate that includes data classification and end-to-end lineage. • Identify where sensitive data is stored in your estate. • Create a secure environment for data consumers to find valuable data. • Generate insights about how your data is stored and used. • Manage access to the data in your estate securely and at scale.
- 50. 50 Azure Policy • Azure Policy is a service in Azure that enables you to create, assign, and manage policies that control or audit your resources. These policies enforce different rules across your resource configurations so that those configurations stay compliant with corporate standards. • Azure Policy enables you to Monitor missing Endpoint Protection in Security Center , known as initiatives. Azure Policy evaluates your resources and highlights resources that aren't compliant with the policies you've created. Azure Policy can also prevent noncompliant resources from being created. • Azure Policies can be set at each level, enabling you to set policies on a specific resource, resource group, subscription, and so on. Also These Policies are inherited, so if you set a policy at a high level, it will automatically be applied to all of the groupings that fall within the parent. • Azure Policy comes with built-in policy and initiative definitions for Storage, Networking, Compute, Security Center, and Monitoring. • Azure Policy also integrates with Azure DevOps by applying any continuous integration and delivery pipeline policies that pertain to the pre-deployment and post-deployment phases of your applications. An Azure Policy initiative is a way of grouping related policies together. • Under this initiative, the following policy definitions are included: Monitor unencrypted SQL Database in Security Center, Monitor OS vulnerabilities in Security Center, Monitor missing Endpoint Protection in Security Center
- 51. 51 Resource Lock • A resource lock prevents resources from being accidentally deleted or changed. • Resource locks can be applied to individual resources, resource groups, or even an entire subscription. Resource locks are inherited, meaning that if you place a resource lock on a resource group, all of the resources within the resource group will also have the resource lock applied. • There are two types of resource locks, one that prevents users from deleting and one that prevents users from changing or deleting a resource.
- 52. 52 Microsoft Service Trust Portal • The Microsoft Service Trust Portal is a portal that provides access to various content, tools, and other resources about Microsoft security, privacy, and compliance practices. • The Service Trust Portal contains details about Microsoft's implementation of controls and processes that protect our cloud services and the customer data therein. To access some of the resources on the Service Trust Portal, you must sign in as an authenticated user with your Microsoft cloud services account (Microsoft Entra organization account).
- 53. 53 Azure Interaction Tools The Azure portal is a web-based, unified console that provides an alternative to command-line tools. With the Azure portal, you can manage your Azure subscription by using a graphical user interface. Azure Cloud Shell is a browser-based shell tool that allows you to create, configure, and manage Azure resources using a shell. Azure Cloud Shell support both Azure PowerShell and the Azure Command Line Interface (CLI), which is a Bash shell. • It is a browser-based shell experience, with no local installation or configuration required. Azure PowerShell is a shell with which developers, DevOps, and IT professionals can run commands called command-lets (cmdlets). These commands call the Azure REST API to perform management tasks in Azure. The Azure CLI is functionally equivalent to Azure PowerShell, with the primary difference being the syntax of commands. While Azure PowerShell uses PowerShell commands, the Azure CLI uses Bash commands. • The Azure CLI provides the same benefits of handling discrete tasks or orchestrating complex operations through code. It’s also installable on Windows, Linux, and Mac platforms, as well as through Azure Cloud Shell.
- 54. 54 Azure Arc • Azure Arc simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform. • Azure Arc provides a centralized, unified way to: • Manage your entire environment together by projecting your existing non-Azure resources into ARM (Azure Resource Manager). • Manage multi-cloud and hybrid virtual machines, Kubernetes clusters, and databases as if they are running in Azure. • Use familiar Azure services and management capabilities, regardless of where they live. • Continue using traditional ITOps while introducing DevOps practices to support new cloud and native patterns in your environment. • Configure custom locations as an abstraction layer on top of Azure Arc-enabled Kubernetes clusters and cluster extensions. • Currently, Azure Arc allows you to manage the following resource types hosted outside of Azure: • Servers • Kubernetes clusters • Azure data services • SQL Server • Virtual machines (preview)
- 55. 55 Azure Resource Manager • Azure Resource Manager (ARM) is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure account. Anytime you do anything with your Azure resources, ARM is involved. • When a user sends a request from any of the Azure tools, APIs, or SDKs, ARM receives the request. ARM authenticates and authorizes the request. Then, ARM sends the request to the Azure service, which takes the requested action. Azure Resource Manager benefits • Manage your infrastructure through declarative templates rather than scripts. A Resource Manager template is a JSON file that defines what you want to deploy to Azure. • Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually. • Re-deploy your solution throughout the development life-cycle and have confidence your resources are deployed in a consistent state. • Define the dependencies between resources, so they're deployed in the correct order. • Apply access control to all services because RBAC is natively integrated into the management platform. • Apply tags to resources to logically organize all the resources in your subscription. • Clarify your organization's billing by viewing costs for a group of resources that share the same tag.
- 56. 56 ARM template and Bicep Azure Resource Manager Template • By using ARM templates, you can describe the resources you want to use in a declarative JSON format. With an ARM template, the deployment code is verified before any code is run. This ensures that the resources will be created and connected correctly. The template then orchestrates the creation of those resources in parallel. That is, if you need 50 instances of the same resource, all 50 instances are created at the same time. • Benefits of ARM template: Declarative syntax, Repeatable results, Orchestration, Modular files, Extensibility Bicep • Bicep is a language that uses declarative syntax to deploy Azure resources. A Bicep file defines the infrastructure and configuration. Then, ARM deploys that environment based on your Bicep file. While similar to an ARM template, which is written in JSON, Bicep files tend to use a simpler, more concise style. • Benefits of Bicep: Support for all resource types and API versions, Simple syntax, Repeatable results, Orchestration, Modularity
- 57. 57 Azure Advisor • Azure Advisor evaluates your Azure resources and makes recommendations to help improve reliability, security, and performance, achieve operational excellence, and reduce costs. • Azure Advisor is designed to help you save time on cloud optimization. The recommendation service includes suggested actions you can take right away, postpone, or dismiss. • The recommendations are divided into five categories: • Reliability is used to ensure and improve the continuity of your business-critical applications. • Security is used to detect threats and vulnerabilities that might lead to security breaches. • Performance is used to improve the speed of your applications. • Operational Excellence is used to help you achieve process and workflow efficiency, resource manageability, and deployment best practices. • Cost is used to optimize and reduce your overall Azure spending.
- 58. 58 Azure Service Health • Azure Service Health helps you keep track of Azure resource, both your specifically deployed resources and the overall status of Azure. Azure service health does this by combining three different Azure services: • Azure Status is a broad picture of the status of Azure globally. Azure Status page is a global view of the health of all Azure services across all Azure regions. It’s a good reference for incidents with widespread impact. • Service Health provides a narrower view of Azure services and regions. It focuses on the Azure services and regions you're using. • Resource Health is a tailored view of your actual Azure resources. It provides information about the health of your individual cloud resources, such as a specific virtual machine instance. Using Azure Monitor, you can also configure alerts to notify you of availability changes to your cloud resources. • By using Azure status, Service health, and Resource Health, Azure Service Health gives you a complete view of your Azure environment-all the way from the global status of Azure services and regions down to specific resources.
- 59. 59 Azure Monitor Azure Monitor is a platform for collecting data on your resources, analyzing that data, visualizing the information, and even acting on the results. Azure Monitor can monitor Azure resources, your on-premises resources, and even multi-cloud resources like virtual machines hosted with a different cloud provider. Azure Log Analytics is the tool in the Azure portal where you’ll write and run log queries on the data gathered by Azure Monitor. Log Analytics is a robust tool that supports both simple, complex queries, and data analysis. Azure Monitor Alerts are an automated way to stay informed when Azure Monitor detects a threshold being crossed. You set the alert conditions, the notification actions, and then Azure Monitor Alerts notifies when an alert is triggered. Depending on your configuration, Azure Monitor Alerts can also attempt corrective action. Application Insights, an Azure Monitor feature, monitors your web applications. Application Insights is capable of monitoring applications that are running in Azure, on-premises, or in a different cloud environment.
- 60. 60 Thanks for the Attention Presented By: K P Verma