Published simultaneously in Canada

ISBN: 978-1-11959657-8

ISBN: 978-1-119-59653-0 (ebk.)

ISBN: 978-1-119-59660-8 (ebk.)

Manufactured in the United States of America

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2019947400

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. Microsoft and Azure are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

CONTENTS

Cover

Acknowledgments

About the Author

Introduction

Chapter 1 The Cloud and Microsoft Azure Fundamentals

The Evolution of the Datacenter
Microsoft Azure 101
Getting Access to Microsoft Azure
Reserved Instances and Azure Hybrid Benefit
Increasing Azure Limits
The Azure Portal

Chapter 2 Governance

What Is Governance?
Understanding Governance Requirements in Your Organization
Azure Subscriptions and Management Groups
Resource Groups
Role-Based Access Control
Naming Conventions
Using Tags
Azure Policy
Azure Templates
Azure Blueprints
Azure Resource Graph
Cost Management

Chapter 3 Identity

The Importance of Identity
A Brief Refresher on Active Directory
Using Cloud Services, Federation, and Cloud Authentication
Azure Active Directory Fundamentals

Chapter 4 Identity Security and Extended Identity Services

Azure AD Security
Azure AD B2C
Active Directory in the Cloud

Chapter 5 Networking

Connectivity
Protection
Delivery
Monitoring

Chapter 6 Storage

Azure Storage Services
Storage with Azure VMs
Bulk Data Options
Azure Database Offerings

Chapter 7 Azure Compute

Virtual Machines
Platform as a Service Offerings

Chapter 8 Azure Stack

Azure Stack Foundation
Managing Azure Stack
Understanding Azure Stack HCI

Chapter 9 Backup, High Availability, Disaster Recovery, and Migration

Availability 101
Backups in Azure
High Availability in Azure
Disaster Recovery in Azure
Migrating Workloads to Azure

Chapter 10 Monitoring and Security

Azure Monitoring
Security in Azure

Chapter 11 Managing Azure

Command Line, Scripting, and Automation with Azure
Deploying Resources with ARM JSON Templates
Additional Useful Technologies for Azure Management

Chapter 12 What to Do Next

Understanding and Addressing Azure Barriers
Why You Should Use Azure and Getting Started

Index

End User License Agreement

List of Illustrations

Chapter 1

Figure 1.1 The three axes of datacenter planning
Figure 1.2 A high-level view of a virtualization host and resources assigned to virtual ma...
Figure 1.3 The key types of highly variable workloads that are a great fit for consumption...
Figure 1.4 The responsibility levels for different types of “as a Service”
Figure 1.5 A more detailed view of responsibilities for different PaaS offerings
Figure 1.6 Various types of Pizza as a Service
Figure 1.7 Scale out vs. scale up
Figure 1.8 Example availability set deployment
Figure 1.9 Availability zone architecture
Figure 1.10 Resilient service using multiple constructs
Figure 1.11 Regional network gateway architecture
Figure 1.12 An old view of available Azure services
Figure 1.13 How resource providers fit in the Azure Resource Manager architecture
Figure 1.14 Viewing the resource providers via the Resource Explorer
Figure 1.15 Viewing billing information for Azure subscriptions
Figure 1.16 The hierarchy when using an enterprise enrollment
Figure 1.17 Possible methodologies for enterprise enrollment account setup
Figure 1.18 A simple RI example
Figure 1.19 A more complex RI example using instance size flexibility
Figure 1.20 Enabling Azure Hybrid Benefit for an existing VM
Figure 1.21 The prompt to create a free account when your identity has no access to Azure s...
Figure 1.22 The Azure portal structure
Figure 1.23 Using the navigation tree in the portal
Figure 1.24 The Azure portal command bar
Figure 1.25 Customizing a dashboard
Figure 1.26 Viewing shared dashboards

Chapter 2

Figure 2.1 Basic Compliance Manager dashboard
Figure 2.2 Tracking customer-managed controls
Figure 2.3 Moving a subscription to a new Azure AD tenant
Figure 2.4 An example management group hierarchy
Figure 2.5 Common ID between the root management group and the Azure AD tenant
Figure 2.6 Enabling access for all subscriptions and management groups under the Azure AD ...
Figure 2.7 The wonderous things you can do with your new management group
Figure 2.8 Accessing the properties of a management group
Figure 2.9 Viewing the roles available for assignment at a resource group level, and then ...
Figure 2.10 A slightly modified icon for a custom role
Figure 2.11 Switching to PIM-based role resource management.
Figure 2.12 Changing the scope for Azure PIM role assignment.
Figure 2.13 Whiteboarding output of tags taxonomy discussion
Figure 2.14 How governance and policy fits into the core of Azure Resource Manager
Figure 2.15 Overview page of Policy
Figure 2.16 Assigning a policy
Figure 2.17 Definition configuration as part of initiative
Figure 2.18 A simple blueprint
Figure 2.19 Assigning a blueprint to a subscription
Figure 2.20 The cost optimization cycle
Figure 2.21 Basic cost analysis with resources grouped by type
Figure 2.22 Adding a new filter
Figure 2.23 Changing the type of chart
Figure 2.24 Creating a budget
Figure 2.25 Viewing advisor cost recommendations
Figure 2.26 VM recommendation options

Chapter 3

Figure 3.1 SAML flow for federation
Figure 3.2 Simple token flow
Figure 3.3 More advanced token flow
Figure 3.4 Viewing some of the built-in federated applications
Figure 3.5 Creating a new Azure AD instance
Figure 3.6 Some architectural elements of Azure AD
Figure 3.7 Matching ImmutableID to ObjectGUID
Figure 3.8 Replicating objects to different AAD instances
Figure 3.9 A custom domain as the primary domain for my Azure AD instance
Figure 3.10 The Microsoft 365 admin center shows details on directory sync
Figure 3.11 The connector accounts used by Azure AD Connect
Figure 3.12 Filtering the objects that will replicate to Azure AD
Figure 3.13 Viewing basic Azure AD Connect status
Figure 3.14 Azure AD Connect Health information for Azure AD Connect
Figure 3.15 Azure AD Connect Health information for AD DS
Figure 3.16 Third-party inbound provisioning to Azure AD
Figure 3.17 Overview of Azure AD B2B
Figure 3.18 OTP usage flow
Figure 3.19 Enabling OTPs
Figure 3.20 High-level flow of pass-through authentication
Figure 3.21 High-level flow of federated authentication
Figure 3.22 Modified token flow with federation in the picture
Figure 3.23 Computer account in AD representing Azure AD
Figure 3.24 Required configuration for Seamless Sign-on
Figure 3.25 Enabling Enterprise State Roaming
Figure 3.26 A simple dynamic group rule
Figure 3.27 User vs. Group Management Properties
Figure 3.28 Adding an application to Azure AD tenant
Figure 3.29 User settings related to enterprise application
Figure 3.30 User vs. admin consent scopes
Figure 3.31 Example MyApps portal experience
Figure 3.32 MyApps browser extension providing easy access to applications

Chapter 4

Figure 4.1 Using an OATH token
Figure 4.2 User Security Info interface
Figure 4.3 Using password reset registration requirements
Figure 4.4 The building blocks of conditional access
Figure 4.5 Forcing re-registration of MFA
Figure 4.6 Diagnostic settings for Azure AD
Figure 4.7 Some of the information available via Log Analytics views
Figure 4.8 Change the resource filter to apply ARM roles at different resource levels
Figure 4.9 An example timeline of activities detected by Azure ATP
Figure 4.10 Basic Azure AD Application Proxy flow
Figure 4.11 Adding identity providers for a B2C instance

Chapter 5

Figure 5.1 Viewing the address space for virtual subnets
Figure 5.2 A public IP address in East US
Figure 5.3 The non-transitive nature of network peering
Figure 5.4 ExpressRoute high-level view
Figure 5.5 Route exchange with BGP
Figure 5.6 Example route filter
Figure 5.7 An example Azure Virtual WAN deployment
Figure 5.8 Traffic control can be achieved using network security groups.
Figure 5.9 Possible NVA deployment with load balancers
Figure 5.10 Traffic flow with NAT
Figure 5.11 Components used with Application Gateway
Figure 5.12 Example Traffic Manager usage scenario
Figure 5.13 High-level Azure Front Door architecture
Figure 5.14 Split TCP detail

Chapter 6

Figure 6.1 Azure Storage architecture and its interaction with Azure compute services
Figure 6.2 An example Azure Storage account showing many of the key attributes
Figure 6.3 Displaying the access keys for a storage account
Figure 6.4 Portal screen for creating a SAS
Figure 6.5 Blob storage pricing
Figure 6.6 Blobs in different access tiers
Figure 6.7 An example Azure table
Figure 6.8 The computer account for the storage account in my managed AAD DS instance
Figure 6.9 Restore options for a file restore
Figure 6.10 Endpoint cloud tiering options
Figure 6.11 Replication of data in a sync group
Figure 6.12 The storage of an Azure VM
Figure 6.13 Availability sets with aligned managed disks
Figure 6.14 Consistency models in Cosmos DB

Chapter 7

Figure 7.1 The layers for IaaS
Figure 7.2 Key cost considerations for on premises and Azure
Figure 7.3 B series credits consumed
Figure 7.4 B series credits remaining
Figure 7.5 Quick Run command options for a VM
Figure 7.6 Boot diagnostics console screenshot
Figure 7.7 Traditional virtualization-hosting applications vs. applications running in con...
Figure 7.8 Windows Server containers vs. Hyper-V isolation containers
Figure 7.9 Container architecture with Docker
Figure 7.10 Applications and deployment slots in an App Service plan

Chapter 8

Figure 8.1 Registered applications during the Azure Stack deployment to Azure AD
Figure 8.2 Using the Admin portal Marketplace management
Figure 8.3 Azure Stack’s update experience
Figure 8.4 The Azure Stack HCI stack

Chapter 9

Figure 9.1 A very simple application architecture
Figure 9.2 Architecture extended to have the frontend in two regions
Figure 9.3 Architecture with a replica in Region 2 of the database for DR purposes only
Figure 9.4 Architecture using the replica for read operations
Figure 9.5 Architecture using Cosmos DB
Figure 9.6 Retention policy in Azure Backup
Figure 9.7 Disaster recovery on premises
Figure 9.8 Disaster recovery on premises to Azure
Figure 9.9 Disaster recovery for Azure to Azure

Chapter 10

Figure 10.1 Monitoring relationships in Azure
Figure 10.2 Viewing metrics for a VM
Figure 10.3 Service Health information in Azure Monitor
Figure 10.4 Diagnostic setting configuration
Figure 10.5 Example blob created as part of diagnostic setting sink to storage
Figure 10.6 Configuring data to collect via connected sources
Figure 10.7 Viewing the schema of a workspace
Figure 10.8 Searching available monitoring solutions
Figure 10.9 Action options in an action group
Figure 10.10 Sources of alerts in Azure
Figure 10.11 Signals available for a resource
Figure 10.12 Metric using dynamic thresholds
Figure 10.13 Alert rules generated across possible sources
Figure 10.14 Alert rules based on Log Analytics queries
Figure 10.15 Action rule filters
Figure 10.16 Viewing alerts with smart groups
Figure 10.17 Viewing threats for Azure SQL database
Figure 10.18 Viewing threats through a query in Log Analytics
Figure 10.19 The overall security state for my subscription and actionable recommendations
Figure 10.20 Enabling access via JIT for my machine
Figure 10.21 Security cases in Azure Sentinel
Figure 10.22 An application using its managed identity to gain access to a secret, which is ...

Chapter 11

Figure 11.1 Opening the JSON settings file
Figure 11.2 Performing an interactive logon via a browser
Figure 11.3 Accessing the Cloud Shell
Figure 11.4 Setting up advanced cloud drive options
Figure 11.5 Viewing the $PSVersionTable information for a Cloud Shell instance
Figure 11.6 An included example runbook
Figure 11.7 Permissions for the created Run As account
Figure 11.8 Working with credential assets
Figure 11.9 Creating a new function with PowerShell as an option
Figure 11.10 Testing a function
Figure 11.11 Viewing the template that will be used to create resources authored in the port...
Figure 11.12 Azure ARM JSON template editing IntelliSense in action
Figure 11.13 Enabling the use of a key vault’s contents for template deployments
Figure 11.14 A very simple release pipeline that consists of a single task for the release: ...
Figure 11.15 Using the Cloud Shell within the Azure application
Figure 11.16 Connecting to my VM via the bastion host service
Figure 11.17 Managing S2D with Windows Admin Center from the browser

Chapter 12

Figure 12.1 Elements and perceived possible vulnerabilities for a public cloud service
Figure 12.2 Gartner Methodologies and Magic Quadrant
Figure 12.3 Gartner Methodologies and Hype Cycle

Introduction

The book you are holding is the result of my 25 years of experience in the IT world, including 20 years of virtualization experience, which started with VMware, Virtual PC, and now Hyper-V, and many years focusing on public cloud solutions, especially Microsoft Azure. My goal for this book is simple: to make you knowledgeable and effective architecting an Azure-based infrastructure. If you look at the scope of Microsoft Azure functionality, a single book would be the size of the Encyclopedia Britannia to cover it, so my focus for this book is the infrastructure-related services, including VMs in Azure, storage, networking, and some complementary technologies. Additionally, the focus is on architecting a solution. I will also show how to automate processes using technologies such as templates and PowerShell/CLI, how to integrate Azure with your on-premises infrastructure to create a hybrid solution, and even how to use Azure as a disaster recovery solution.

There is a huge amount of documentation for each feature of Azure. The documentation walks through each feature's basic functionality and provides step-by-step instructions for the basic deployment. When performed through the GUI, these steps often change, as interfaces continue to evolve. Additionally, as this book will show, while the portal is great for learning about the options, you won't be using it for production deployments, preferring instead to use prescriptive technologies like templates. Therefore, the goal of this book is to help you understand the options, to understand how to use them as part of a solution to meet requirements, to enable architectures to be created using the right components, with best practices developed over years of working with many Fortune 500 organizations. Yes, this book will expose you to all the important Azure infrastructure services, but it will focus on providing real value to enable the most complete and optimal utilization of Azure. It will focus on walkthroughs only for more involved or complex scenarios where they really provide value. But don't worry—the basic step-by-steps will still be referenced so that you can easily find them.

Microsoft is one of only three vendors with a solution in the public cloud IaaS Gartner Magic Quadrant as a leader in addition to being used by many of the largest companies in the world and I will cover this in more detail in Chapter 12.

I am a strong believer that doing an action is the best way to learn something, so I encourage you to try out all the technologies and principles I cover in this book. Because Azure is a public cloud solution, you don't need any local resources except for a machine to connect to Azure. You can even run command-line interfaces (CLIs) directly within the Azure portal environment. Ideally, you will also have an on-premises lab environment to test the networking to Azure and hybrid scenarios. However, you don't need a huge lab environment; for most of the items, you could use a single machine with Windows Server installed on it and with 8 GB of memory to enable a few virtual machines to run concurrently. As previously mentioned, sometimes I provide step-by-step instructions to guide you through a process; sometimes I link to an external source that already has a good step-by-step guide; and sometimes I link to videos I have posted to ensure maximum understanding.

This book was one of the most challenging I've written. Because Azure is updated so frequently, it was necessary to update the book while writing, as capabilities would change. The Microsoft product group teams helped greatly, giving me early access to information and even environments to enable the book to be as current as possible. To keep the content relevant, I will be releasing a digital supplement and updating it as required. This will be available, along with any sample code, video links, and other assets, on the books GitHub page at:

https://github.com/johnthebrit/MasterIaaS2019

As you read each chapter, look at the GitHub repository for videos and other information that will help your understanding, as I do not specifically call these references out in the text of the book. The main page shows how to get a local copy of the repository, which has the benefit of making it easy to get updates as they occur.

Who Should Read This Book

I am making certain assumptions regarding the reader:

You have basic knowledge about and can install Windows Server.
You have basic knowledge of what PowerShell is.
You have access to the Internet and can sign up for a trial Azure subscription.

This book is intended for anyone who wants to learn Azure Infrastructure services, but it is really focused on exposing the options and offering guidance on architecting solutions. If you have basic knowledge of Azure, that will help, but it is not a requirement. I start off with a foundational understanding of each technology and then build on that to cover more advanced topics and configurations. If you are an architect, a consultant, an administrator, or really anyone who just wants a better knowledge of Azure Infrastructure, this book is for you.

There are many times I go into advanced topics that may seem over your head, in which case don't worry. Focus on the preceding elements you understand, implement and test them, and solidify your understanding. Then, when you feel comfortable, come back to the more advanced topics, which will seem far simpler.

There are various Azure exams. The most relevant to this book are AZ-100 and AZ-101 (replacing the old 70-533 exam), which, when passed, give the participant the Azure Administrator Associate certification:

https://www.microsoft.com/en-us/learning/azure-administrator.aspx

Additionally, exams AZ-300 and AZ-301 (replacing the old 70-534 exam), when passed, give the Azure Solutions Architect Expert certification:

https://www.microsoft.com/en-us/learning/azure-solutions-architect.aspx

Will this book help you pass the exams? Yes, it will help. I took the exams for both certifications cold, without knowing what was in the exams and without any study, and I passed. Since most of my Azure brain is in this book, it will help. However, I advise you to look at the areas covered in the exams and use this book as one resource to help, but also use other resources that Microsoft references on the exam site. This is especially true of the architect certification, which includes a significant amount of content of application and database concepts, which I cover in this book only at a very high level.

What's Inside

Here is a glance at what's in each chapter.

Chapter 1, “The Cloud and Microsoft Azure Fundamentals,” provides an introduction to all types of cloud services and then dives into specifics about Microsoft's Azure-based offerings. After an overview of how Azure is acquired and used, the Infrastructure as a Service (IaaS) will be introduced, with a focus on what is really the difference between a best-effort and a reliable service and why best-effort may be better!
Chapter 2, “Governance,” focuses on the first item companies must consider and address before using any service, including the public cloud and Azure. This chapter focuses on key concepts around Azure Resource Manager, understanding core governance around structure, role-based access control, naming, policy, cost and more.
Chapter 3, “Identity,” addresses the next consideration for service usage, understanding identity. This chapter walks through the importance of identity in the public cloud and how it becomes the key security perimeter for many services. Azure AD will be introduced, along with its population and authentication options.
Chapter 4, “Identity Security and Extended Identity Services,” builds on the previous chapter by looking at key security capabilities with Azure AD and how AD can be extended into the public cloud in a secure manner. Other identity services for custom applications will be explored.
Chapter 5, “Networking,” explores offering services running in Azure out to Internet-based consumers. It looks at key concepts such as endpoints to offer services and also providing load balanced services for greater service availability. Virtual Networks provide a construct to enable customizable IP space configurations that are used by many services in Azure. This chapter dives into architecting, configuring, and managing virtual networks. Finally, various types of connectivity between virtual networks and on premises are explored.
Chapter 6, “Storage,” examines the core capabilities of storage accounts in Azure and then walks through the storage capabilities used by infrastructure services in Azure, including managed disks. Services for large-scale data import and export are introduced.
Chapter 7, “Azure Compute,” starts by introducing virtual machines, the building block of nearly every Azure service, including their key capabilities, before moving on to more advanced concepts around availability and placement. An introduction to some of the Platform as a Service offerings is provided to provide a complete knowledge for architects for the key available options.
Chapter 8, “Azure Stack,” explores the on-premises Azure capability through partner appliances, including key scenarios and architecture considerations. Key concepts such as plans and offers will be covered, including how to manage the marketplace.
Chapter 9, “Backup, High Availability, Disaster Recovery, and Migration,” starts by looking at key requirements for disaster recovery and some of the key considerations to architect a successful disaster recovery plan. A number of technologies commonly used for disaster recovery will be explored, including types of replication and service provisioning. The orchestration of a failover is explored using recovery plans. Finally, the chapter examines the same technologies used for replication that can also be used in combination with other capabilities for migration purposes. Finally, the chapter introduces backup capabilities and discusses best practices for their usage.
Chapter 10, “Monitoring and Security,” dives into Azure services related to monitoring, enabling complete insight into the entire Azure-based solution. Key security services that are not covered elsewhere in the book are also covered.
Chapter 11, “Managing Azure,” looks at the right way to manage Azure. This includes command-line interfaces, scripting and automation, and using templates for resource provisioning. A number of management services to enhance the overall solution are covered, including some seamless options to connect to Azure-based virtual machines.
Chapter 12, “What to Do Next,” brings everything together and looks at how to get started with Azure, how to plan next steps, how to stay up-to-date in the rapidly changing world of Azure, and the importance of overall integration.

How to Contact the Author

I welcome your feedback about this book or about books you'd like to see from me in the future. You can reach me by writing to john@savilltech.com. For more information about my work, visit my website at https://savilltech.com.

Sybex strives to keep you supplied with the latest tools and information you need for your work. Please check their website at www.wiley.com/go/sybextestprep, where we'll post additional content and updates that supplement this book, should the need arise.