Transcript
Use with ChatGPT / Claude Auto-scroll A
Introduces the AZ-104 course, its modular structure, and the main Azure administrator topics covered. It also explains exam format, timing, and recommended preparation steps.
microsoft azure administrator certification is one of the most important and relevant certification in the entire microsoft certification track if you ask per to become an azure administrator or an infrastructure engineer this is going to be a perfect coursefor you in this course i will teach you how to become hands-on with azure we will learn about core azure services and workload and we will learn about how to configure and implement core services like azure storage azurenetworking and azure compute and i will help you understand how to secure your azure environment by learning about azure core security services and governance and we will go deep dive into azure active directory which is a very importanttopic for an azure administrator this course is designed in a modular format and i will make sure to put timestamps below the like button so it is easier for you to navigate through these concepts thank you so much
for taking your time to learn this as 104 azure administrator course and i wish you all the very best for your examination in this tutorial i will take you guys through all these five modules so towards the endyou will be super comfortable to sit for this as 104 examination i have prepared this tutorial based on the skills what we have seen on the previous slide on these level modules my recommendation is create a free azuresubscription which will give you 300 credit for a month so when you are learning these topics just explore these options within the azure portal as well so you get to know the practical knowledge by doing it and youget to learn these by listening to these tutorials all right so let me give you some exam basics when you sit for the exam expect questions between 40 to 60 and some of these questions worth more than one
point and please make sure to select all answer or respond to all questions there is no penalty for guessing so don't leave any questions unattended because there is no negative mark your total examination minutes is around 180 soplan for 150 so that you have rest of the time for commenting score reporting and reviewing your questions and providing feedback so don't expect going into an exam just expecting multiple choices there are different types of questions likea built list hot area active screen drag and drop and of course case studies for exit 104 you can expect a lab and case study as well for this azure administrator 104 exam there is no prerequisite but ifyou are totally new to azure i would highly encourage you to start with az 900 because that will give you a overall basic understanding about cloud and this is going to make your life so much easier when you
start with a z104 and if you are trying to be an azure solutions architect it is mandatory that you you pick up both of these certification as 900 and 104 before moving and applying into 303 and 304 in
Explains what Azure Active Directory is and where to find it in the Azure portal. Covers its main benefits such as single sign-on, cloud app access, and identity protection.
this lesson you're going to learn about azure active directory let's have a look at the topics we are going to see on this particular lesson we're going to start with high level overview on azure active directory we're goingto go through azure ready concepts it's very important for us to know about what are the main difference between adds versus azure active directory then we will go over what are the different editions of azure active directories areavailable how can you utilize azure active directory join in terms of hybrid identity and other services and few of the other features including self-service password reset we'll touch base on multi-factor authentication and how to configure the mfa sowithout wasting any more time let's get into it azure active directory or azure id is microsoft multi-tenant cloud-based directory and identity management service for it admins azure ad provides an affordable easy to use solution to give employees and
business partners single sign-on access and this single sign-on access can be enabled for thousands of cloud applications like office 365 salesforce dropbox and concur etc for application developers azure id lets you focus on building your application by makingit fast and simple to integrate with world-class identity management solution used by millions of organizations around the world so before i explain the benefits and features of azure ad let me quickly show you where you can find yourazure active directory in the azure portal so now i logged into my azure portal by going into portal.azure.com you can see that i used a user called rick sanchez to sign into the azure portal on the left handside you would be able to find azure active directory if you don't see it over here you can go to the global search box and type in azure active directory and click on select to go inside the azure
active directory on the left hand side you can find all the settings and options available for azure ready including single sign-on company branding device management user management group based management etc so let me quickly go and explain someof the benefits and features of azure ad one of the cool benefit of azure active directory is the single sign-on ability to log into any cloud or on-premises web application so this azure active directory provides secure single sign-onto cloud and on-premises application including microsoft office 365 and thousands of sas applications such as salesforce workday docusign service now and box etc and azure active directory works with ios mac operating system android and windows devices so userscan launch application from any personalized web-based application panel or mobile app or office 365 or any other custom company portal using their existing work credentials and have the same experience whether they are working on ios mac operating system
android and windows devices you can use azure active directory to protect on-premises web application with secure remote access as well you can access your on-premises web application from anywhere and protect with multi-factor authentication conditional access policies or groupbased management access control users can access sas and on-premises web apps from the same portal another cool thing about azure ad is to another cool thing about azure ad is the ability to extend your active directory to thecloud you can connect your azure id and other on-premises directory to your azure active directory in just a few clicks and maintain a consistent set of users groups passwords and devices across these environment another great feature comes withazure id is about protection you can protect your sensitive data and applications so you can enhance application access security with unique identity protection capabilities that provide a consolidated view into suspicious sign-in activity and potential vulnerabilities if you are
an office 365 azure or dynamics 365 online customer you might not realize that you are already using azure ad every office 365 azure and dynamics 365 crm tenants is already an azure id tenant so whenever you want tostart using the tenant to manage access to thousands of other cloud application just log into portal.azure.com and you will be able to access your tenant's azure active directory from there so let's have a look into some of the
Defines identities, accounts, tenants, directories, and subscriptions in Azure AD. Then compares Azure AD with Active Directory Domain Services and highlights key architectural differences.
azure ad concepts identity is a thing that can get authenticated an identity can be a user with a username and password identities also include applications or other servers that might require authentication through secret keys or certificates so whatare accounts accounts are an identity that has data associated with it you cannot have an account without an identity let's have a look at azure ad account an identity created through azure ad or another microsoft cloud service suchas office 365 is called an azure ad account so identities are stored in azure id and accessible to your organization's cloud service subscriptions this account is also sometimes called a work or school account so what do you meanby an azure tenant azure tenant is a dedicated and trusted instance of an azure id that's automatically created when your organization signs up for a microsoft cloud service subscription such as microsoft azure microsoft intune or office 365 an
azure tenant represents a single organization so what is an azure ad directory each azure tenant has a dedicated and trusted azure id directory so the azure ad directory includes the tenant users groups and apps and is used toperform identity and access managed functions for the tenant resources and finally what is this user subscription or azure subscription azure subscription is used to pay for your azure cloud services you can have many subscription and have linked toa credit card or to your organization's accounts as well so let's look at how different is this azure active directory with active directory domain services it is important to realize that using azure id is different from deploying anactive directory domain controller it is important for us to realize that using azure id is quite different from deploying an active directory domain controller on an azure virtual machine and adding it to your on-premises domain controller so let
me make it clear that what are the some of the characteristics that is making this as ready different from adds the first one is identity solution azure ad is primarily an identity solution and it is designed for internetbased application by using http and https communications because azure ad is used for http and https based communication it cannot be used for querying through ldap instead azure ad uses rest apis over http and https because azure adis http versus https based it does not use kerberos authentication instead it uses http and https protocol such as saml ws federation and open id connect for authentication azure ad includes federation services and many third party services suchas facebook linkedin twitter google etc and azure id users and groups are created in a flat structure and there are no organizational units or group policy objects or gpus in azure id so azure ad is a managed service
you can manage the users groups and policies using azure id all right so when you deploy adds with virtual machine in azure that means that you are going to manage the deployment configuration virtual machine patching and all otherbackend tasks if you deploy adds with virtual machine using azure that means that you are going to manage the deployment configuration virtual machines patching and all other backend tasks now that we have learned about what are the main
Reviews Azure AD free, Office 365, P1, and P2 editions and what each includes. It then explains Azure AD join, device registration, and how they support secure device access.
difference between ldds versus azure ready let's have a quick look into what are the different types of azure active directory editions available so azure active directory comes in four different editions free office 365 apps premium p1 and premiump2 the free edition is included with an azure subscription the premium editions are available through a microsoft enterprise agreement the volume licensing and the cloud solution providers program or csp azure and office 365 subscribers can also buy azureactive directory p1 and p2 online so what comes with azure active directory free option azure adfree provides user and group management then it gives you on-premises directory synchronization basic reports and single sign-on across azure office 365 and manypopular sas applications azure active directory office 365 apps this edition is included with your office 365.in addition to the free features this edition provides identity and access management for your office 365 apps including branding mfa group access management and self-service password reset for cloud users let's look at azure adp1 or premium one in
addition to the free features p1 also lets your hybrid users access both on-premises and cloud resources it also supports advanced administration such as dynamic groups self-service group management microsoft identity manager and cloud right-back capabilities which allow self-service passwordreset for your on-premises users and last but not the least azure active directory p2 in addition to the free and p1 features p2 also offers azure active directory identity protection to help provide risk based conditional access to yourapplication and critical company data and privileged identity management to help discover restrict and monitor administrators and their access to resources and to provide just-in-time access when needed azure active directory or azure ad enables single sign-on to devices appsand services from anywhere the proliferation of devices including bringing your own device empowers end users to be productive wherever and whenever but it administrators must ensure corporate assets are predicted and that devices meet standard for security and compliance
azure ad join is designed to provide access to organizational apps and resources and to simplify windows deployments of work owned devices azure ad has many benefits let me take you through few of those the first benefit is singlesign-on your users will not have additional authentication prompts when accessing work resources the single sign-on functionality is available even when users are not connected to the domain network the next one is enterprise compliant roaming this enterprise compliant roamingof users setting across join devices so users don't need to connect to a microsoft account for example hotmail or outlook to observe settings across devices the third benefit is access to microsoft store for business this is being usedby using an azure active directory account your users can choose from an inventory of applications pre-selected by the organization the windows hello support for secure and convenient access to work resources another benefit is a restriction of access to
apps from only devices that means compliance policy and what about seamless access to your on-premises resources when the device has the line of sight to the on-premises domain controller another key concept we need to understand are what arethe connection options to get a device under the control of azure eddy you have primarily two options registering and joining so let me explain you what is the main difference between registering a device and joining a device meansfor you registering a device to azure ready enables you to manage a device identity when a device is registered azure ad device registration provides the device with an identity that is used to authenticate the device when a usersign into azure ready you can use the identity to enable or disable a device joining a device is an extension to registering a device this means that it provides you with all the benefits of registering a device and
in addition to this it also changes the local state of the device changing the local state enables your users to sign into device using an organizational work or school account instead of a personal account so the registration combinedwith the mobile device management or mdm solutions such as microsoft intune provide additional device attributes to azure ad this allows you to create conditional access rules that enforces access from devices to meet your standards for security and compliance
Introduces Azure Multi-Factor Authentication and why it is important for protecting accounts. Shows how to configure MFA options, trusted IPs, verification methods, and remembered devices.
although azure ad join is intended for organization that do not have on-premises windows server active directory infrastructure it can be used for other scenarios such as branch offices etc let's learn about what is azure multi-factor authentication azure multi-factorauthentication or mfa helps safeguard access to data and applications while maintaining simplicity or users it provides additional security by requiring a second form of authentication and delivers strong authentication through a range of easy to use authentication methods sofor organization that need to complement with industry standards such as pci dss mfa is a must-have capability to authenticate users beyond being compliant with industry standards enforcing mfa to authenticate users can help organizations to mitigate credential theft attacksthe security of mfa two-step verification lies in a layered approach compromising multiple authentication factors presents a significant challenge for attackers even if the attacker managed to learn the user's password it is useless without having the possession of additional
authentication methods these additional authentication methods include something you know typically a password something you have which is a trusted device that is not easily duplicated like a phone and something you are which is biometrics there are so manybenefits to multi-factor authentication some of the features are get more security with less complexity migrating threats with a real-time monitoring and alerts use with office 365 salesforce and more and protection for azure administrator accounts so you can accessmulti-factor authentication by going into the azure ad portal and click on the hyperlink to come to this particular page this is where you would be able to see all the users who is part of your azure id youcan filter these by who you enabled the mfa who you have enforced the mfa and you can filter these users by sign in built sign-in allowed users billing administrators global admin etc on the right hand side you can
see the details of which is enabled or disabled you can click a user to go to quick steps quick steps allow you to disable an already enabled account and you can click on manage user settings you would beable to enforce these settings for your users the first one lets you force the users to provide the contact information again you can delete all existing app passwords generated for a selected user and you can restore mfa authenticationon all remembered devices
you can go to the service settings page over here this lets you control additional features for your mfa things like do you want to enable the app password if you would like to whitelist certain ip you can provideall the trusted ips over here so the users will not be prompted for dual factor authentication if you turn this on and there is verification options as well there are four methods available so you are good to chooseany one of these or you can choose multiple as well so the first option is call to phone this option allows you to place an automated voice call the user answers the call and presses hash key to authenticatethen we have text message to phone this sends a text message that contain a verification code to the user we have notification through mobile app this sends a push notification to your phone or registered device and finally we
have a verification code from the mobile app or hardware token this is the way the microsoft authenticator app generates a new oauth verification code every 30 seconds and once you make these changes you can hit on save andthis is another option where you can enable to remember the multi-factor authentication so depending on the number of days you given the mfa will remember not to prompt or re-authenticate those users who is already signed in with the
Explains how self-service password reset reduces help desk workload and how to configure it in Azure AD. Covers user and group targeting, authentication methods, and security questions.
mfa all right so the last topic on this lesson is self-service password reset the large majority of help this call in most companies are requested to reset password for users enabling self-service password reset or it is known assspr gives the users the ability to bypass the help disk and reset their own password to configure self-service password reset you first determine who will be enabled to use self-service password reset on the azure portal under azure activedirectory select password reset in the password reset properties there are three optionsnone selected and all the selected option is useful for creating specific groups who have self-service password reset enabled the azure documentation recommends creating a specific group for this purpose for testing or proof of concept before deploying it toa larger group within your azure edit in it once you're ready to deploy this functionality to all users with accounts in your azure id tenant you can change the settings to all after enabling password reset for users and
groups you can pick the number of authentication method required to reset the password and the number of authentication methods available to users at least one authentication method is required to reset a password but it is good idea tohave additional methods available you can choose from email notification text or code sent to your user's mobile or office phone or set the security questions as well regarding the security questions these can be configured to require a certainnumber of questions to be registered for the users in your azure ready tenant in addition you must configure the number of correctly answered security questions that are required for a successful password reset please note that the azure administratoraccount will always will be able to reset their password no matter what their option is set to now with that we have completed the first lesson in this lesson we're going to learn about users and groups let us
Covers cloud identities, synchronized identities, and guest users, along with ways to create and manage accounts. Also explains bulk user creation with CSV files and naming conventions.
have a quick look into what are the things we are going to learn in this particular lesson we will start with learning what are the types of user accounts available within azure then how are you going to managethese user accounts if you happen to have multiple user accounts from on-prem or other identity sources you will learn about how can you bulk upload these user accounts into azure we will touch base on what are the differenttypes of groups and how do you manage these groups within your azure active directory what is the use case scenario of azure ad connect and how can you use azure id connect to synchronize your on-prem users to yourazure id how do you make sure that your azure id connect is on healthy all the time towards the end we will learn about azure adb2b and b2c which is business to business and business to consumer so without
wasting any more time let's get into it so let's first learn about the types of user account you access user account or log into your azure portal select azure active directory and click on users this is where youwould be able to see all the users who is part of your azure active directory tenant typically azure ad defines users in three ways typically azure ad defines users in three ways cloud identity directory synchronized identities and guestusers so let's look at the first option which is cloud identities these users exist only in azure id so as you can see that this one is not synchronized this is a cloud-borne user example are administrator accounts anduser that you manage yourself the source is azure active directory or external azure active directory if the user is defined in another azure active directory instance but needs to access the subscription resource controlled by this directory when these
accounts are removed from the primary directory they are deleted the second type is called directory synchronized identities these users exist in an on-premises active directory a synchronization activity that occurs via azure ad connect brings these users to theazure their source is windows server active directory and finally the last type is called guest user these users exist outside of azure example are accounts from other cloud providers and microsoft accounts such as xbox live account this typeof account is useful when external vendors or contractors need to access to your azure resources once their help is no longer necessary you can remove the account and all of their access so let's learn about managing these useraccounts there are multiple ways to add cloud identities to azure id the first place where you can manage these user accounts is in the azure portal so you can add a new user through the azure portal in addition
to the name and the username there is a profile information like job title and department which you can give as well when you try to add a user you can start by either creating a new user or invitea user as well when you send an invitation you can add a personal message to that invitation as well there are certain things you need to consider when try to manage a user you as a user must bea global administrator to manage users user profile picture job and contact information is optional deleted users can be restored for 30 days and sign in and audit log information is always available for you to check please note thatusers can also be added to your azure id through your office 365 admin center microsoft intune admin console and cli so how do you bulk add the user accounts into your azure active directory there are several ways to
do that you can either use powershell or you could use the csv format so let me quickly go back to the azure portal to show you how to upload multiple user account using a csv file in azure soi'm now in my azure portal i'm going to go back to azure active directory and click on users if you are going to use a csv file here are some of the things you need to think about clickon bulk options and click on bulk create first of all you get an option to download the csv template then you can edit the file and finally you can upload the csv file so i'm going to download thefile let's open the file and see what are the information we need to provide the information you have to give are mentioned over here name of the user it's a mandatory field username it's again a required field initial
password do you want to enable block sign in or not then the first name last name job title department user location etc so these are all the optional fields all the required field have to be filled first thenaming convention establish alt implement a naming convention for user names display names and alias for example a username could consist of last name and then the password implement a convention for the initial password for newly created user figureout a way for the new users to receive their password in a secure way methods commonly used for this are generating a random password and emailing it to the new user or their manager azure 80 allows you to
Describes security groups and Microsoft 365 groups and how they differ in purpose. Also explains assigned, dynamic user, and dynamic device membership options.
define two different types of groups security groups and office 365 groups let me quickly show you where you can find the groups in azure active directory so i'm going to go back to my azure id click on groupswhen you try to create a new group there are two options security groups and office 365 or microsoft 365 group let me tell you the main difference between these two groups first security groups these are the most commonand are used to manage members and computer access to shared resources for group of users for example you can create a security group for a specific security policy by doing it this way you can give a set ofpermission to all the members at once instead of having to add multiple people and multiple permission to each members individually this option requires an azure id administrator right the second option is office 365 group or microsoft 365 group
these groups provide collaboration opportunities by giving members access to a shared mailbox calendar files sharepoint site and more this option also let you give people outside of your organization access to these groups as well this option is availableto users as well as admin the next thing we need to learn about is adding members to the groups there are different ways you can assign access right the first option is assigned then there is a dynamic userthe third option is dynamic device or security groups only so let me explain these three concepts in detail so i'm in my azure ad and i'm trying to create a new group after you pro after you select thegroup type and provide a group name group description you can come to the membership type you can select dynamic or assigned membership for this group there are three types the first one is called assigned assigned lets you add
specific users to assigned lets you add specific users to be members of this group and to have unique permissions dynamic user lets you use a dynamic membership rules to automatically add and remove members if a member attribute changethe system look at your dynamic group rules for the directory to see if the member meets the rule requirement or no longer meets the rule requirement etc and the third option is dynamic device in this option this lets
Introduces Azure AD Connect and how it synchronizes on-premises directories with Azure AD. Covers sync options, password hash sync, pass-through authentication, and health monitoring.
you use a dynamic group rule to automatically add and remove devices just like dynamic users if the device attribute change the system looks for your dynamic group rules let's talk about azure ad connect azure ad connect will integrateyour on-premises directory with your azure active directory this allows you to provide a common identity for your users for office 365 azure and sas applications integrated with azure id so let me quickly take you through steps where youcan download the azure ad connect and connect your azure id connect with your on-premises adds to your azure id so i logged on to my azure portal on the left hand side you can find azure active directory withinazure active directory under manage scroll down till you find azure ad connect click on azure ad connect this is where you can find the azure ad connect details so i have already downloaded and installed this on my on-premises
domain controller otherwise you would be able to download the tool straight from this portal or you can go to microsoft download and download the azure led connect and install on your ad ds as well as you can seethat my azure ad connect is already connected and the sync status is enabled the last sync is more than a day you can see that another option called password hash sync is enabled as well i don't have federationi don't have seamless single sign-on and pass-through authentication enabled all of these things are disabled i can click over here to monitor my on-premises identity infrastructure click on azure ad connect help so i can come over here andi can download and install the azure id connect health agent as well let me take you to my on-premises adds and show you some of the features of azure id connect so i logged into my on-premises domain controller
so this domain controller is installed with azure ad connect and all the users and groups is already syncing back to azure ad so i'm going to launch the azure id connect since this has been installed and configured i'mgoing to quickly show you what are the configurations options you can do post installation you can go and see the privacy settings view the current configuration so let me quickly show you what is the current configuration looks likeit says that it is synchronized to this directory the account used is this one and as you can see that what are the synchronization settings which is enabled azure ad app settings azure id app and attribute filtering isenabled you can see that group write back is disabled password right back is disabled auto upgrade is enabled and device right back is disabled so this is where you can see all the options one of the important option
is pass password hash sync which is enabled as well so i'm going to go back and show you how to customize the synchronization option i'm going to customize the azure id connect the first step is to connect toyour azure ready term using your global administrator username and password
right now this is establishing a connection to my azure led tenant so now it is connected so click next if you would like if you would like to modify any settings over here this is where you can changeto different directory different forest you can add a new directory as well click next if you don't want to modify anything if you look at it my domain is ingram azure.ml so the whole domain is being synchronized butif i but if you would like to just modify and synchronize a selected ou within your on-premises domain controller you can untick this and create a new cloud ou where you can specifically put your users and groups usersand groups which you would like to move to azure id i don't want to make any changes over here like next right so these are all the optional features which we are talking about so we talked about password
hash centralization so what is password hash synchronization password hash synchronization is a sign in that synchronizes a hash of a user's on-premises ad password with the azure id then we have another option called pass-through authentication so we candownload and install an agent if you if you do that pass-through authentication is a sign-in method that allows users to use same password on premises and in the cloud but doesn't require the additional infrastructure of a federated environmentthen we have additional options like group right back device wipe brack device right back etc so you can basically turn on and turn off these five features based on your requirement so you can turn on the azure idapps which you would like to add or restrict access to what are the azure ad attributes you would like to export to azure and some of the directory extensions as well so once you modify it you can click
next to configure the changes what you have made right now another feature which i would like to highlight is called health monitoring and azure ad connect health can provide a robust monitoring and provide a central location in yourazure portal to view this activity so let me take you through the place where you can find the azure ready connect health so let's look at azure ready connect help azure ad connect health provides robust monitoring of youron-premises identity infrastructure it enables you to maintain a reliable connection to your office 365 and microsoft online services this reliability is achieved by providing monitoring capabilities for your key identity components also it makes the key data points aboutthese components easily accessible so let me show you where you can download the agent and install azure id connect health on your on-premises server log into your azure portal and go to your azure active directory under manage you
would find azure ad connect within azure id connect scroll down to the bottom till you reach health and analytics and then click on azure id connect help so this azure id connect health helps you monitor and gain insightsinto your adfs server actually d connect and add ds as well and then azure d connect helps you monitor and gain insight into your synchronization that occurs between your on-premises ads and the azure id and finally you canuse azure ad connect health to monitor and gain insight into your on-premises identity infrastructure that is used to access your office 365 and azure id applications so with azure ad connect the key data you need is easily accessible
Explains resource, administrative, and synchronization independence across tenants. Shows how separate Azure AD tenants remain isolated while still supporting different synchronization models.
you can view and act on alerts and set up email notification for critical alerts and view performance data using azure ad connect work by installing an agent on each of your on-premises sync servers so let's understand how canyou manage multiple directories in azure active directory each tenant is fully independent resource appear that is logically independent from other tenants that you manage there is no parent-child relationship between the tenant the independence between the tenants include resourceindependence administrative independence and synchronization independence so let's understand this concept in bit more details so i'm going to give you a high level overview on what are these three types of independence we are talking about let's talk aboutthe resource independence if you create or delete a resource in one tenant it has no impact on any resources in other tenant if you use one of the domain names with one tenant it cannot be used with any
other tenant that is called resource independence let's look at administrative independence if a non-administrative user of a tenant creates a test tenant called test then by default the user who creates a tenant is added as an external userin that new tenant and is assigned as the global administrator role in that unit if you add or remove an administrator role for a user in one tenant that change does not affect the administrator role that the userhas in the another tenant let's look at the synchronization independence you can configure each azure id tenant independently to get data synchronized from one single instance or either you can use the azure ready tenant connector for forefront identity
Describes Azure AD B2B for external partner collaboration and Azure AD B2C for customer identity management. Highlights invitation flows, external access, and large-scale authentication support.
manager to synchronize data with one or more on-premises forest all right so we have reached the last topic for this module the last lesson we are going to learn today is azure adb2b and b2c b2b is business tobusiness and b2c is business to customer so let's talk about azure ad b2b azure active directory business to business collaboration lets you securely share your company's application and services with guest users from any other organization while maintaining controlover your own corporate data you can work safely and securely with external partners large or small even if they don't have any azure ad or an it department a simple invitation and redemption process lets partners use their owncredentials to access your company resources and developers can use azure ad b2b apis to customize the invitation process or write applications like self-service sign up portals etc so with azure adb to be there is no external administrative overhead
for your organization the partner uses their own credentials and identities azure id is not required and you don't need to manage external accounts or passwords and finally you don't need to sync accounts or manage account life cycles sonow let's look at b2c or azure ad business to customer azure ad b2c provides business to customer identity as a service your customers use their preferred social enterprise or local account identities to get sign in or single sign-inaccess to your applications or apis so azure adb2c is a customer identity access management solution capable of supporting millions of users and billions of authentications per day it takes care of scaling and safety of authentication platform monitoring andautomatically handling threats like denial of service password spray or brute force attacks with azure adb2c you can invite users from other social media identity tenants into your own organization tenant then users provisioning is done by this invited party
and you are in control to invite the other side of users and with azure adb2c you can facilitate identity verification and proofing by collecting user data then passing it to the third party system to perform validation cross-scoring and
Walks through review questions on Azure AD join, sync health, Azure AD versus AD DS, guest users, SSPR, and admin roles. Reinforces the key concepts from the identity module.
approval for user account creation so congratulations on finishing the first module of this az 104 azure administrator examination course in this video you're going to go through the first module review questions so let's look at the first questionyour users want to sign into devices apps and services from anywhere they want to sign in using an organizational work or school account instead of a personal account that's a keyword the users want to use work or schoolaccount you must ensure corporate assets are predicted and that devices meet standards for security and compliance specifically you need to be able to enable or disable a device what should you do while you provide users ability to usethe work or school account at the same time you need to protect the devices for standard security and compliance so which option would you pick from the below is it enable the device in azure active directory no just
by enabling the device in azure id it is not going to allow any of this functionality to work is it connect the device to azure ad no just by connecting you are not able to get all these functionalityas well registering the device again is not going to allow you to manage and remove these devices whenever you want or enable or disable so the correct answer is join the device to azure ad joining a device isan extension to registering a device this means it provides you with all the benefits of registering a device like able to enable or disable the device in addition it also changes the local state of a device changing thelocal state enables your users to sign into a device using an organizational work or school account instead of a personal account so by registering a device you get an ability to enable or disable a device but by joining
a device to azure ready this gives you an ability to make sure that your users can sign in with their work or school account let's look at the second question your network contains an active directory domain services oradds domain name contensor.com and an azure active directory domain named contoso dot on microsoft.com azure ready connect is installed and active directory federation service is configured so you have the adf setup as well password right back is enabledyou need to monitor synchronization events generated by azure ad connect select one so the question is you enable password right back now you need to monitor the synchronization events generated by the azure ad connect so which option belowwill be able to use to monitor the events generated by your azure ad connect is it launch the synchronization service manager and edit the properties of the connector you can do that for so many other activities so you
can definitely log into your server and modify your synchronization service to change parameters and this the ways you want to modify your synchronization manager so that's not the right answer is it by configuring the authentication caching definitely notthat's not even relevant is it by deploying a domain controller for contoso.com on a virtual machine in contessa.onmicrosoft.comabsolutely rubbish answer so just by deploying a domain controller is not gonna resolve the problem what we are trying to solve so the right answer is install azure ad connect help azurity connect health is a feature that willmonitor on-premises adds identities and provide alerts this requires an agent on each server being monitored so let's look at question number three identify three differences from the following list between azure active directory and azure active directory domain servicesand you need to select three answers so we need to go through each of the statements and find out the main three differences between azure ad and azure id domain services so let's read the first one azure ad
uses http and https communication which is correct so the option is right azure ad uses kerberos authentication which is wrong azure ready does not use kerberos authentication azure ad uses the modern authentication third option there are no organizationalunits or group policies in azure ready which is absolutely right so azure ad doesn't have ou or gpus ous and gpos are part of on-premises domain controller or adds next statement is ngready includes federation services absolutely so azureready is the one you can use for federation services as well the last statement is azure ready can be queried through ldap which is completely wrong you can only use adds to query ldap so let me tell yousome of the several characters of azure ready that it makes different from adds so azure ad is primarily an identity solution and it is designed for internet based application by using http and https communication because azure ad is
http and https based it cannot be queried through ldap instead azure ad uses rest api over http and https azure id users and groups are created in a flat structure and there are no organizational units or group policieswhile azure ad includes federation services and many third-party services such as facebook linkedin etc and adds supports federation as well you would like to add a user who has microsoft account to your subscription which type of user accountis this you need to select one answer so is it a cloud identity no is it a directory synchronized identity absolutely not directly synchronized identities are synchronized from on-prem to the cloud cloud identity is a user who isborn in the cloud is it a provider identity i don't know what does that mean is it a hosted identity not definitely not so the correct answer is guest user guest users are users added to your azure id
as part of your third party services like microsoft or google let's look at the question number five you are configuring self-service password reason which of the following is not a validation method you need to select one answer outof it so we are trying to find which one is not going to be a validation method email notification is definitely a validation mechanism along with text which is sent to your users phone and mobile is again averification process and the last one a set of security questions is also part of the verification process the only option which is not a validation method is aging service right so let's look at the last question of thismodule you are assigning azure ad roles which role will allow the user to manage all the groups in your team's tenant and be able to assign other administrative roles so you are looking for an azure ad role which
you which has an ability to assign additional administrative roles to someone within your organization so it is definitely not user administrator because user administrators can only manage users security administrators can view and manipulate reports related to security andmodify some security related groups password administrator have ability to manage passwords for the users so the correct answer is global administrator global administrator is the only admin role you can use to manage groups across tenant and assign either
Introduces Azure regions, region pairs, and why geography matters for performance and resilience. Then explains subscriptions, billing, and the different ways to obtain an Azure subscription.
administrative roles so that concludes this module in the second module we are entering into governance and compliance and in the first lesson we're going to talk about azure subscriptions and azure accounts let's have a high level view onwhat are the topics we are going to learn on this particular lesson we will start off with azure regions and different types of azure subscriptions available and how can you get a new azure subscription and once you startconsuming azure where can you go and make sure that you are staying on top of the azure subscription usage then we will dive deep into what is azure cost management it's a new functionality it's pretty cool then wewill touch base on azure resource tag and cost saving aspect of azure microsoft azure is made up of data centers located around the globe these data centers are organized and made available to end users by region a region
is a geographical area on the planet containing at least one but potentially multiple data centers that are in close proximity and network together with a low latency network a few examples of region are west u.s canada central westeurope australia east japan west etc azure is generally available in 50 plus regions and available in 140 countries there are some things you need to know about regions all right azure has more global regions than any other cloudprovider regions provide customers the flexibility and scale needed to bring applications closer to their users and regions preserve data residency and offer comprehensive compliance and resiliency options for customers for most azure services when you deploy a resource inazure you choose the region where you want the resource to be deployed so let me quickly show you what do i mean by that so now i'm on my azure portal for an example if i'm going to deploy
a resource i'm going to click on create a new resource in this instance i'm going to deploy a windows server 2016 data center server before i deploy anything there are a couple of mandatory thing microsoft ask first oneis subscription and then the resource group we will talk about that but particularly one of the key requirement is region where would you like to host this particular workload too so when you expand it it gives you arecommended region based on your geographical placement and if you select the drop down box this is where you can pick the closest region where you want to host this application to this is not only relevant to virtual machineany resources you select within azure be this storage account be the database anything you have to make sure that you pick the region before you proceed further and some services or virtual machine features are only available in certain
regions such as a specific virtual machine size or a storage type and there are also some global azure services that do not require you to select a region such as a microsoft azure active directory or microsoft azure trafficmanager or azure dns so each region is paired with another region within the same geography together making a region pair the exception is brazil south which is paired with the region outside of its geography a regional pair consistsof two regions within the same geography so azure serializes platform updates and planned maintenance across regional pairs ensuring that only one region in each pair update at a time if an outage affects multiple region at least one regionin each pair will be prioritized for recovery and there are certain things you need to know about regional pairs the first one is physical isolation when possible azure prefers at least 300 miles of separation between these data centers
in regional pair although this isn't practically possible in all geographies a physical data center separation reduces the likelihood of natural disasters civil unrest power outages or physical network outages affecting both regions at once then there is platform providedreplication some services such as geo-redundant storage provide automatic replication to the paired region in the event of a broad outage recovery of one region is prioritized out of every pair so applications that are deployed across paired regions areguaranteed to have one of the other regions recovered with priority please always make sure to go to microsoft docs latest details about azure geography what are the regions available what are the announce region and where you can find
Covers Azure free, pay-as-you-go, enterprise, and student subscriptions and how to monitor usage. Also explains Cost Management, budgets, alerts, and recommendations for controlling spending.
the availability zone i'm not sure whether you are aware of it i live in new zealand so we are going to have an azure data center coming soon close to us so we don't know the date yet butthis is where you can come and have a look at places where microsoft announced a new data center as you can see that there is israel center holland central spain central and mexico central these are all the placeswhere microsoft is going to have a latest data center now that we have learned about azure regions and what are the difference between regions and regional pair let's go and talk about azure subscriptions an azure subscription is alogical unit of azure services that is linked to an azure account billing for azure services is done on a per subscription basis if your account is the only account associated with the subscription then you are responsible for billing
so let me quickly show you where you can find the azure subscription within your azure portal so i'm on my azure portal on the left hand side this is where you can find the subscription or you can typein subscription and select subscription this takes you to the subscription area and if you do happen to have access to multiple subscription you would be able to see multiple subscriptions over here so i'm going to select a subscriptionand this is where you can see all the details about a subscription subscription help you organize access to cloud service resources they also help you control how resource usage is reported built and paid for each subscription can havedifferent billing and payment setup so you can have different subscription and different plans by department project regional office and so on and every cloud service belong to a subscription and the subscription id may be required for programmatic operations
and let's learn about how can you get an azure subscription there are several ways to get an azure subscription enterprise agreement microsoft resellers microsoft partners and a personal free account so let's talk about an enterprise account enterprise agreementcustomers can add azure to their agreement by making an upfront monetary commitment to azure that commitment is consumed throughout the year by using any combination of the wide variety of cloud services azure offers from its global data centersenterprise agreements have a 99.95 monthly sla another way to get an azure subscription is to contact an azure reseller you can purchase azure through an open licensing program which provides a simple and flexible way to purchase microsoft cloudservices next option is to get azure via a partner so you can find a partner who can design and implement your azure cloud solution these partners have the business and technology expertise to recommend solutions that meet unique need
for your business and finally you can use your free account to start your first azure free account so let me show you how you can do that so with azure free trial account you can get started with azureright away and you won't be charged until you choose to upgrade so you can go to this website and you can create your azure free account today for the first month you get close to 310 dollars based onwhere you live and after the first month you get to use a lot of free services for another 12 more months so you can get all the details on this webpage and if you're interested to find out whichproducts are free for rest of the 12 months these are the products which is listed over here are free as you can see that you have a linux virtual machine you can use a windows compute machine a managed
disk database file storage this is plenty enough for you to start your azure journey or testing something or using azure to learn for yourself this is exactly how i started my azure journey let's understand some of the waysyou can monitor the azure subscription usage azure offers free and paid subscription option to suit different needs and requirements some of the most common subscriptions are free pay as you go enterprise and student and as your free subscriptioninclude a 200 credit to spend on any service for the first 30 days and free access to the most popular azure products for 12 months and access to more than 25 products that are always free this is anexcellent way for a new user to get started please note that a credit card information is used to identify verification only and you won't be charged for any services until you upgrade the second option is azure pay as
you go subscription model a piasico subscription charges you monthly for the services you used in that billing period this subscription type is appropriate for a wide range of users from individuals to small businesses and many large organizations aswell third type is an azure enterprise agreement an azure enterprise agreement provides flexibility to buy cloud services and software licenses under one agreement with discounts for new licenses and software assurance it's targeted at an enterprise scale organizations andthe last one is student subscription an azure student subscription include 100 usd in azure credits to be used within the first 12 months plus selected free azure services without requiring a credit card at sign up so to getthat azure for student subscription you must verify your student status through your organizational email address so let's learn about how can you manage cost within your subscription with azure products and services you only pay for what you use
as you create and use azure services you are charged for user resources you use azure cost management and billing features to conduct building administrative tasks and manage billing access to cost you can also use cost management for monitoringand control azure spending and to optimize azure resource usage so let me quickly take you through the azure portal to show you where you can find the course management option so i'm on my azure portal you can goto the global search box and type in cost management cost management shows organizational cost and usage patterns with advanced analytics reports in course management shows the usage-based costs consumed by azure services and third-party marketplace offerings these costs arebased on negotiated price and factors in reservations and azure hybrid usage benefit discounts collectively the report shows your internal and external cost of usage and azure marketplace charges other charges such as reservation purchases support and taxes are not
yet shown in these reports on top of this analysis you can set up cost alerts this is where you can place alerts so that it alerts you on when you reach a particular threshold you can define a budgetyou get notified if you are nearing your budgeted allocation then there is an inbuilt azure advisor recommendation as well this is where you get recommendation to reduce cost on your azure workloads there are multiple ways cost management helpyou plan for and control your cost including cost analysis budgets recommendation and exporting cost management data so let me take you through so let me give you a high level overview on what you can do you can usecost analysis to explore and analyze your organizational cost you can view aggregated cost by organization to understand where these costs are accrued and to identify spending trends and you can see accumulated cost over time to estimate monthly quarterly
or even yearly cost trends against a budget like i showed you you can set up budgets as well these budgets help you plan for and meet financial accountability within your organization they help prevent cost thresholds or limit frombeing surpassed and budgets can also help you inform others about their spending to proactively manage cost and with them you can see how spending progresses over time then there is azure advice or recommendations as well these recommendations showhow you can optimize and improve efficiency by identifying ideal and underutilized resources or they can show less expensive resource options as well when you act on these recommendations change the way you use the resources to save money youfirst view the cost optimization recommendation you view potential usage inefficiencies next you act on recommendation to modify your azure resource use to more cost effective option then you verify the action to make sure that the change you make
is successful and finally how can you export the cost management data if you use external systems to access or review the cost management data you can easily export the data from azure and you can set a daily scheduled
Explains how tags help organize resources and group billing data. Then reviews reservations, hybrid benefit, Azure credits, and region selection as ways to reduce costs.
export in csv format and store the data files in azure storage then you can access the data from your external systems let's understand resource tagging you can apply tags to your azure resources logically organize them by categories eachtag consists of a name and a value for example you can apply the name environment and value as prediction or development to your resources after creating your attacks you associate them with the appropriate resource so let me quicklyshow you where you would be able to find tags and how can you apply a tag on a particular azure resource i'm on my azure portal you can use the global search box to type and find tags ifyou have any tags configured you can find all the tags in one single place but if you are trying to figure out how are you gonna add a tag to an existing resource i'm gonna quickly show you how
you can do that so i'm gonna go back to my virtual machines as you can see that i have three virtual machines laid out i want to select the first virtual machine which is my active directory on theleft hand side right under the access control i am i can find the tag so there is no tag available at the moment so i can create a new tag so i created a name called virtual machine asthe name of the tag and the value as project x and i hit save so the next time if i would like to pull all the resources related to project x i can simply select the value and pullthe details as well i'm going to go back to my home select tags and i can see that there is new tag value as well so i select the tag it is going to list me all the resources
i can select the virtual machine project x it is going to display all the resources where i have that as project x so with tags in place you can retrieve all the resources in your subscription with that tagname and value this means that you can retrieve related resources from different resource group as well perhaps one of the best use of tags is the group billing data when you download the usage csv for the services thetags appear in the tag column you could then group the virtual machine by cost center and production environment there are few things to consider about tagging each resource or resource group can have a maximum of 50 tag nameor value paired tags applied to resource group are not inherited by the resources in that resource group so please keep those in mind all right so let's look at some of the cost savings you can do on azure
the first one is azure reservations azure reservations help you save money by pre-paying for one year or three years of virtual machine sql database compute capacity or azure cosmos db throughput pre-paying allows you to get a discount onthe resources you use these reservations can significantly reduce your virtual machine sql database compute and azure cosmos db resource cost up to 72 percent on your pay as you go pricing and these reservations provide a billing discount anddoesn't affect the runtime state of your resources another way to significantly reduce the cost is by leveraging azure hybrid benefits azure hybrid benefit is a pricing benefit for customers who have licenses with software assurance which helps maximize thevalue of existing on-premises windows server and sql server licensing investment when migrating to azure there is an azure hybrid benefit saving calculator to help you determine your savings so let me quickly show you where you can find that
so i'm gonna go to azure pricing calculator so under azure pricing calculator i'm gonna quickly show you an example where you can see the reservations and the hybrid usage benefit i select a virtual machine under virtual machine i'mgoing to first pick a region where i would like to host this virtual machine i'm going to select australia east the operating system i'm gonna keep it as windows um just the operating system is only thing i needright now standard tier and this is where i can pick up any type of virtual machine of my choice so i'm gonna go with ds13 v2 which gives me 2 core and 56 gb ram and i'm going torun 24 7 for a month the asu pricing for this virtual machine is close to 863 dollars now on the left-hand side you can see that there is license included and azure hybrid usage benefit so if you want
to know how to reduce the pricing if you happen to have a windows server subscription or if you or if you have an on-premises license with this software assurance included you select azure hybrid benefit as you can seenow the price suddenly dropped from 863 to 583 this is how you can reduce the cost of your licensing by using azure hybrid usage benefit the next thing is reserving your compute for one or three year so wetalked about azure resolution so if you reserve the compute for one year if you notice the price will drop down from 582 to 371 because you are paying microsoft upfront and microsoft is giving you a huge discount onthis compute instance the second option is i'm going to apply three year reserved instance as you notice right now we have bring down the cost of the virtual machine from 862 to 244 that's how you can significantly reduce
the cost of azure by leveraging multiple components like azure reservations or azure hybrid benefits now we talked about these two concepts let's understand what is azure credits azure credits is monthly credit benefit that allow you to experiment withdevelop and test new solutions on azure for example as a visual studio subscriber you can use microsoft azure at no extra charge with your monthly azure credit azure is your personal sandbox for dev test another way of saving
Introduces management groups as a way to organize subscriptions and apply governance at scale. Then explains Azure Policy definitions, initiatives, scopes, and compliance evaluation.
some cost is choosing the right regions azure regions pricing can vary from one region to another double check the pricing in various regions to see if you can save a little alright so that's brings us to the conclusionof the first lesson from the module 2 we learned about azure subscriptions and different types of azure accounts you can use in this lesson we're going to learn about azure policy let's have a look at the high levelthings what we are going to see on this video we are going to talk about what is management group and we are going to spend quite a lot of time on azure policy i'm going to explain what isazure policy how can you implement an azure policy what do you want to know about azure definitions when you create definitions what do you mean by initiative definition and how do you define a scope for your definitions and
how can you create azure policies to determine compliance as well and throughout the journey i will take you through the portal and show you exactly what i mean by each of these topics let's talk about management groups ifyour organization has several subscriptions you may need a way to effectively manage access policies and compliance for those subscriptions azure management groups provide a level of scope above subscriptions you organize subscription into containers called management groups so letme take you through the portal to show you where you can find the management group you can search for management group on the global search box find the management group as you can see that i already have onemanagement group created so you can organize subscription into containers called management group and apply your governance conditions to the management groups so when you create management groups you would be able to enable organizational alignment to your azure subscription
through custom hierarchies and groupings targeting of policies and spend budgets across subscription and inheritance down these hierarchies and compliance and cost reporting by organizations as well so all the subscriptions within a management group automatically inherit the conditions appliedto the management group for example you can apply policies to a management group that limits the regions available for virtual machine creation this policy would be applied to all management groups subscriptions and resources under the management group byonly allowing vm to be created in that region you can create a management group using the azure portal powershell or azure cli when you create a management group it asks for a management group id and a management groupdisplay name the management group id is the directory unique identifier that is used to submit commands on this management group this identifier is not editable after creation as it is used throughout the azure system to identify this group
the display name field is the name that is displayed within the azure portal a separate display name is an optional field when creating the management group and can be changed at any time so let's learn about azure policyazure policy is a service in azure that you can use to create assign and manage policies these policies enforce different rules over your resources so those resources stay compliant with your corporate standards and service level agreements azure policydoes this by running evaluations of your resources and scanning for those not compliant with the policies you have created the main advantages of azure policies are in the areas of enforcement scaling and remediation so let's talk about enforcementand compliance turn on built-in policies are built custom ones for all resource type real-time policy evaluation and enforcement periodic and on-demand compliance enforcements so what about apply policies at scale apply policies to a management group which controls across
your entire organization what about remediation you can use real-time remediation and remediation on existing resources as well so azure policy will be important to you if your team runs an environment where you need to governance things like multipleengineering teams multiple subscription or you may need to standardize or enforce or manage regulatory compliance and cost control as well before we dive deep into azure policies let me give you some of the use case scenarios of azurepolicies you can specify a set of virtual machines cues that your organization can deploy another use case scenario would be you can restrict the location your organization can specify when deploying a resource or you would be able toenforce a required tag and its value and finally you would be able to audit if the azure backup service is enabled for all virtual machines or not so let's go and find out some of the detailed information about
azure policy okay let's look at how can you implement an azure policy to implement an azure policy you have to follow these four steps the first one is browse for policy definitions don't worry i will definitely take youthrough the azure portal to show you how to do that but let's understand these steps in detail before we proceed and do that a policy definition expresses what to evaluate and what actions to take every policy definitions hasconditions under which it is enforced and it has an accompanying effect that takes place if the conditions are met for example you could prevent vms from being deployed if they are exposed to a public address the second actionis create initiative definitions an initiative definition is a set of policy definitions to help track your compliance state for a larger goal for example ensuring a branch office is compliant the third action is scope the initiative definition you
can limit the scope of the initiative definition to management groups subscriptions or resource groups the fourth and the final step is view policy evaluation results once an initiative definition is assigned you can evaluate the state of compliance forall of your resources so what are policy definitions so let me take you to the azure portal and show you where you can find the policies first so i'm on my azure portal i'm going to click on policyif you don't see policy over here you can search your policy on this global search box under policy you can come to definitions so there are many built-in policy definitions for you to choose from sorting by category willhelp you locate what you need so for example i'm going to select allowed virtual machines cue size this enables you to specify a set of virtual machine skus that your organization can deploy or i'm going to search for
another policy now location so allowed location policy enables you to restrict the locations that your organization can specify when deploying resources this can be used to enforce your jio compliance requirements if there isn't an applicable policy you canadd a new policy definition the easiest way to do this is to import a policy from github or you create a new policy from scratch so please note that policy definitions have a specific json format as an azureadministrator you will not need to create files in this format but may want to review the format just so that you are familiar with it once you have determined which policy definitions you need you can create an initiativedefinition this definition will include one or more policies please note that currently an initiative definition can have up to 100 policies the next action is scope the initiative definition so once our initiative definition is created you can assign
the definition to establish its scope a scope determines what resources or grouping of resources the policy assignment gets enforced on so in this you can see that the scope is the subscription but when you create a new definitionyou can decide which scope you want to assign it to you can either select a subscription and then optionally select a resource group as well and last but not the least is determining the compliance once your policy inplace you can use the compliance blade to review non-compliant initiatives policies and non-compliant resources so i go back to my azure policy widget and based on the policies you have defined you can go and click on compliance tosee how compliant you are as you can see that i'm not compliant on this particular policy when a condition is evaluated against your existing resources and found true then those resources are marked as non-compliant with the policies although
the portal does not show the evaluation logic the compliant state results are shown so typically the compliant state results are either compliant or non-compliant so please note that policy evaluation happens about an hour which means that if you
Explains Azure RBAC concepts such as security principals, role definitions, scopes, and assignments. Also compares Azure RBAC with Azure AD administrative roles and reviews built-in roles.
make changes to your policy definition and create a policy assignment then it will be re-evaluated over your resources within the hour all right so we just finished the second lesson of the second module so we learned about managementgroup and azure policy in this video i'm going to talk about role-based access control so let's have a look at the high level view on what are the topics we are going to see on this video we're goingto start with the role base access control what it means and how can you define the definition and the assignments what's the main difference between azure rbac and azure 80 administrative roles so it's very important us for tounderstand what are the key differences between these two then our back authentication and what is our back roles etc every time i explain a particular concept i will take you through where you can see that in the azure
portal as well access management for cloud resources is critical function for any organization that is using the cloud role-based access control or rbac helps you manage who has access to these azure resources and what can they do withthese resources and what areas they have access to so our back is an authorization system built on azure resource manager that provides fine-grained access management of resources in azure so let's understand what can i do with our backso i'm going to give you some of the example what you can do with our back you can allow an application to access all resources in a resource group another example could be allow one user to manage virtualmachine in a subscription and another user to manage a virtual network or allow a dba group to manage sql database in a subscription or allow a user to manage all resources in their resource groups such as virtual machine
websites and subnets so let's understand some of the concepts for our back security principle role definition scope and assignment so what is security principle object that represents something that is requesting access to resources example user group service principleand manage identity the second one is role definition collection of permissions that list the operation that can be performed example is reader contributor owner user access administrator etc and then the third concept is scope boundary for the levelof access that is required example is management group subscription resource group and resources and finally assignment which is attaching a role definition to a security principle at a particular scope so users can grant access described in a roledefinition by creating an assignment deny assignments can currently read only and can only be said by azure so what are the best practices for our back using our back you can segregate duties within your team and grant only
the amount of access to users that you need to perform their job instead of giving everybody the unrestricted permission in your azure subscription or resources you can allow only certain action at a particular scope when planning your accesscontrol strategy it's a best practice to grant users the least privilege to get their work done so this following diagram shows a suggested pattern of using rbac each role is a set of properties defined in a json filethe role definition include name id and description it also include allowable permissions actions denied permissions and scope for the role so in this example the owner role means all actions no denied actions and scope so what about roleassignment a role assignment is a process of attaching a role definition to a user group or service principle in a managed identity at a particular scope of purpose of granting access so the access is granted by creating a
role assignment and access is revoked by removing a role assignment so you can select a user and remove a role assignment or you can simply add over here to add a new role assignment for a user so thisdiagram shows an example of a role assignment in this example the marketing group has been assigned the contributor role for the pharma sales resource group this means that the users in the marketing group can create or manage anyazure resource in the pharma sales resource group marketing users do not have access to resources outside the pharma sales resource group unless they are part of another role assignment notice that the access does not need to be grantedto the entire subscription roles can also be assigned for the resource group as well as an individual resource so let us understand what is the main difference between azure rbac roles versus azure ad roles if you are new
to azure you may find a little challenging to understand all the different roles in azure i'm going to explain the following roles and when you would use each one of those the first one is classic subscription administrator roleor azure role based administrator control so to better understand roles in azure it helps to know some of the history when azure was initially released access to resources was managed just by three administrative roles account administrator service administratorand co-administrator later role-based access control for azure resources was added so azure are back is a newer authorization system that provides fine-grained access management to azure resources so our back include many built-in roles and it can be assignedto different scopes and allows you to create your own custom roles as well to manage resources in azure 80 such as users groups and domains there are several azure ad roles at a high level azure our back rules
control permissions to manage azure resources while azure ad administrator roles controls permissions to manage azure active directory resources this is the following table which compares some of the differences please note that classic administrative role should be avoided ifyou are using azure resource manager when it comes to our back authentication our back includes many built-in roles and can be assigned to different scopes and allows you to create your own custom roles to manage resources in azure80 such as users groups and domains there are several azure ad administrative roles so this diagram is a high level view of how the azure are backed roles and azure id administrator roles are related so do you seehow azure ad admin roles and azure are back roles work together to authenticate users so let me take you through azure our back roles first azure includes several built-in roles that you can use the following list are the
four fundamental built-in roles the first three applies to all the resources so the first role is owner owner has full access to all resources including the rights to delegate access to others the service administrator and co-administrators are assignedto the owner role at the subscription scope this applies to all resource type contributor can create and manage all types of azure resources but can't grant access to others this applies to all resource types then again reader readercan view existing azure resources again this applies to all resource types as well and last one is user access administrator user access administrator lets you manage user access to azure resources so this applies to managing access rather thanmanaging resources so let me show you the rest of the built-in roles so i'm in my azure portal so let me quickly show you what are the built-in roles available for a user you can go under roles and
this is where you would be able to find all the built-in rbac rules available within the azure subscription so you have the owner contributor reader are the three main roles we talked about and then there is user accessadministrator the rest of the built-in roles allow management of specific azure resource for example virtual machine contributor role allows a user to create and manage virtual machine but the built-in role doesn't meet the specific needs of your organizationyou can create your own custom roles as well azure has introduced data operations that enable you to grant access to data within an object for example if a user has read data access to the storage account then they
Reviews questions on management groups, tags, budgets, policy initiatives, resource groups, resource locks, and RBAC scope. Reinforces how governance tools are used together in Azure.
can read the blobs and messages within the storage account all right so now we have completed the module three module three is all about governance and compliance and in this video we talked about role-based access control and inthis video we're gonna go through the review questions of the lessons what we have learned on the previous module let's look at the first question you need to target policies and review spend budgets across several subscriptions you managewhat should you do and you can only select one answer from below so the key word here is you need to target policies and you need to review spend budgets so what can you do is it create aresource group definitely not resource group is a logical container you have to create to place your azure workloads is it create azure policies yep you can create policies to place any condition on any workload but that is not
going to resolve targeting and reviewing spends is it billing groups definitely not that is not going to resolve either so the correct answer is create management groups management group can be used to organize and manage subscriptions let's lookat question number two you would like to categorize resources and billing for different departments like it and hr the billing needs to be consolidated across multiple resource groups and you need to ensure that everyone complies with this solutionwhat should you do so you need to choose two to complete the solutions so within the exam you might find you need to choose more than one answer to complete the whole solution so what are the key wordshere so you need to categorize and you need to categorize resources and billing or different departments and you need a solution for that and the second is the billing need to be consolidated across multiple resource group so is
it create a subscription account rule definitely not he said add the group into a single resource group by adding a group into a resource group is not going to solve that problem is it create a billing group foreach department that is a time consuming and not an efficient way of doing things so the correct answer is create tags for each department so by creating tags you would be able to filter and categorize each department usingdifferent tags and the second answer is create an azure policy as well so you should create a tag with key value pair like department like hr or sales etc and then you can then create an azure policy whichrequires the tag to be applied before a resource is created that's why these two are part of the solution so let's look at the third question your company financial controller wants to be notified whenever the company is halfway
to spending the money allocated for cloud services what should you do and you need to select one only one answer all right so the key over here is you need to have a mechanism to notify your financial controllerwhenever you are nearing to your spending limit so is it by creating an azure subscription uh sorry is it by creating an azure reservation definitely not reservation is an ability to reserve a compute in azure to save coston this workload is it to create a management group management group is created to manage multiple subscriptions at once is it entering workload in the total cost of omniship calculator it's absolutely ridiculous so these three are not theright answer so the correct answer is create a budget and a spending threshold billing alerts help you monitor and manage billing activity for your azure accounts you can set up a total of 5 billing alerts per subscriptions with
a different threshold and up to two email recipients for each alert monthly budgets are evaluated against spending every four hours and budgets reset automatically at the end of the period let's look at the next question your organization hasseveral azure policies that you would like to create and enforce for a new branch office what should you do and you need to select one answer this pretty straightforward question so you have several azure policies and what canyou do to enforce it we just learned about it so the correct answer is azure policy initiative nothing else can dissolve it not by creating a management group or not by creating a resource group or not by havinga subscription so you have bunch of azure policies you create a policy initiative to enforce these policies to your branch office a policy initiative would include all the policies of interest once your initiative is created you can assign
the definition to establish a scope a scope determines what resources or grouping of resources the policy assignment gets in first on right so the next question is your manager asked you to explain how azure uses resource group youprovide all the following information except one so i think three of the solution or three of the choices given below are right and one of the statement is wrong so we just have to eliminate which one is wrongso i'm going to read out from the beginning resources can be in only one resource group which is absolutely right you you when you create an azure resource you are supposed to place that resource in a logical containercalled resource group and you can only place that resource in one resource group second statement resources can be moved from one resource group to another resource group absolutely possible so when you would like to move a resource from
one resource to another resource group all you have to do is log into the azure portal or use the powershell and move a resource from one resource group to another resource group another tip is that you can moveresources from one subscription to another subscription as well not all the resources though but most of the resources are possible the next option is resource groups can be nested uh that is not possible resource groups cannot be nestedso that is the wrong option here but the right answer for this particular question so let's do so let's read the last option role-based access control can be applied to the resource group absolutely possible so you can createa role-based access control granular permission to the resource group or for resources as well let's look at the question number six which of the following would be a good example of when to use a resource lock select one
again we are going to go through each statement and we are going to find the appropriate statement where we feel this is the best place where we can use the resource lock so i'm going to start from thebottom a resource group for a new branch office that is just starting up i don't think you need to place a resource group or a resource lock for a resource group for a new branch office which is juststarting up it is not even relevant for it a storage account used to temporarily store image images processed in a development environment absolutely not because first of all it's a development environment and second of all it's a temporarystore to place your image processing so you don't need a lock there it's not a critical resourcenext statement a non-production virtual machine used to test occasional application build again not an ideal scenario where you will place a resource lock because first of all it's a non-protection virtual machine and second it is only occasionally used
to test so the correct answer is an express route circuit with connectivity back to your on-premises network resource lock prevent another user in your organization from accidentally deleting or modifying critical resource and express route is a critical resourcein an organization
all right let's look at question number seven your company hires a new it administrator she need to manage a resource group with first-tier web servers including assigning permissions however she should not have access to other resource group insidethe subscription all right so we need to prevent her from accessing other resources within the subscription that's the key statement here guys and you need to configure role based access what should you do and you only need toselect one so what do you guys think the right answer is is it assigning her a subscription owner access definitely not if you assign the it administrator the subscription owner right she would be able to access any resourcesin that particular subscription is it assigning her with a subscription contributor again she would be able to access other resources within the subscription as well is it assigning her to the resource group owner absolutely correct so you would
assign this it administrator lady a resource group owner rights because the new it administrator need to be able to assign just permissions to assign permission you need an owner right not the contributor right all right so let's lookat the last question on this module you have three virtual machines vm1 vm2 and bm3 in a resource group the help disk hires a new employee the new employee must be able to modify the settings on vm3 butnot on vm1 and vm2 your solution must minimize administrative overhead what should you do and select one so the new employee must only be able to modify the settings on vm3 so you need to prevent that employee frommodifying anything on vm1 and vm2 so out of these options what do you think is going to be the right answer so let's go and read out the statements assign the assign the user to the contributor role on
the resource group definitely not because if you assign somebody a contributor role on the resource group that user will be able to modify anything within that resource group that includes vm1 and bm2 the next option is assign theuser the contributor role on vm3 absolutely right so you only assign the contributor role on bm3 so that the user can modify anything on bm3 but not on vm1 and bm2 so that is the right answer so now
Introduces Azure Resource Manager, its deployment model, and key terms like resources, resource groups, providers, and templates. Also covers locks, moving resources, and subscription limits.
we have finished two modules and we have gone through two modules review questions in the next module i'm going to take you through azure administration and in the first lesson we're going to talk about resource manager let's havea quick look at what are the things we're going to learn on this particular lesson we're going to start with what is resource manager and we are going to understand few terminologies around resource manager as well and whatare the different ways you can deploy these resource groups uh what is resource manager lock and how can you move these resources between these resource groups or subscriptions how can you remove resources and resource groups and what aresome of the limitations of these resources and along the way whenever i explain things if it is necessary i will take you back to the portal to show you exactly what i mean the infrastructure for your application is
typically made up of many components maybe a virtual machine a storage account and a virtual network or a web app database and database server and a third-party services these components are not separate entities instead they are related andinterdependent part of a single entity you want to deploy manage and monitor them as a group azure resource manager enables you to work with these resources in your solution assay group you can deploy update or delete all theresources for your solution in a single coordinated operation you use a template for deployment and that template can work for different environments such as testing staging and protection as well so resource manager provides security auditing and tagging featuresto help you manage your resources after deployment let's look at the management layer experience of resource manager so resource manager provides a consistent management layer to perform tasks through azure powershell azure cli azure portal rest apis and client
sdks all capabilities that are available in azure portal are also available through azure powershell azure cli and azure list apis and client sdks functionality initially released through apis will be represented in the portal within 180 days of initialrelease you can choose the tools and apis that works best for you and they have the same capability and provide consistent results this following image shows how all the tools interact with the same resource manager api and theapi passes the request to the resource manager service which authenticates and authorizes the request resource manager then routes the request to the appropriate resource providers and you may be wondering what are the benefits of resource manager there areseveral benefits let me quickly highlight some of it before we move on to terminology you can deploy manage and monitor all the resources for your solution as a group rather than handling these resources individually another benefit would be
you would be able to repeatedly deploy your solution throughout the development life cycle and have confidence in your resources are deployed in a consistent state or you can manage your infrastructure through declarative templates rather than scripts another benefitwould be you can define the dependencies between resources so they are deployed in the correct order all right so let's look at some of the terminologies if you're new to azure resource manager there are some terms you mightnot be familiar with something like resource so what is a resource resource is a manageable item that is available through azure some common resources are a virtual machine storage account web app database and virtual machine but there aremany more so what is a resource group resource group is a container that holds related resources for an azure solution the resource group can include all the resources for the solution are only those resources that you want to
manage as a group you decide how you want to allocate resources to resource group based on what makes the most sense for your organization so let's understand what is resource provider resource provider is a service that supplies theresources you can deploy and manage through resource manager each resource provider offers operations for working with the resources that are deployed some common resource providers are microsoft dot compute which supplies the virtual machine resource another resource provider ismicrosoft dot storage which supplies the storage account resource and microsoft.web which supplies the resources related to web apps so what are arm template arm template is a json or javascript object notation file that defines one or more resourcesto deploy to a resource group it also defines the dependencies between the deployed resources the template can be used to deploy the resources consistently and repeatedly finally let's understand what is a declarative syntax syntax that lets you state
here is what i intended to create without having to write the sequence of programming commands to create it the resource manager template is an example of declarative syntax in the file you define the properties for the infrastructure todeploy to azure let's understand resource group deployments resources can be deployed to any new or existing resource group deployment of resources to a resource group becomes a job where you can track the template execution if deployment fails theoutput of the job can describe why the deployment failed whether the deployment is a single resource to a group or the template to a group you can use the information to fix any errors and redeploy deployments are incrementalif a resource group consists two web apps and you decide to deploy a third the existing web app will not be removed currently immutable deployments are not supported in a resource group to implement an immutable deployment you must
create a new resource group so you need to be aware of some of the considerations resource groups are at the simplest a logical connection of resources there are a couple of small rules for resource groups resources can onlyexist in one resource group and these resource group cannot be renamed and you need to understand that resource groups can have resources of many different types and services in one single group and resource group can have resources frommany different regions as well so there are some important factors to consider when defining your resource group all the resources in your group should have a same life cycle you deploy update and delete them together each resource canonly exist in a single resource group i'm sure you're aware of that so please note that by scoping permissions to the resource group you can add remove and modify resources easily without having to recreate assignments and scopes so
let's understand what is resource manager logs a common concern with resources provisioned in azure is the ease in which they can be deleted let me show you what i mean i'm on my azure portal i'm gonna quickly goto a resource group i'm gonna select a resource group looks like i don't have any resources within this group let's pick another resource group as you can see that there is a resource within this resource group so ias a user if i have contributor or owner access to this resource group or in the subscription i can simply go and select the resource i would be able to go and delete the resource without any issues sothe resource manager logs allow organization to put a structure in place that prevents the accidental deletion of resources in azure so i have this resource group over here i have many resources within part of this resource group i
want to prevent any sort of accidental deletion happening in this resource group so on the left hand side under settings i can find there is an option called logs so you can associate the logs with a subscription resourcegroup or resource and logs are inherited by child resources so you can simply add and i can add a lock when trying to add a lock there are two types of locks available read only and delete locks readonly logs prevent any changes to the resources and delete logs will prevent any sort of deletion please note that only the owner and user access administrator roles can create or delete management logs so let's understand how you canmove resources between resource group and subscription sometimes you may need to move resources to either a new subscription or a new resource group in the same subscription when moving resources both the source group and the target group are
locked during the operation write and delete operations are blocked on the resource group until the move completes this lock means you can't add update or delete resources in the resource groups but it doesn't mean that the resources arefrozen for example if you move a virtual machine to a new resource group an application accessing the virtual machine experiences no downtime so there are some limitations so be so before beginning the process be sure to read moveoperation support for resources page this page details what resource can be moved between resource groups and subscriptions so i'm on my azure portal when you click on a resource group select the resources which you would like to moveso right now you can see that the move operation is grayed out as soon as you select resources this turns on so you can click on this move option let me zoom it and you get two options move
to another resource and move to your subscription so when i click on move to another resource it asks you to select a resource group where you would like to move and you select a new resource group and yousay that you understand the tools and scripts associated with the resource and you can hit ok to move it another option is i can come over i can go back and click on move and select another subscription soi don't have any subscription to move the resources to so there is a prerequisite for it so you need to add another subscription to your existing azure account so that it gives it gets an option to show youwhere to move these resources to and if you're wondering how to remove resources you can select these and you can delete these resources or you can select the delete the resource group as well before deleting it you need
to give a consent to say that at least you need to type in the name of the resource group or sometimes if you are trying to delete a particular resource you just need to type yes to confirm ityou can use the powershell to delete the resource group as well use caution when deleting a resource group deleting a resource group deletes all the resources contained within it that resource group might contain resources that resources in otherresource group depends on if you're using powershell to remove the resource group use the command remove dash azure resource group you need to understand some of the resource limits as well azure provides the ability to observe the numberof each network resource type that you have deployed in your subscription and what your subscription limits are the ability to view resource usage against limits is helpful to track current usage and plan for future use so the limits
shown are the limits for your subscription if you need to increase a default limit there is a request increase link you will complete and submit the support request all resources have a maximum limit listed in azure list ifyour current limit is already at the maximum number the limit can be increased all right so now that we have learned about the resource manager and the resource group and the resource group limitations in the next lesson we're
Walks through the Azure portal interface, dashboards, settings, and navigation features. Then introduces Azure Mobile App and Cloud Shell for browser-based management.
going to learn about azure portal and cloud shell so let's have a look at the high level topics we are going to learn in this particular video we will start with azure portal and what is azure mobile appdemonstration around azure portal and azure cloud shell and how you can use this to manage your workloads within azure so without wasting any more time let's get into it azure portal lets you build manage and monitor everything fromsimple web apps to complex cloud application in a single unified console you might have seen azure portal many times let me take you through and give you a walkthrough on the azure portal so i'm on my azure portalnow in this portal you can search for resources and services and documentation etc using this global search box when you sign in you can you can see who you signed in with what sort of an access you got
and you can sign in with multiple accounts as well and this gives you an ability to switch directory so if you happen to have access to multiple directory you can sign in and switch between directories you can alwaysgive feedback to microsoft related to what you are experiencing this can be accessible from any portal where you are at if you would like to raise any support ticket with microsoft click on help and support takes you tothe place where you can raise your support ticket settings many you give you a lot of options like configuring your general settings changing your default look of your portal uh do you like to have a fly out ordo you like to have a docked menu i prefer the dark one and what sort of a theme do you like i'm a big fan of dark theme but i get that sometimes when i'm explaining things it's very
difficult for you to like pinpoint and understand what i mean by that so i change it to little gray theme or i try to keep it one side dark another another side bright then you have an option tochange the contrast themes as well i like to keep it none if you want to enable your pop-up notification you can do that as well over here when you deploy or any sort of activity happening within azure allthe notification will come up over this screen then you have the switch directory icon over here to switch between these directories and you can access the cloud shell over here which will come back later right now you areviewing my dashboard within the dashboard area you have an ability to download and upload a new dashboard you can make it as a blank dashboard you can make it a full screen you can click escape to come back
to the regular mode you get an option to edit uh in this edit mode you can resize your existing view you can change and move things around and you can decide how you would like to see your dashboardlike so i'm going to quickly change a few items over here to show you what are the possibilities if you want you can add more stuff anytime when you add more and more stuffs get added to your dashboardso i will let you play out your imagination when you are going and modifying this go nuts and click on done and now when i say done customizing you can see that i have a new dashboard once ihave the new dashboard before i work on it i can click on clone and then i can get a default view of what i have done before and name your new dashboard and do my further customization as well
so that's about the dashboard on the left hand side on the dock area this is where you can see all the highlighted services as you can see that i have resource group storage account virtual machine etc let's supposeif i want to have a virtual network available i can go to the global search box i can type in virtual network and select virtual network and work on it but if i want to keep it on theleft hand side i can go to all services and type in virtual network when you hire virtual network you get this star icon or a highlight option so i can click on this highlight immediately that's put that optionon the dock window so now since i have it on the dock i can move it around so if virtual network is something which i'm going to constantly work on and i have to have an easy access to
that i can place it on the left hand side so now i have virtual network on the left hand side so you get the idea right there are plenty of things you can do it don't worry about itthe more you work on it you get more familiarized with the portal the next one is azure mobile app unfortunately i can't demonstrate the azure mobile app but you can go and download it from your favorite app storeor a google play store and install the azure mobile app when you install it you can stay connected to the cloud and check status and critical metrics anytime and anywhere with the azure mobile app you don't need tobe in front of your computer to keep an eye on your azure resources such as vms and web apps you can stay connected no matter where you are from your ios or android mobile device you can check for
alerts view metrics and take corrective actions to fix common issues and restart a web app or connect to a vm directly and be agile and respond to issues faster with the azure mobile app and finally you can runcommands to manage your azure resources as well so you want to use a command line run an adhoc answer cli or powershell commands from your azure mobile app and stay in control your resources and take corrective actions likestarting and stopping vms and web pages etc even though we touched upon azure cloud shell let's learn a bit more about that azure cloud shell is an interactive browser accessible shell for managing azure resources so let me showyou where you can find that i am now on my azure portal right on top of the ribbon you can see the cloud shell over here so the cloud shell provides the flexibility of choosing the shell experience that
best suits the way you work linux users can opt for bash experience while windows users can offer powershell and this cloud shell enables access to a browser-based command line experience built with azure management task in mind so let'stalk about some of the cloud shell features cloud shell offers an integrated graphical text editor based and open source monaco editor it authenticates automatically for instant access to your resources and runs on a temporary hosted provider on aper session per user basis and cloud shell times out after 20 minutes without interactive activity and cloud shell requires a resource group storage account and azure file share and cloud shell is assigned one machine per user account andcloud shell permissions are set as a regular linux user in bash so now that we have come to the end of this particular lesson we have learned about azure portal and different ways you can manage and customize azure
Explains how to install and use Azure PowerShell locally and through Cloud Shell. Then shows how to install Azure CLI and sign in to manage Azure resources from the command line.
portal for your need and then we learned about azure cloud shell and we touched upon azure mobile app as well in this video i'm going to teach you how to use azure powershell and cli let's have a quicklook at what are the things what we are going to learn on this video we will learn about what is azure powershell and what are the powershell commandlets and modules you can use and a quick demonstration on howto use powershell which is by installing it locally and using it then we're going to follow the same process for azure cli and it is going to follow it up with azure cli working on a local machine andhow you can use the cli as well so without wasting any more time let's get into it azure powershell is a module that you can add to windows powershell or powershell core to enable you to connect to your
azure subscription and manage resources azure powershell requires powershell to function official provides services such as shell window and command parsing and azure powershell and the azure specific commands for example azure powershell provides the new dash azvm command thatcreates a virtual machine inside your azure subscription you use it you need to launch the powershell application and then issue a command such as new acvm resource group unit mention which resource group it is and the name ofthe vm and which image of the operating system you are going to choose with azure powershell is also available two ways the first option is to choose the azure cloud shell and change to powershell so you can useazure powershell via azure cloud shell without installing it in a linux or a mac operating system a second option is you can install it locally on a linux or a mac or a windows operating system in both cases
you have two modes from which to choose from you can use it in an interactive mode in which you can manually issue one command at a time or in a scripting mode where you can execute a script thatconsists of multiple commands as well so let me show you how you can work with powershell so i am going to open the powershell in an elevated command so right click and launch in and run as an administratorso i have launched the powershell module in an elevated privilege in this demonstration we will install azure az powershell module the azid module is available from a global repository called the powershell gallery you can install the module ontoyour local machine through install module command you need an elevated powershell shell prompt to install modules from the powershell gallery please note that if at any time you receive errors during running script is disabled be sure to set
the execution policy so i'm going to run the execution policy now the next step is i'm going to install the az module again make sure that you are running in an elevated privilege and run the command like installdash module name az and allow cobbler depending on the new get version you have installed you might get a prompt to download and install the latest version if prompted then trust the repository by default the powershell gallery isn'tconfigured as a trusted repository for powershell get the first time you use the powershell gallery you will be prompted and as prompted install the modules now we have completed the installation of the azure model let's see if wecan connect to an azure account so i'm gonna put a command called connect dash az account that should give me an ability to connect to an azure subscription all right i'm gonna put in the credential to connect to
an azure subscription put in the username and sign in with the password alright so it is now connected to the azure subscription now to get the details about the subscription i can simply type get azure subscription and iwill have the details about the subscription which i am connected to now i can go ahead and use azure commands like new az resource group create a new resource group lots of command to create any resources within myazure subscription as you can see that it returned the value like what subscription it is uh subscription id tenant id and what is the state of the subscription so we just completed the demonstration part we learned about howto install an asset module install the new get and we trusted the repository and we connected to an azure and view the subscription information as well let's learn about azure cli azure cli is a command line program to
connect to azure and execute administrative commands on azure resources it runs on linux mac operating system and windows and allows administrators and developers to execute their commands through a terminal or a command line prompt or script instead ofa web browser for example to restart a vm you would use a command such as azvm restart and give a resource group and what's the vm name the azure cli provides cross platform command line tools for managing azureresources you can install this locally on your computer running linux or mac or windows or you can also use the azure cli from the browser through the azure cloud shell in both cases azure cli can be used interactivelyor through scripts so let me show you how to install the azure cli on your local windows computer so go to aka dot ms slash install azure cli for windows and that will automatically download the cli on your
local computer so i'm gonna wait for this installation so i'm gonna wait for this download to com complete or looks like it is downloading second time and i'm gonna launch the downloader right i'm gonna accept the terms andi'm gonna install azure cli on my local machine please note that running azure cli from powershell has some advantages over running a cli from the windows command prompt official provides more chat completion features than the command prompt solet's finish and launch the azure cli so i'm going to open my powershell again i open a new azure powershell with an elevated control and i'm going to start azure cli and verify your installation now i'm going torun a z-version to verify the installation by running this version check so you can see the version of this azure cli now i can simply log into azure by running az login and this will give me an ability
to sign into my azure subscription as well again this is redirected to azure to login for the first time i'm not going to log in now but you get the point right so you can use azure cli justlike how you use for azure powershell as well all right so i hope the information provided on azure powershell and the azure cli was useful we are still under the module 3 which is azure administration and in this
Describes the purpose and benefits of ARM templates for repeatable deployments. Covers schema, parameters, variables, functions, outputs, and Azure Quickstart templates.
lesson we're going to learn about arm templates let's have a quick look at the high level view on what are the things we are going to learn on this video we are going to talk about these arm templatesadvantages and what are the benefits of arm template then we will go through schema parameters variables functions and resources and outputs i will give you a quick high level view on what is azure arm template quick start templatesand during the whole process we will have a demonstration around what i am talking about as well so without wasting any more time let's get into it the azure resource manager template precisely defines all the resource manager resourcesin a deployment you can deploy a resource manager template into a resource group as a single operation using resource manager template will make your deployments faster and more repeatable for example you no longer have to create a vm
in the portal wait for it to finish and then create the next vm resource manager takes care of the entire deployment for you so before we dive deep into arm templates let me quickly tell you some of thebenefits of arm template the first one is arm templates improves consistency resource manager templates provide a common language for you and others to describe your deployments regardless of the tool or the sdk that used to deploy the templatethe structure format and expressions inside the template remain the same another benefit is expresses complex deployments templates enable you to deploy multiple resources in the correct order for example you wouldn't want to deploy a virtual machine prior tocreating an operating system disk or network interface resource manager maps out each resource and its dependent resources and create dependent resources first dependency mapping helps ensure that the deployment is carried out in the correct order another advantage is
these templates reduce manual error prone task manually creating and connecting resources can be time consuming and it's easy to make mistakes resource manager ensures that the deployment happens the same way every time and you have an ability torun these templates as a code as well template expresses your requirement through code think of a template as a type of infrastructure as a code that can be shared tested and versioned similar to any other piece of softwarealso because templates are code you can create paper trail that you can follow the template code documents the deployment most users maintain their templates under some kind of revision control such as git when you change the template itsversion history also documents how the template and your document has evolved over time and by doing that these arm templates promote reusability as well your templates can contain parameters that are filled in which the template runs a parameter
can define a username or password a domain name and so on the template parameters enable you to create multiple versions of your infrastructure such as staging and production while still utilizing the exact same template these templates are linkableyou can link resource manager template together to make the template themselves modular and you can write smaller templates that each define a piece of a solution and then combine them to create a complete system and finally these templatessimplify orchestrations you only need to deploy the template to deploy all of your resources you only need to deploy the template to deploy all of your resources normally this would take multiple operations let's talk about the template schemaarm templates are written in json which allows you to express data stored as an object such as a virtual machine in text a json document is essentially a collection of key value pairs each key is a string whose
value can be a string a number a list of values an object etc search for deploy a custom template you can create your own template using the editor or you can use some of the common templates available i'mgonna click a create a windows virtual machine common template and this is how it looks like if you select that option i'm gonna go back to selected template and this time i'm going to search for i'm going toselect a template with an active directory with a new domain and high availability and i'm going to click on edit template and this gives you a view of what i'm talking about the schema is the location of thejson schema file that describes the version of the template language in the parameters section of the template you specify which values you can input when deploying these resources the available properties of the parameters are name default value allowed
value minimum value maximum length minimum length etc then we have template variables this template section is where you define values that are used throughout the template the variables can help make your template easier to maintain for example youmight define a storage account name one time as a variable and then you use this variable throughout the template if the storage account name changes you need to only update the variable once and then we have template resourcesthis section is where you define the azure resources that make up your deployment the type of the resource is like the microsoft dot network slash public ip address etc because resource types can change over time api versions referto the version of the resource type you want to use as resource type evolves you can modify your template to work with the latest features so let's talk about template functions this section is where you define procedures that
you want to repeat throughout the template similar to variables functions can help make your template easier to maintain when defining a use of functions there are some restrictions functions can't access variables and the function can only use parametersthat are defined in the function and the function can't use reference function as well so here is a function that create a unique name you could use this function when creating resources that have globally unique naming requirements whatabout template outputs this section is where you define any information you would like to receive when the template runs for example you might want to receive your vm's ip address or fully qualified domain names information you don't knowuntil the deployment runs so here is a structure of that output definition so it's a good practice to comment your templates for inline comments you can comment a single line with double stash dot and you can comment a
block of line with slash asterix or astrix this can vary across different tools so be sure to check that what works for you so what is kickstart templates azure quickstart templates are resource manager templates provided by the azurecommunity templates provide everything you need to deploy your solution while others might serve as a starting point for your template either way you can study this template to learn how to best author and structure your own templates solet me quickly show you how to access these kickstart templates so i'm on the azure quickstart templates page this is where you would be able to find all the templates available so let's quickly check the first one whichis deploy a simple virtual machine for windows so you can read about what this template means and you can understand the parameters required for the template and you can click on browse to github to get more information related
to this template as well you can click on visualize to see how it is going to look like when you deploy it and what are the components which is involved in in this particular deployment as well now ifyou wish to deploy you can click on deploy to azure this straight away take you this template into your azure portal as well since i have logged in in the same browser window it took me to the sameplace where you just have to fill a few information related to the template and click on review and create to start your installation that's how simple is to use a quick start template and this template provide everything youneed to deploy your solution now that we have learned about the arm template schema function and output file and we learned about what is azure quickstart template as well so that concludes the module 3 which is azure administration
Reviews questions on resource group creation, Cloud Shell behavior, PowerShell login, moving resources, ARM template structure, and quota increases. Reinforces the main Azure administration concepts.
in this video we're going to go through a quick review questions on the things what we have learned so far let's look at the first question you are creating a new resource group to use for testing which twoof the following parameters are required when you create a resource group with powershell or cli select two so when you're going to create a resource group what are the two parameters required if you use powershell or cli isit tag definitely not tag is an optional parameter is it subscription you don't have to provide subscription as a parameter anywhere is it region again region is not a default parameter as well so the two required parameters whencreating a resource in powershell or cli are location and name location and name are required by powershell new dash a z resource group and cli which is a z group create so let's go through question number two which
of the following is not true about cloud shell and you need to select one so i'm going to read out all the statement and figure out which one is going to be not true so the first statement isauthenticates automatically for instant access to your resources absolutely correct so cloud shall authenticate automatically second statement each user account can be assigned multiple machines which is not true each user account cannot be assigned multiple machines the cloud shellis assigned one machine per user account so that is that statement is not true let's go through other statements as well cloud shell provides both bash and powershell session absolutely true cloud shell provides an editor yes you willget an editor with the cloud shell and the last one is cloud shell requires an azure file share which is again true as well so the wrong statement is each user account can be assigned multiple machines no you
can assign one machine per user account all right the next question you are managing azure locally using powershell you have launched the app as an administrator which is the following command would you use first select one which commandyou are gonna use so the right answer is connect dash agent account when you are working locally you are not automatically logged into azure so the first thing you should do is to connect to azure and provide yourcredentials
you have a new azure subscription and need to move resources to that subscription which of the following cannot be moved so you need to find out which resource out of the list provided below cannot be moved is itkey vault you can move a key wall definitely you can move a storage account and a virtual machine one thing which you cannot move is a tenant a tenant cannot be moved between subscriptionsnext question which of the following is not an element in the template schema select one so we learned about template and different parts of the template so we learned about functions which is part of template schema we learnedabout outputs which is part of the template schema and we learned about parameters as well which is part of the schema as well the one thing which is not part of the template is inputs inputs is not a
part of template schemaall right the next question is which of the following best describes the format of an azure resource manager template we talked about it quite a lot so i'm sure all of you are aware of it this is definitelynot an xml document it's not a text document it's not a markdown document as well the format is called a json a json document with key value pairs an azure resource manager template is a json document with akey value pairs okay let's look at the last question you are reviewing your virtual machine usage you notice that you have reached the limit of virtual machine in u.s ease region which of the following provides the easiest solutionyou need to select one if you remember i talked about if you reach the limit on any particular usage limit or a resource limit in your subscription you can always go to your quota and request support to increase
the limit so it's not you won't be able to do this by adding another resource group or changing your subscription plan or resizing your virtual machine this has been done by raising a support ticket with microsoft to increasethe quota so if you need to increase the default limit there is a request increase link you will complete and submit the support request so that microsoft can increase the quota all right so that concludes the module three
Introduces Azure virtual networks, subnets, and how they provide isolated cloud networking. Also explains address spaces, service endpoints, and how to create a virtual network.
in the next video we are entering a brand new module called virtual networking and we are going to go and see a lot of azure networking components in the next few videos the first lesson is all about virtualnetworks in this video we're going to go and see about azure networking components what are azure virtual network and how is subnet related to these azure networking components how do you implement this virtual network and throughout this tutoriali will definitely take you back and forth between the presentation and the azure portal to show you exactly what i mean by these so without wasting any more time let's get into it a major initiative for adopting cloudsolutions such as azure is to enable information technology departments to move server resources to the cloud this can save money and simplify operations by removing the need to maintain expensive data centers with uninterruptible power supplies generators multiple failsafe
cluster database servers and so on for small and medium-sized companies which might not have the expertise to maintain their own robust infrastructure moving to the cloud is particularly appealing once the resources are moved to azure they require thesame networking functionalities as an on-premises department and in specific scenarios require some level of network isolation as well azure networking components offer a range of functionalities and services that can help organizations design and build cloud infrastructure services thatmeet their requirement and azure has many networking components virtual network load balancer application gateway virtual ban and virtual network gateway and traffic manager profile are a few of those so let's understand about the virtual network an azure virtualnetwork or vnit is a representation of your own network in the cloud so let me take you to the portal and show you what is an azure network mean i'm in my azure portal i'm going to click on
virtual network or you can search for virtual network in the global search box example or you can search for virtual network in the global search box as well within virtual network you can see available virtual network within yoursubscription i'm going to click on one particular subnet so virtual network is a logical isolation of the azure cloud dedicated to your subscription you can use vnit to provision and manage virtual private network and optionally link the v-netwith other units in azure as well or you can link it with your on-premises it infrastructure to create a hybrid cross-on-premises solution as well each v-net you create has its own cidr block and can be linked to otherv-nets and on-premises network if the cidr blocks do not overlap you also have control of dns server settings for vnets and segmentation of your v-net into subnets as well so this virtual networks can be used in many ways
you can create a dedicated private cloud only v-net sometimes you don't require a cross-premises configuration for your solution when you create a v-net your services and vms within your v-net can communicate directly and securely with each other inthe cloud you can still configure endpoint connections for vms and services that require internet communication another way of using vnet is to securely extend your data center with vnets you can build traditional side-to-side vpns to securely scale yourdata center capacity so side-to-side vpns are ipsec to provide a secure connection between your corporate vpn gateway and azure and finally you can enable hybrid cloud scenarios so vnets give you the flexibility to support a range of hybridcloud scenarios you can securely connect cloud-based application to any type of on-premises systems such as mainframes and unix servers let's understand about subnets a virtual network can be segmented into one or more subnets these subnets provide logical divisions
within your network and subnet can help improve security increase performance and make it easier to manage the network as well each subnet contains a range of ip address that fall within the virtual network address space each subnet musthave a unique address range specified in the cidr format the address range cannot overlap with other subnet in the virtual network in the same subscription some of the consideration you have to take when you design a subnet isservice requirement virtual appliances service endpoints and network security group so let's look at some of the subnet's considerations in service requirements each service directly deployed into virtual network has specific requirements for routing and the type of traffic thatmust be allowed into and out of subnets a service may require or create their own subnet so there must be enough unallocated space for them to do so some of the consideration you have to consider for the virtual
appliances are azure routes network traffic between all subnets in the virtual network by default you can override azure's default routing to prevent azure routing between subnets or to route traffic between subnets through a network virtual appliance the nextone is service endpoints you can limit access to azure resources such as an azure storage account or azure sql database the specific subnet with a virtual network service endpoint please note that azure reserves the first three ip addressand the last ip address in each subnet address range so how do you implement the virtual network you can create a new virtual network at any time you can also add virtual network when you create a virtual machineeither way you need to define the address space and at least one subnet by default you can create up to 50 virtual network per subscription and per region although you can increase this limit by 500 by contacting the
support team so let me create a azure virtual network for you so let me show you how you can implement an azure virtual network so basically you select the subnet and select the resource group where you want toplace this so i'm going to create a new resource group so the resource group is called az104 and the name is and i'm going to place it in australia east i can specify an address here but i'm goingto go with the default value but if i want to add more details i can add that there is an option to add ipv6 address as well right now i don't want to do it by default uh itcreated a subnet within it if i want i can add more subnet based on the information i provide here and any service and points we discussed about this is where you can add the service endpoint so i'm going
to select microsoft sql for the service endpoint and click on add so let me provide a submit address so i can create a subnet by adding a subnet name and i can select an endpoint which i want toassociate with that subnet next is security this is where you have additional option on turning off additional features like firewall or ddos protection or bastion host so i don't want to do that on this demo so i'm goingto click on review and create this is not going to take much time looks like our subnet has been created i'm going to go to the resource so i can see that sample v-net demo we created is alreadyavailable under virtual network and i can go and see the other details like what's the address space connected devices the default subnet for that virtual network etc please note that default limit on azure networking resources can change periodically
so it's a good idea to consult the documentation for the latest information and always plan to use an address space that is not already in use in your organization even if you plan for a v-net to be cloudonly you may want to make a v-net connection to it later if there is any overlap in address space at that point you will have to reconfigure or recreate the v-net all right so now we have learned about
Covers public and private IP addresses, static versus dynamic assignment, and how IPs are used with Azure resources. Also explains public IP creation and private IP behavior on virtual machines.
the virtual networks and in this video we're going to talk about ip addressing so let's see what we are going to learn in this video we're going to talk about ip addressing in azure how to create an ipaddresses what's the main difference between public and private ip address so without wasting any more time let's get into it you can assign ip addresses to azure resources to communicate with other resources your on-premises network and the internetthere are two types of ip address private ip address and public ip address virtual networks can contain both public and private ip address space so what is private ip address private ip addresses are used for communication within yourazure virtual network and public ip address is used for communication with internet another key concept you need to understand is static and dynamic ip addressing to know more about that i'm gonna take you to my azure portal so
within the azure portal i'm gonna go to the virtual machine i have few virtual machines here i'm gonna select the smart hotel host virtual machine on the left hand side under settings you can find there is networking ifyou look at it my virtual machine is connected to a network interface i can select that network interface and i can go inside the settings of that under settings you can find ipconfigurationsand there you go so you can see that my ip address is 10.0.0.4 and it is dynamically configured so these ib addresses can also be statically assigned or dynamically assigned static ip address do not change and are bestfor certain situations so let me explain few situations where static ip is the best the first one is dns name resolution where a change in the ip address would require updating host records second scenario is ip addresses based
on security models which require apps or services to have a static ip address the third scenario is ssl certificates linked to ip addresses another scenario is firewall rules that allow or deny traffic using ip address range as abest practice you may decide to separate dynamically and statically assigned ip resources into different subnets and ip addresses are never managed from or within the virtual machine so let's understand how to create a public ip address so i'mgoing to take you to the azure portal to show you how to create a public ip address on the global search box search for ip address and select public ip address as you can see that i already havetwo public ip addresses i'm going to create a new public ip address so you need to decide is it ipv4 or v6 or both selecting both will result in two public ip address creating one ipv4 and one ipv6
address the second thing is queue there are two skus available basic and standard you cannot change the sku after the public ip address is created a standalone virtual machine with an availability set or virtual machine skill set canuse basic or standard skus mixing skills between virtual machine with an availability set or scale set or standalone vms is not allowed then there is name the name must be unique within the resource group you select the nextoption is either is the ip address dynamic are static dynamic addresses are assigned only after the public ip address is associated to an azure resource and the resource is started for the first time dynamic address can change ifthey are assigned to a resource such as virtual machine and the virtual machine is stopped and then restarted the address remains the same if a virtual machine is rebooted or stopped but not deallocated dynamic addresses are released when
a public ip address resource is disassociated from a resource it is associated to so what is static static address are assigned when a public ip address is created static address are not released until the public ip address resourceis deleted if the address is not associated to a resource you can change the assignment method after the address is created if the address is associated to a resource you may not be able to change the assignment methodif you select ipv6 for the ip version the assignment method must be dynamic for basic skew the standard sku addresses are static for both b4 and ipv6 then there is ideal timeout in minutes dns name you can preferi always prefer to choose a dns name for the ip address and then the subscription name and where you want to place this ip address to and what location you want to create that once you have all this
information populated you can hit on create a public ip address resource can be associated with virtual machine network interface internet facing load balancers vpn gateways and application gate base you can see the difference here can you assign itto a dynamic or a static as well as you notice for vpn gateway and application gateway static ip address are available only on certain skus a private ip address resource can be associated with virtual machine network interface internalload balancers and application gateways azure can provide an ip address dynamic assignment or you can assign the ip address as static assignment as well a private ip address is allocated from the address range of the virtual network subneton a resource which is deployed which can contain both dynamic and static as well now that we have learned about public ip private ip what's the difference between static and dynamic ranges in this lesson we're going to talk
Explains network security groups, inbound and outbound rules, and effective security rules. Also introduces application security groups and how they simplify rule management.
about network security group let's have a quick look at what are the things we are going to learn on this video we're going to start with what is network security group and what about the rules what are therules you can create what is inbound rule what is outbound rule and what are the nsg's effective rules and how can you create these nsg rules and we will talk in briefly about what is application security group andhow is that different from a network security group and whenever i talk about these topics i will demonstrate whatever i am talking about so that it makes sense to you you can limit network traffic to resources in avirtual network using a network security group or nsg a network security group contains a list of security rules that allow or deny inbound or outbound network security traffic an nsg can be associated with a subnet or a network
interface and you might wonder what is subnet so you can assign nsg to subnets and create protected screen subnets also called dmz these nsgs can restrict traffic flow to all the machines that reside within that subnet each subnetcan have zero or one associated network security groups then you have an ability to attach network security group to the network interface as well so i'm gonna go into a virtual machine i'm going to click on a networkinterface as you can see that there is no network security group assigned to this particular or a network interface you can assign nsgs to a neck so that all the traffic that flows through that nick is controlled bynsg rules each network interface that exists in a subnet can have zero or one associated network security group let's talk about associations when you create a network security group the overview blade provides the information about network security group
such as associated network interface and security rules generally this is used for vm's network virtual appliances rules otherwise it is recommended to link nsg to a subnet level and reuse across your vnets and subnets let's understand nsg rulessecurity rules in network security groups enable you to filter the type of network traffic that can flow in and out of virtual network subnets and network interfaces azure creates several default security rules within each network security group youcan add more rules by specifying name priority port protocol can be any or tcp or udp or source any ip address or service tag and destination can be any ip address and virtual network and this action can beallow or deny you cannot delete the default rules because you can add other rules with higher priority azure creates the default rules in each network security group that you create and you cannot remove the default rules but you
can override them by creating rules with higher priorities then there is inbound security rules and outbound security rules then we need to understand about inbound security rules and outbound security rules there are three default inbound security rules therules deny all inbound traffic except from the virtual network and azure roll balancers and then there is outbound security rules there are three default outbound security rules and the rules only allow outbound traffic to the internet and thevirtual network so let's understand nsg's effective rules nsgs are evaluated independently and an allow rule must exist at both levels otherwise traffic will not be admitted if you have several nsgs and are not sure which security rules areapplied you can use effective security rules let me show you how you can find that i'm going to go back to my virtual machines and select a virtual machine where you have an sg applied or not go to
networking and next to network interface you can see effective security rules and when you try to create a network security rule you need to be aware of the source which is the service or port ranges and priority whenyou try to create a network security rule you need to understand these three concepts service port range and priority the service specifies the destination protocol and the port range for this rule you can choose a predefined service likehttps and ssh when you select a service the port range is automatically completed choose custom to provide your own port range then there is port ranges if you choose a custom service then provide a single port this specifieson which ports traffic will be allowed or denied by this rule provide an asterisk to allow traffic on any port then there is priority rules are processed in priority order the lower the number the higher the priority we
recommend leaving gap between rules 100 200 and 300 etc this is so it is easier to add new rules without editing existing rules enter a value between 100 to 4096 this is unique for all security rules within yournetwork security group so let's understand application security groups application security groups provide for the grouping of servers with similar port filtering requirements and group together servers with similar functions such as web servers and this allows you to reuseyour security policy at scale without minimal maintenance of explicit ip address and this handles the complexity of explicit ip address and multiple rule sets allowing you to focus on your business logic the rules that specify an asg asthe source or destination are only applied to the network interfaces that are members of the asg if the network interface is not a member of an asg the rule is not applied to the network interface even though the
Introduces Azure Firewall as a managed security service and explains its main features. Covers NAT, network, and application rules, plus how firewall rule processing works.
network security group is associated to the subnet now that we have learned about network security group and in this lesson we're going to learn about azure firewall so we will start with azure firewall then we will learn abouthow can you implement azure firewalls and what are the rules you can implement within azure firewalls azure firewall is a managed cloud-based network security service that protects your azure virtual network resources it's a fully stateful firewall as aservice with built-in high availability and unrested cloud scalability you can centrally create enforce and log application and network connectivity policies across subscription and virtual networks azure firewall uses static public ip address for your virtual network resources allowing outsidefirewalls to identify traffic originating from your virtual network the service is fully integrated with azure monitor for logging and analytics some of the features of azure firewalls are built in high availability so high availability is built in so
no additional load balances are required and there is nothing you need to configure it comes with availability zones as well so the firewall can be configured during deployment to span multiple availability zone for increased availability an azure firewallcan scale up as much as you need to accommodate changing network traffic flows so you don't need to budget for the peak traffic what about application fqd and filtering rules you can limit outbound traffic or sql traffic toa specific list of fully qualified domains including wildcards then it comes with threat intelligence as well so threat intelligence based filtering can be enabled for your firewall to alert and delay traffic from to known malicious ip address anddomains the ip addresses and domains are sourced from the microsoft threat intelligence feed and you can associate multiple ip addresses up to 100 with your firewall let's learn about implementing azure firewall so first let's consider a simple example
where we want to use azure firewall to route protect our workload server by controlling the network traffic so the first step is to create the network infrastructure in this case we have one virtual network with three subnets thesecond step is deploy the firewall so the firewall is associated with virtual network in this case it is a separate subnet with public and private ip address the private ip address will be used in a new routing tablethe third step is create a default route create a routing table to direct network workload traffic to the firewall the route will be associated with the workload subnet all traffic from the subnet will be routed to the firewallsprivate ip address and finally configure an application rule in the production deployment a hub and spoke model is recommended where the firewall is in its own v-net and workload servers are in paired v-nets in the same region with
one or more subnets let's understand different types of firewall rules there are three kinds of rules that you can configure in the azure firewall remember by default as your firewall blocks all traffic unless you enable it the firstone is nat rules you can configure azure firewall destination network address translation or dnat to translate and filter inbound traffic to your subnet each role in the nat rule collection is used to translate your firewall public ip andport to private ip and port scenarios where nat rules might be helpful are publishing ssh rdp and non-https application to internet and that rule that routes traffic must be accompanied by matching network rule to allow the traffic thenext rule we need to know about is called network rules any non-https traffic that will be allowed to flow through the firewall must have a network rule for example if resources in one subnet must communicate with the resources
in another subnet then you would configure a network rule from the source to the destination and the third one is application rules application rules define fully qualified domain names that you can be accessed from subnet for example specifythe windows update network traffic through the firewall one more concept you can think about is called rule processing when a packet is been inspected to determine if it is allowed or not the rules are processed in this orderthe first rule is network rule and then application rules the rules are terminating once a positive match is found allowing the traffic through no more rules are checked so now that we have learned about azure firewall and in
Explains custom domains, verification, DNS zones, record sets, and private DNS. Also covers delegation, name servers, and the benefits of Azure DNS for name resolution.
this video we're going to talk about azure dns let's have a high level look into what are the things we are going to learn on this video we're going to talk about domains and custom domains and how canyou verify these custom domain names and what is azure dns zone and how can you delegate these dns zones and what about the record sets within azure dns then we will talk about the private domains and the privatedomains and couple of other scenarios where you could use the private domain scenarios so throughout this topic whenever it is relevant i will take you back to the azure portal to show you what i'm talking about so itmakes sense to you so let's learn about domains and custom domain names by default when you create an azure subscription an azure ad domain is created for you this instance of the domain has initial domain name in the
form of domainname.onmicrosoft.comso let me show you where you can find the initial domain name i'm on my azure portal and i am inside my azure active directory under manage if you scroll down you can find custom domain names as youcan see that there is a domain name with onmicrosoft.com associated with it so the initial domain name while fully functional is intended primarily to be used as a bootstrapping mechanism until a custom name is verified so what isa custom domain name if you notice i have registered my domain with a custom domain as well you can do this by going into add a custom domain and provide your custom domain name although the initial domain nameof the directory can't be changed or deleted you can add any routable custom domain you control this simplifies the user sign-in experience by allowing user to login with credentials they are familiar with for example a contoso gold.onmicrosoft.com could
be assigned to a simpler custom domain called contoso.com or contosogol.com in my case it's silverlabs.ml so let me tell you some practical information about domain names only a global administrator can perform domain management task in azure ad bydefault this is the user who created the subscription and domain names in azure id are globally unique if one azure id directory has verified a domain name then no other azure id directory can verify or use that samedomain name so before a custom domain name can be used by azure ade the custom domain name must be added to your directory and verified this is covered in the next topic when i'm gonna talk about how toverify a custom domain name all right so let's learn about verifying a custom domain name when an administrator add a custom domain name to an azure id it is initially in an unverified state azure ready will not allow
any directory resources to use an unverified domain name this ensures that only one directory can use a domain name and the organization using the domain name owns that domain name so let me show you how to add acustom domain name so i'm on my azure portal i'm going to go back to azure active directory you can perform the same activity on your admin.microsoft.com which is the microsoft 365 admin portal as well so right under settingsyou would be able to find a custom domain names even though mine is verified with a custom domain name i can add multiple domain names to my tenant so i'm gonna go and add a custom domain name i'mgoing to add a custom domain name called azid104domain.com click on add the domain so after adding the custom domain name you must demonstrate ownership of the domain name this is called verification and it is done by adding the
dns which is mx or text that is provided by azure into your company's dns zone once this record is added azure will query the dns domain for the presence of the record this could take several minutes or severalhours if azure verifies the presence of the domain record it will then add the domain into your subscription so now this is the place where you copy these text and mx values and register in the place where youown the domain it could be godaddy it could be any other domain provider that is where you have to verify all right so let's understand azure dns zones azure dns provides a reliable secure dns service to manage andresolve domain names in a virtual network without you needing to add a custom dns solution a dns zone hosts the dns record for a domain so it start hosting your domain in azure dns you need to create a
dns zone for that domain name each dns record for the domain is then created inside the dns zone so let me quickly show you how to create a dns zone i'm on my azure portal i'm going to typein dns zone on this on this global search box and select the dna zones as you can see i don't have any dna zones at the moment i'm gonna create a new dna zone so first step is toselect a resource group i'm gonna select az 104 and an option is to so i have an option to add this zone as a child of an existing zone already hosted in azure dns so i don't have thatat the moment so otherwise i can select that and select the parent zone so in this instance the one which i'm going to create is going to be the parent zone so the dns name i want to have
is az104 dns.com and the resource group is where it is located is australia east so the dns is going to be hosted there so i'm going to click on review create right so now you understand that from theportal you can easily add a d in a zone and then view information including name the number of cards resource group location which is always global and subscription and the name servers as you can see that i havefour name servers available already for this dns all right so some of the consideration for azure dns zones are the name of the zone must be unique within the resource group and the zone must not exist already anotherconsideration is same zone name can be reused in different resource group or different azure subscriptions where multiple zones share the same name each instance is assigned different name server addresses and the last consideration is only one set of
addresses can be configured with the domain name register and please note that you do not have to own a domain name to create a dns zone with the domain name in azure dns however you do need to ownthe domain to configure the domain to delegate your domain to azure dns you first need to know the name server names for your zone each time a dns zone is created azure dns allocates name servers from a poolonce the name servers are assigned azure dns automatically creates authoritative ns records in your zone so the easiest way to locate the name servers assigned to your zone is through this azure portal in this example you can seethat ns1-04 azure dns.com and ns2 and s3 and ns4 are the four dns name servers for you once the dns zone is created you have the name servers and you need to update the parent domain please note that
when delegating a domain to azure dns you must use the name server names provided by the azure dns you should always use all four name servers regardless of the name of your domain then we have the child zoneif you want to set a separate child zone you can delegate a sub domain in azure dns so setting up a subdomain follows the same process as typical delegation the only difference is that ns records must be createdin the parent zone the parent and the child zones can be in the same or different resource group alright so let's talk about the dns record sets it is important to understand the difference between dns record sets andindividual dns records a record set is a collection of records in a zone that have the same name and are of the same type you can access the record set on top of your dna zones when you click
on the record set you can add up to 20 records of any record sets a record set cannot contain two identical records and empty record sets with zero records can be created as well but do not appear onazure dns name server so the add record set page will change depending on the type of record you select for an a word you will need a ttl or time to leave an ip address as you can seethat for a for a c name it changes to ttl and ttl unit for an srv it requests you to put in priority weight and port as well let's understand the dns for private domains by using private dnszones you can use your own custom domain name rather than the azure provided name available today using custom domain name help you tailor your virtual network architecture to best suit your organization's need it provides name resolution for virtual
machines within a virtual network and between the virtual network additionally you can configure zone names with a split horizontal view which allows a private and public dns to share the name alright so now we understand azure dns whatit means for let's look at some of the benefits of azure dns azure dns removes the need for custom dns solutions previously many customers created custom dns solutions to manage dns zones in their virtual network you can nowperform dns zone management by using the native azure infrastructure which removes the burden of creating and managing custom dna solutions and azure dns uses all common dns record types azure dns supports a pod a cname mx ptr soasrv and text records types and azure dns supports automatic hostname record management along with hosting your custom dns records azure automatically maintains hostname records for the vms in the specified virtual networks in this scenario you can optimize the
domain name you use without needing to create a custom dns solution or modifying applications and azure dns provide host name resolution between virtual network as well unlike azure provided host names private dns zones can be shared between virtualnetworks this capability simplifies cross-network and service discovery scenarios such as virtual network pairing and azure dns provides familiar tools and user experience to reduce the learning curve this new offering uses well-established azure dns tools such as powershell azureresource manager template and rest apis to give you that management experience and azure dns use split horizon dns support as well with azure dns you can create zones with same name that resolves different answers from within a virtualnetwork and from a public internet a typical scenario for split horizon dns is to provide a dedicated version of a service for use inside your virtual network and finally azure dns is available in all azure regions the azure
dns private zone feature is available in all azure regions in azure public cloud now that we have learned about azure dns and what are the benefits of azure dns in the next lesson we're going to go through the
Reviews questions on custom domain verification, overlapping address spaces, public IP requirements, DNS records, NSG rules, DNS delegation, and firewall application rules. Reinforces the networking module concepts.
review question on the previous module the module we were going through was called virtual networking that's the fourth module of examination is it 104 all right so let's look at the first question your company has an existing azuretenant named a domain name dot on microsoft.com the company wants to start using another domain name which is a custom domain name for their azure resources you add a custom domain name to azure now you need to adda dns record to prepare for verifying the custom domain which two of the record type would you create and you need to select two answers so if you remember when we talked about the dns and the custom domainand we went through two record types which we need to add to verify a custom domain name i'm not sure whether you remember it the two records we talked about are the text record and the mx record so
the correct answer is text and mx record so by default azure will prompt you to create a custom text record in the dns zone to verify a custom domain optionally you can use an mx record instead the resultis the same other record types are not supported let's look at the question number two you're planning to configure networking in microsoft azure your company has new microsoft azure presence with the following network characteristics one virtual network andone subnet using an ip and thus not having any existing resources and your on-premises data center have the following network characteristics and we have 10 subnets using the same network range so the company intended to use 192.168.1.0
on premises and 192.168.0.0
24 in azure and you need to update the company environment to enable the needed functionality what should you do and we have to pick two answers to complete the solution so the first step we have to do iswe have to delete 192.168.0.0.23
from azure because it overlaps with 192.168.1.0
which is intended to use for the on premises so that is the first step we have to do and the second is we need to create a new subnet in azure so definitely not deleting the second one thethird option is create a mismatch public subnet in azure and on-premises that is not the right answer is it creating a subnet for 192.168.0.23
in the on-premises environment definitely not we have to create a subnet in azure because we deleted a subnet from azure so the correct answer is create a subnet for 192.168.0.0.24 in azure and this is to enable the usagein azure let's look at question number three you are planning your azure network implementation to support your company's migration to azure your first task is to prepare for the deployment of the first set of vms and the firstset of vms that you are deploying have the following requirements so what are these requirements customers on the internet must be able to communicate directly with the web application on the vms and the ip configuration must be thezone redundant all right so we know what are the requirements from the customer let's read the further question you need to configure the environment to prepare for the first vm additionally you need to minimize the cost whenever possible
while still meeting the requirements so what should you do you need to select one answer so let's go and read the statement and figure out what should we do to meet this requirement is it creating a basic ipaddress after the first vm created and remove the private ip address and assign the public ip address to the nic it is not going to resolve the problem the basic ip address is not what we are looking atagain second option is create a basic public ip address during the creation of first vm again the basic ip address is not gonna cut out another option is create a standard public ip address yeah we yep we needa standard public ip address after the first vm is created and remove the private ip address and assign the public ip address no we don't have to remove the public ip address so we don't have to remove the
private ip address all right so the next option is create a standard public ip address during the creation of the first vm associate the public ip address for the vm next absolutely correct so to meet the requirement ofcommunicating directly with the consumers on the internet you must use a public ip address and to meet the requirement of having a zone redundant configuration you must use a standard public ip address and of the answer choice onlythe answer that creates the standard public ip address first then associate it during the vm creation and functions meet the requirement all right so let's look at the next question you deploy a new domain name contoso.com to thedomain controllers in azure and you have the following domain join machine i have vm1 vm2 vm3 and vm4 each vms have an ip address as well 10 11 12 and 101 so i have vm1 vm2 bm3 and bm9
and the ip address of vms are 10 11 12 and 101 you need to add dns records so that host names will solve their respective ip addresses additionally you need to add a dns record so that internet.contesso.com resolvesto vm99 so what should you do and if you need to pick two answers to complete the whole solution so we learned about these different types of records and how we can add these records in the dns inthe previous module so the correct answer is adding a a record and a cname record so let me explain you why this is the correct answer in this scenario the host name have ipv4 ip addresses thus to resolvethese host name you must add a a name record for each vms to enable internet.contoso.com to resolve in bm99.contoso.com
you need to add a cname record a cname record is often referred to as an alias your company is preparing to move some services and vms to microsoft azure the company has opted to use azure dns to providename resolution a project begins to configure the name resolution and the project identifies following requirements let's understand the requirements first the first requirement is a new domain will be used and then a domain will be and the secondrequirement is a domain will have dns record for internal and external resources and the third requirement is minimize ongoing administrative overhead right so you need to prepare and configure the environment with a new domain name and a testhost of www dot which is the following steps should you perform and we need to choose three answers to complete the solution so let's go through the options register a domain name with the domain register absolutely so if
you need to get the domain right and you need to have a www dot you need to register the domain name first which is correct register a domain name with microsoft azure definitely not that is not possible atall you need to register a domain name with a domain register next option is delegate the new domain name to azure dns absolutely correct you need to delegate the domain name to azure dns you need to add addressa record to azure name server so you don't need to add an a record in this instance and add a dns glue records to point to azure name servers again you don't have to do that and add arecord for www dot absolutely correct so you need to add a www dot record to complete the solution so for private domain names you must register with a registrar because azure isn't a register thereafter you need to delegate
the new domain name to azure dns which enables the azure dns to be the authority for the domain after delegation you should add a test host of www and test name resolution all right let's look at the questionnumber six you have a vm with two nicks named nick one and nick two nick one is connected to this ip address subnet and nick2 is connected to another ip subnet the only difference is 8.0 and 20.8 youplan to upgrade the vm configuration to provide the following functionality so what are the vm configurations the first configuration is enable direct communication from internet to tcp port 443 second configuration changes maintain existing communication across10.10.8.0.24 and 10.20.8.0 24 subnets and maintain a simple configuration whenever possible you need to update the vm configuration to support the new functionality so what should you do so you have lot of changes here so what are you
going to do to make sure that you update the vm's configuration to support all these new functionality so let's read out the statements remove the private ip address from nic 2 and then assign public ip address to itand then create an inbound security rule definitely not the right answer because it's add more complexity to the existing solution second statement add a third nic and associate public ip address to it and then create an inbound securityrule again absolutely wrong um it is not even gonna resolve the problem third option is associate a public ip address to nick and create an inbound security rule absolutely correct to enable direct communication from internet to the vmyou must have a public ip address you also need an inbound security rule and you can associate the public ip address with nick one and nick two although in this scenario only presents an option to associate it with
nick2 so this is the correct answer let's look at question number seven you are currently using network security group or nsgs to control how your network traffic flows in and out of your virtual network subnet and network interfacesyou want to customize how your nsgs work alright so you need to customize your nsg's for all incoming traffic you need to apply your security rules to both the virtual machine and at the subnet level which of thefollowing options will let you accomplish this so we need to choose two answers to complete the solution let's read the options configure the allow b-net inbound security rule for all nsgs that is not going to help it uhcreate rules for both nics and subnet with the allow action absolutely correct you should add rules with higher priority than the default rule if need all right that's the correct answer delete the default rule um you won't be
able to delete the default rule that is not possible the last option is add rules with higher priorities than the default one absolutely correct so because you cannot delete the default rules you can override it by adding thehigher priority so the correct answer is two and four so you should add rules with a higher priority than the default rules if needed as you cannot delete the default tools also in order to meet the requirement toapply security rules to both vms and subnet level you should create rules with an allow action for both and there is no need to configure the allow we need inbound rule as it as a default rule for anynew security group you create
all right let's look at the question number eight you need to ensure that azure dns can resolve names for your registered domain what should you implement we just need to select one answer and the correct answer is zonedelegation once you create the dns zone in azure dns you need to set up ns record in the parent zone to ensure that azure dns is the authoritative source for your name resolution for your zone for domains purchasedfrom a register your register will offer the option to set up those ns records when delegating a domain to azure dns you must use the name server names provided by the azure dns domain delegation does not require thename server name to use the same top level domain as your domain all right let's look at the last question you are configuring the azure firewall you need to allow windows update network traffic through the firewall which of
the following should you use you need to select just one answer it's not network rule you won't be able to achieve it through nat rules or nat rules and destination inbound rule is not correct so the correct answeris application rules application rules define fully qualified domain names rfqdns that can be accessed from a subnet that would be appropriate to allow a windows update network traffic all right so that concludes the review questions for module four
Introduces regional and global VNet peering and explains the benefits of private connectivity and low latency. Also covers gateway transit, remote gateways, and service chaining.
i hope the information provided was useful we are entering a brand new module the fifth module is called intersight connectivity and the first lesson we are going to learn on this fifth module it's all about v-net pairing let'shave a look at what are the topics we are going to learn on this video we will start with v-net pairing we will understand the concepts and the benefits of v-net pairing we will learn about gateway transit andconnectivity and how to configure the v-net peering and the service chaining and throughout the video whenever i explain about a concept i will take you back and forth the presentation and the azure portal so you exactly know whatit means and you understand it thoroughly perhaps the simplest and quickest way to connect your v-nets is to use v-net pairing virtual network pairing enables you to seamlessly connect to azure virtual networks once paired the virtual networks appear
as one for connectivity purposes and there are two types of v-net pairing we need to understand the first one is called regional v-net pairing and the second one is called global v-net pairing so let me ex so letme explain you the concept behind regional and global regional v-net peering connects azure virtual network in the same region and the global v-net pairing connect the azure virtual network in different regions when creating a global peering the peeredvirtual network can exist in any azure public cloud region or china cloud regions but not in government cloud regions you can only peer virtual network in the same region in the azure government cloud regions that's the one thingwe need to keep in mind so there are lots of benefits for using the v-net pairing so let's understand one by one so one of the key benefits of v-net pairing is private network traffic between peer virtual network
is private traffic between the virtual network is kept on microsoft backbone network no public internet gateways or encryption is required in the communication between these virtual networks another benefit is performance a low latency high bandwidth connection between resourcesin different virtual networks one another benefit is communication the ability for resources in one virtual network to communicate with the resources in a different virtual network once the virtual networks are appeared and veen appearing is seamless the abilityto transfer data across azure subscriptions deployment models and across azure regions and finally with v-net peering you don't have to worry about any sort of disruptions no downtime to resources in either virtual network when creating the peering orafter the peering is created let's understand the gateway transit and connectivity when virtual networks are appeared you can configure a vpn gateway in the peer version network as a transit point in this case a peer virtual network can
use the remote gateway to gain access to other resources a virtual network can have only one gateway and the gateway transit is supported for both v-net pairing and global v-net pairing so when you allow gateway transit in virtualnetwork so when you allow the transit in virtual network it can communicate to resources outside the pairing so in this scenario the gateway transit allows peer networks to share the gateway and get access to these resources this meansthat you do not need to deploy a vpn gateway in the pier virtual network so please note that the default being appearing configuration provide full connectivity so the network security groups can be applied in either virtual network toblock access to other virtual networks or subnets when configuring virtual network pairing you can either open or close the network security group rules between the virtual networks all right so let's learn about how to configure the vnet pairing
so i'm going to take you through the azure portal to show you where to configure the v-net pairing so i'm on my azure portal i'm going to go to virtual networks as you can see that i have manyvirtual networks available so i'm going to pick a virtual network here and under settings you can find bearings so click on pairings as you can see that the appearing status is connected and i appeared with dms vnet andthe gateway transit is disabled if i want to add a new pairing i can click on add and provide the name of the peering and select the right subscription the virtual network which i would like to pair withand other configuration which i need to choose some of the settings which i need to be aware of is let's assume if i need to pair with one other network i'm gonna select i select the subscription i select
the v-net which i like to appear and the name of the pairing and let's look at the options available the first option is allow forward traffic and we have other configurations we need to be aware of allow forwardtraffic allows traffic not originating from within the pr virtual network into your virtual network and allow gateway transit allows the peer virtual network to use your virtual network gateway the pl cannot already have the gateway configured if youselect the allow gateway transit on one virtual network then you should select the use remote gateway on the other virtual network as well so let's understand service chaining so the we need appearing is non-transitive this means that ifyou establish v-net pairing between v-net 1 and v-net 2 and between v-net 2 and v-net 3 v-net pairing capabilities does not apply between vnet1 and vnet3 however you can leverage user-defined routes and service chaining to implement custom routing
that will provide transitivity and this allows you to provide implement a multi-level hub and spoke architecture and overcome the limit of the number of unit pairings per virtual network so what about the harban spoke architecture you can deploythe hub and spoke network where the hub network can host the infrastructure such as the network virtual appliance or vpn gateway and the spoke version network can then pair with harp virtual network and traffic can flow through thevirtual network appliance or vpn gateways in the hub virtual network another thing we need to understand is user defined routes and service chaining virtual network pairing enables the next hop in the user-defined route to be the ip addressof the virtual machine in the pier virtual network or the vpn gateway and the service chaining enables you to direct the traffic from one virtual network to the virtual appliance or the virtual network gateway in a peered virtual
network through user-defined routes you can check the status of the v-net pairing by looking at updating or connected when you create the peering to the second virtual network from the first virtual network the pairing status is called initiatedand when you create the peering from the second virtual network to the first virtual network the status is changed from initiated to connected all right so now we understand what is v-net pairing in the next lesson we're going
Explains VPN gateways, site-to-site, point-to-site, and network-to-network connections. Covers gateway subnet requirements, VPN types, local network gateways, and active-active versus active-standby behavior.
to learn about vpn gateway connections a vpn gateway is a specific type of virtual network gateway that is used to spend encrypted traffic between an azure virtual network and an on-premises location over the public internet you can alsouse vpn gateway to send encrypted traffic between azure virtual network and microsoft network each virtual network can have only one vpn gateway however you can create multiple connections to the same gateway when you create multiple connection to thesame vpn gateway all vpn tunnels share the available gateway bandwidth there are three main types of vpn gateways you need to be aware of the first one is called side-to-side vpn gateways the side-to-side connections connect on-premises data centersto the azure virtual network the next one is called network to network the network to network connections connect azure virtual networks which is a custom way of connecting and the third vpn gateway type is called point to site
point-to-side connections connect individual devices to azure virtual networks a virtual network gateway is composed of two or more vms that are deployed to a specific subnet you create called a gateway subnet virtual network gateway vms contain routing tablesand run specific gateway services these vms are created when you create the virtual network gateway you can't directly configure the vms that are part of the virtual network gateway and the vpn gateways can be deployed in azure availabilityzones as well this brings resiliency scalability and higher availability to the virtual network database deploying gateways in azure availability zones physically and logically separates gateways within a region while protecting your on-premises network connecting to azure from zone levelfailures please note that creating a virtual network gateway can take up to 45 minutes to complete so let's learn about how to implement a side-to-side vpn connection here are the steps to creating a v-net to v-net connections the
on-premises part is necessary only if you are configuring side to side and throughout this video i am going to take you through each steps one by one so let's talk about the first step which is create vnet andsubnet so by now you should be familiar with creating virtual network and subnets we have learned about that in the past videos remember for this we need to connect to an on-premises location you need to coordinate with youron-premises network administrator to reserve an ip address range that you can use specifically for this virtual network the second step is optional step which is specifying the dns server so the dns is not required to create a side-to-sideconnection however if you want to have name resolution for resources that are deployed to your virtual network you should specify a dns server in the virtual network configuration take time to carefully plan your network configuration if you duplicate
ip address range exist on both sides of the vpn connection traffic will not drop the way you may expect it to be so the third step is creating the gateway subnet so let's go and learn how to createthe gateway subnet so before creating a virtual network gateway for your virtual network you first need to create the gateway subnet so let me quickly go to the azure portal to show you where to create this gateway subneti'm on my azure portal now let me go to the virtual network i'm going to select a sample virtual network now if you go to under settings you can see there is subnets click on subnets and right underneaththe subnet you can either create a new subnet or create a new gateway subnet so click on gateway subnet so the gateway subnet contains the ip address that are used by the virtual network gateway if possible it's best
to create a gateway subnet by using cidr block of 28 or slash 27 to provide enough ip address to accommodate future additional configuration requirements when you create your gateway subnet gateway vms are deployed in the gateway subnet andconfigured with the required vpn gateway settings you must never deploy other resources for example additional vms into your gateway subnet and the gateway subnet must be named as gate based subnet only and i don't think you can changethe name anyways another thing you need to remember that when working with gateway subnet avoid associating a network security group to the gateway subnet associating a network security group to this subnet may cause your vpn gateway to stopfunctioning as expected and please note that this is the same step in configuring vpn pairing all right so after we create the subnet the next step is to create the vpn gateway the vpn gateway settings that you need
to choose are critical to creating a successful connection so let me show you how you can create a vpn gateway configuration i'm on my azure portal search for virtual network gateways as you can see that i don't haveany virtual network gateway configured so create a new virtual network gateway so first you select the subscription and the virtual network to get the resource group and provide a name for your virtual network and pick a region whereyou want to host this the next important step is gateway type so this gateway type defines whether you would like to create a vpn gateway or express root gateway so based on your selection the below options changes thenext one is vpn type you have two types there root based and policy based the type of vpn you can choose depends on the make and model of the vpn device and the kind of vpn connection you intended
to create choose a route-based gateway if you intend to use point-to-site into virtual network or multiple side-to-side connections if you are creating a vpn type gateway to coexist with your express route gateway or if you need to useike version 2 policy based gateway support only ik v1 most vpn types are route based after selecting that you need to select the skew use the drop down to select the a gateway skew route based vpn types areoffered in 3 skus basic standard and high performance a high performance cube must be selected if you are using an active active mode your choice will affect the number of tunnels you can have and aggregate throughput benchmark thebenchmark is based on measurements of multiple tunnels aggravated through a single gateway it is not guaranteed throughput due to an internet traffic condition and your application behaviors when you select the public ip address you can use an existing
one as well and then there are two types of generations you need to be aware of generation one and generation two changing generation or changing skus across generation is not allowed so please note that after the gateway iscreated view the ip address that has assigned to it by looking at the virtual network in the portal so the gateway should appear as connected device before we proceed to the next step you need to be aware ofvpn gateway types when you create the virtual network gateway for your vpn gateway configuration you must specify a vpn type the vpn type that you choose depends on the connection topology that you want to create for example apoint to site requires a route-based vpn and a vpn type also depends on hardware that you are using a side to side configuration requires a vpn device some vpn device only supports certain vpn types so let me give
you a bit more details around a route based vpn and a policy based vpn the route-based vpns use routes in ip forwarding and routing table to direct packets into their corresponding tunnel interfaces the tunnel interfaces then encrypt ordecrypt the packets in and out of the tunnels the policy or the traffic selector for the route-based vpns are configured as any to any or wild cards the policy-based vpn encrypt and direct packets through ipsec panels based onipsec policies configured with the combination of address prefixes between your on-premises network and azure vnet so the policy or the traffic selector is usually defined as an access list in the vpn device configuration when using a policy basedvpn keep in mind the following limitations you have you can have only one tunnel when using poly you can have only one tunnel when using a policy based vpn all policy based vpns can only be used on a
basic gateways queue and is not compatible with other gateway skus and please note that once a virtual network gateway has been created you can't change the vpn type when you create a virtual network gateway you need to specifythe gateways queue that you want to use select this queue which satisfies your requirement based on the type of workloads throughputs features and sls aggregate throughput benchmark is based on measurements of multiple tunnels aggregated through a single gatewaythe aggregate throughput benchmark of the vpn gateway is side to side plus point-to-side combined and the aggregate throughput benchmark is not guaranteed throughput due to internet traffic conditions and your application behaviors please note that the basic skew isconsidered as a legacy skew so let's learn about the local network gateway let me take you to the portal first so type in local network gateway in the global search box as you can see i don't have any
local network gateway as of now i'm going to click on create new so the local network gateway typically refers to the on-premises location you give the site a name by which azure can refer to it then specify theip address of the on-premises vpn device for the connection you also specify the ip address prefixes that will be routed through the vpn gateway to the vpn device the address prefixes you specify are the prefixes located in youron-premises network after you give the name you need to provide the ip address this is where you put the public ip address of your local gateway and then the address space one or more ip address range in acidr notation that defines your local network address space and the very next step is configuring your on-premises vpn device microsoft has validated a list of standard vpn devices that should work well with your vpn gateway this list was
created in partnership with device manufacturers like cisco juniper ubiquity barracuda network etc if you don't observe your devices listed in the validated vpn device table your device may still work with the cytoside connection please contact your device manufacturerfor additional support and configuration instruction to help you with your connection to configure your vpn gateway you need the following the first thing is a shared key and the next one is the public ip address of your vpngateway please note that depending on the vpn device that you have you may be able to download a vpn device configuration script from this website and the last step is creating the vpn connection so once your vpn gatewayis created you can create the connection between them if your vnets are in the same subscription you can use the portal you basically have to enter the name connection type as side to side vpn or you can use
the drop down to select anything else in this field enter a shared key for your connection you can generate a you can generate or create this key yourself in side-to-side connection the key you use is the same foryour on-premises devices and your virtual network gateway connection the concept is similar here except that rather than connecting to a vpn device you are connecting to other virtual network gateways so after you configure all the side to sidecomponents it is time to verify that everything is working you can verify the connection either in the portal or by using azure powershell last but not the least let's look at some of the high availability scenarios we havetwo scenarios active standby which is a default and then there is active active so let me explain you what is active standby every azure vpn gateway consists of two instances in active standby configuration for any planned maintenance or
unplanned disruption that happens to the active instance the standby instance would take over automatically and resumes the side to side vpn or v-net-tv-net connections the switchover will cause a brief interruption for planned maintenance the connectivity should be restoredwithin 10 to 15 seconds for unplanned issues the connection recovery will be longer about one minute or one and a half minutes in the worst case the point-to-side connections will be disconnected and users will need to reconnect forthe client machines so what about active active you can now create azure vpn gateway in an active active configuration where both instances of the gateway vms will establish side to vpn channel to your on-premises vpn device in thisconfiguration each azure gateway instance will have a unique public ip address and each will establish an ipsec or side-to-side vpn tunnel to your on-premises vpn device specified in your local gateway and connection because the azure gateway instances are
an active active configuration the traffic from your azure virtual network to your on-premises network will be routed through both tunnels simultaneously even if your on-premises vpn device may favor one tunnel over the other so that concludes our lesson
Describes ExpressRoute as a private dedicated connection to Microsoft cloud services and reviews its benefits and billing models. Then introduces Virtual WAN and its hub-and-spoke connectivity model.
on vpn gateways we have learned quite a lot about vpns and in this lesson we're going to learn about express route and virtual van let's have a look at the high level things what we're going to learn onthis video we will learn about what is express route and what are its capabilities and what do you mean by co-existing side-to-side and express route mean for you or your customer and some of the inter-site connection comparisons andwe will finally finish off with the virtual bands azure express route lets you extend your on-premises network into the microsoft cloud over a dedicated private connection facilitated by connectivity provider with express route you can establish connection to microsoftcloud services such as microsoft azure office 365 and crm online you can use azure express route to create private connections between azure data center and infrastructure on your on-premises express route connection doesn't go over the public internet and
they offer more reliability faster speed and lower latencies than any typical internet connections you can use express route to both connect and add compute and storage capacity to your existing data centers with high throughput and fast latencies azurewill feel like a natural extension to or between your data centers so you can enjoy the scale and economics of public cloud without having to compromise on network performance with predictable reliable and high throughput connection offered by expressroute you can build applications that span on-premises infrastructure and azure without compromising privacy and performance so let's have a look at some of the express routes capabilities express route is supported across all azure regions and locations this followingmap provides a list of azure regions and express route locations express route locations refer to those where microsoft peers with several service providers you will have access to azure services across all regions within a geographical region if you
connected to at least one express road location within the geographical region so what are the benefits the first one i would like to talk about is layer 3 connectivity microsoft uses bgp an industry standard dynamic routing protocol toexchange routes between your on-premises network your instances in azure and microsoft public address and microsoft establish multiple bgp sessions with your network for different traffic profiles another benefit is connectivity to microsoft cloud services and geographical locations express routeconnections enable access to lots of microsoft services including azure office 365 services dynamics 365 office 365 was created to be accessed securely and reliably via the internet so express route requires microsoft authorization another benefit is global connectivity withexpress road premium add-on so you can enable the express.premium add-on feature to extend connectivity across geopolitical borders so you can extend the express route premium add-on feature to extend connectivity across geopolitical boundaries let's look at some of the
bandwidth options you can purchase express route circuits for a wide range of bandwidths be sure to check with your connectivity provider to determine the bandwidths they support and then there is flexible building models as well so you canpick a billing model that works best for you you can have an unlimited data meter data or express route premium add-on as well in an un in the unlimited data model billing is based on a monthly fee allinbound and outbound data transfers is included free of charge in the meteor billing data billing is based on a monthly fee all inbound data transfer is free of charge and outbound data transfer is charged per gb of data'stransfer and the premium add-on feature this add-on includes increased routing table limits increased number of units and global connectivity and connections to office 365 dynamics 365 etc so let's learn about co-existing side-to-side and express route what does it
mean for you express road is a direct and private connection from your van to microsoft services including azure cytoside vpn traffic travels encrypted over public internet being able to configure side to side vpn and express road connection forthe same virtual network have several advantages you can configure side to side vpn as a secure failover path for express road or use side to side vpn to connect to sites that are not part of your network butthat are connected through express route notice that this configuration requires two virtual network gateways for the same virtual network so one using the type as vpn and the other one is using as express route gateway and you cancreate a connection between your on-premises network and microsoft cloud in three different ways collocated at cloud exchange point-to-site internet connection and any to any connection there are many inter-site connection choices this table summarizes how to make a selection
Reviews questions on VNet peering, site-to-site VPN prerequisites, gateway transit, ExpressRoute, gateway sizing, and Virtual WAN capabilities. Reinforces the connectivity module.
let's talk about virtual vans azure van is a networking service that provide optimized and automated branch connectivity to and through azure region serve as hub that you can choose to connect your branches to you can leverage the azurebackbone to also connect branches and enjoy branch to v-net connectivity there is a list of partners that support connectivity automation with azure virtual band vpn so what are the advantages of virtual van the first one is integrated connectivitysolution in hub and spoke so automate side-to-side configuration and connectivity between on-premises and an azure hub the second one is automated spoke setup and configuration and it's super easy and intuitive for troubleshooting as well and there are twotypes of virtual vans the basic and standard and the basic one that is side to side vpn only and the standard one offer express route point to side side to side interhub and we need to be a transitioning
through virtual hub so that concludes the module five so we completed the module called interside connectivity in this video we're gonna go through review questions you want to connect different v-nets in the same region as well as differentregions and decide to use weeded peering to accomplish this which of the following is the true benefit of peanut pairing and we need to select two to complete the whole solution so i'm basically going to read out thestatement to find if that statement is true or not the first statement is the virtual network can exist in any azure cloud region that is not true the virtual network cannot exist in any cloud region the second statementis the network traffic between peer virtual network is private absolutely true peering is easy to configure and manage and requiring little to no downtime absolutely correct as well it's super easy to configure the veined pairing and the last
statement is gateway transit can be configured regionally or globally that is wrong so peering is efficient as there is no downtime to resources in either virtual network when creating the pairing or after pairing is created and also forsecurity network traffic between peer virtual network is private the traffic between virtual network is kept on the microsoft backbone network while virtual network can exist in any azure public cloud region they cannot exist in azure national cloud thenational clouds have very specific customer requirement to their use and operation these services are confined within the geographic border of specific countries and operated by local personnel so the gateway transit only applies to regional being appearing and notto the global we need pairinglet's look at the question number two your company is preparing to implement a side-to-side vpn to microsoft azure you are selected to plan and implement the vpn currently you have an azure subscription an azure virtual network and an
azure gateway subnet you need to prepare the on-premises environment and microsoft azure to meet the prerequisites of the side to side vpn later you will create the vpn connection and test it what should you do and we haveto select three answer to complete the solution all right so let's read out the options so what we are trying to achieve over here is you are trying to you're trying to prepare the on-premises environment and microsoft azureto meet the prerequisites of side-to-side vpn so keep that in your mind when you are reading these solutions the first statement is obtain a vpn device for the on-premises environment absolutely we need an on-premises device to set upthe side-to-side vpn correct obtain a vpn device for azure environment which is completely wrong you don't need a device in azure environment you only need a gateway third statement is create a virtual network gateway and local network gateway
in azure absolutely correct so you need to create a gateway and a local network gateway in azure to set an establishing connection between on-prem environment and azure the next statement is create a virtual network gateway expressed out inazure so we are trying to create a side to side vpn not an express route so that is wrong next statement is obtain a public ipv4 ip address without nat for using vpn device absolutely correct so you needa ipv4 address without an ad address for your vpn device so we got our three statements right so last statement is obtain ipv4 address behind the net so that is completely wrong so we don't need nat for thevpn devices so the prerequisites for the side-to-side vpn are having a compatible vpn device on premises having a public ipv4 without an ad on on-premises device and creating a vpn gateway and local gateway in azure please note that
the ipv6 is not supported for vpns and express route is a different saved app and not part of the side to side vpn okay let's look at the question number three your company is preparing to implement persistent connectivityto microsoft azure and your company has a single site headquarters which has an on-premises data center the company establishes the following requirements for the connectivity the connectivity must be persistent and the connectivity must provide for the entire on-premisessite you need to implement a connectivity solution to meet the requirement so what should you do we just need to pick one answer to complete the solution is it implementing a point-to-side vpn definitely not that is not gonnaresolve the issue that is for one-to-one connection is it to implement we need to be net vpn again that is to connect two networks together is it to implement vgwu or vpc definitely not so the correct answer is
implement a side-to-side vpn in this scenario only one of the answer provide the persistent connectivity to azure which is side to side vpn a we need to be net connects two azure virtual network together a point to sitevpn is used for individual connection a vpc and bgw are relevant for amazon aws all right so let's look at question number four you are configuring wiener peering across two virtual networks minute one and we need two andyou're configuring the vpn gateways you want we need two to able to use the win at once gateway to get the resources outside the pairing so what should you do you just need to select one so i'm goingto read out the statements from below to see if that makes any sense do not select allow gateway transit to use remote gateways on either vnet1 or winrar2 not the right answer and we have select allow gateway transit
on all three answers we just need to select allow gateway transit on vn1 and use remote gateways on vnet2 so that is the correct answer select allow gateway transit on bnet1 and use gateways on binary2 vnet1 will allowbna2 to transit external resources and we need to will expect to use a remote gateway let's look at question number five you are configuring a side-to-side vpn connection between your on-premises network and azure network the on-premises network usesa cisco asa vpn device and you have checked to ensure the device is on a validated list of vpn devices before you proceed to configure the device what two pieces of information should you ensure to have you needto select two is it the shared access signature key for the recovery services world definitely not that is for dr and backup is it the shared key you provided when you created the cytoside vpn connection absolutely correct so
you need to have the shared key you provided when you created the side side-to-side vpn connection so what is the next answer is it the gateway routing method provided when you created the side-to-side connection definitely not is itthe static ip address of your virtual network gateway we don't need the static ip address but we need the public ip address so the next statement is the public ip address of your version network gateway that is correctso those two are our correct answers so you will need two things the shared key and the public ip address of your virtual network gateway the shared key was provided when you created the side-to-side vpn connection let's lookat question number six you manage a large data center that is running out of space you propose extending the data center to azure using multi-protocol label switching virtual private network which connectivity option should you select so we are
trying to extend the data center using a multi-protocol label switching so the correct answer for that is express route express route is the best choice for extending the data center as it can use an any to any ipvpnconnectivity model an mpls vpn typically provided by an ipvpn networks enables connectivity between microsoft cloud and your branch offices and data centers let's look at question number seven you are creating a connection between two virtual networks performance isa key concern which of the following will most influence performance you need to select one if performance is the key concern do you think selecting a route-based vpn is gonna resolve the problem definitely not do you think selectinga policy based vpn is gonna solve the problem definitely not and it is definitely not gonna resolve if you specify a dns server so the correct answer is ensuring you select an appropriate gateway skew so the gateway skew
selection directly affects performance the gateway skew control the number of tunnels and connections that are available this affects the overall aggregate throughput of the connection let's look at the last question your manager asked you to verify some informationabout azure virtual bands which of the following statements are true and you need to select three choices all right so i'm going to read out each statement to see if that is true or false you must use oneof the approved connectivity partner providers that is false you must use vpn device that provide ike version 2 and version 1 ipsec support which is true virtual van support express route again that is true and virtual van supportside to side connection as well again that is true virtual van does not support point-to-side connection that is false virtual run support point-to-side connection as well you can switch between the basic and standard plans no you can't switch
between basic and standard plans so the virtual band support express load and any vpn device that is ipe version 2 and version 1 ipsec compliant so that concludes the module 5 for us so we just finished module 5
Explains system routes, user-defined routes, and how traffic can be directed through virtual appliances. Also covers service endpoints and Azure Private Link for secure private access to services.
the entire lessons and the review questions and we are going to enter a brand new module which is module 6 which is all about network traffic management and the first lesson we are going to learn is all aboutnetwork routing and endpoints azure uses system routes to direct network traffic between virtual machines on-premises network and the internet the following situations are managed by these system routes traffic between vms in the same subnet between vms in differentsubnets and same virtual network and data flow from vms to the internet for example consider this virtual network with two subnets the communication between the subnet and from the front end to the internet are all managed by azureusing the default system routes please note that the information about the system route is recorded in the route table a route table contains a set of rules called routes that specifies how packets should be routed in virtual network
and the route tables are associated two subnets and each packet leaving a subnet is handled based on the associated route table and the packets are matched without using the destination and the destination can be an ip address avirtual network gateway a virtual appliance or the internet if a matching route can't be found then the packet is dropped so what is user-defined route as explained in the previous topic azure automatically handles all network traffic routing butwhat if you don't want to do something different for example you may have a virtual machine that performs a network function such as routing firewalling or van optimization you may want certain subnet traffic to be directed to thevirtual appliance for example you might place an appliance between subnets or subnet and the internet in these situations you can configure a user defined routes or udr udr's control network traffic by defining route that specified the next hop
of the traffic flow this hop can be a virtual network gateway virtual network internet or virtual appliance please note that each route table can be associated to multiple subnet but a subnet can only be associated to a singleroute table there are no additional charges for creating route tables in microsoft azure so let's review a specific network routing example in this example you have a virtual network that includes three subnets the subnets are private dmz andpublic in dmc subnet there is a network virtual appliance and network virtual appliance are vms that help with network functions like routing and firewall optimization you want to ensure all traffic from public subnet goes through the network virtualappliance with the private subnet so what are the steps you need to take the first step is you need to create the route table then you will add a custom route that requires all private subnet traffic to be
directed to the network appliance and finally you associate the new route to the public subnet please note that by default using system route traffic would go directly to the private subnet however with a user defined route you canforce the traffic through the virtual appliance creating a route table is very straight forward you must provide the name subscription the resource group location and whether you want to use a virtual network gateway route propagation a standard routingprotocol is used to exchange routing and reachability information between two or more networks routes are automatically added to the route table for all subnets with virtual network gateway propagation enabled in most scenarios this is what if you wantfor example if you are using express route you would want all subnet to have that routing information so how do you create a custom route so in this example a new route is named to private subnet and the
private subnet is at 10.0.1.0 and the route uses virtual appliance notice the other choice for the next hope type which is network which is version network gateway virtual network internet and none and the virtual appliance is located at10.0.2.4 in summary this route applies to any address prefixes in 10.0.1.0.24
and traffic headed to this address will be sent to the virtual appliance with a 10.0.2.4 address and the last step in our example is to associate the public subnet with the new routing table each subnet can have zeroor one route table associated with it in this example remember that virtual appliance should not have a public ip address and ip forwarding should be enabled on the device all right so let's understand what is service endpoints avirtual network service endpoint provide the identity of your virtual network to the azure service once service endpoints are enabled in your virtual network you can secure azure service resources to your virtual network by adding a virtual network ruleto the resources today azure service traffic from a virtual network uses public ip addresses as source ip addresses once service endpoints are enabled in your virtual network you can secure azure service resources to your virtual network by adding
a virtual network rule to the resources today azure service traffic from a virtual network uses public ip address as source ip address with service endpoints service traffic switches to use network with service endpoints service traffic switches to usevirtual network private address as source ip address when accessing this azure service from virtual network this switch allows you to access the services without the need for reserved public ip address used in ip firewalls you might wonder whywould you use service and points some of the benefits of using service endpoints are improved security for your azure service resources optimal routing for azure service traffic for your virtual network and endpoints always take service traffic directly fromyour virtual network to the service on microsoft azure backbone network and simple to set up with less management overhead and please note that with service endpoint the source ip address of the virtual machine in the subnet for the
service traffic switches from using public ipv4 address to using private ipv4 addresses accessing azure service firewall rules using azure public ip addresses will stop working with this switch so please ensure azure service firewall rules allow for this switchbefore setting up service endpoints you may also experience temporary interruption to service traffic from this subnet while configuring service and points and it's easy to add service and point to azure virtual network several services are available including azureactive directory azure cosmos db azure cosmos db even hub key vault service bus sql and storage so what is private link azure private link provide private connectivity from virtual network to azure platform as a service customer owned ormicrosoft partner services it simplifies the network architecture and secures the connection between endpoints in azure by eliminating data exposure to the public internet there are few benefits to private link the first one is private connectivity to services on
azure then integration with on-premises and peer network then protection against data exfiltration for azure resources and services delivered directly to your customers virtual network so how it works so use private link to bring services delivered on azure intoyour private virtual network by mapping it to the private endpoint or privately deliver your own services in your customers virtual network all traffic to the service can be routed through the private endpoint so no gateways nat devices expressroute or vpn connection or public ip addresses are needed private link keep traffic on the microsoft global network all right so that concludes the first lesson of network traffic management module and the lesson we're going to learn in
Introduces Azure Load Balancer, its components, and the difference between public and internal load balancers. Covers backend pools, load balancing rules, session persistence, and health probes.
this video is azure load balancer so let's have a look at what are the things we are going to learn on this video i will introduce you to what is an azure load balancer and then we will understandthe differentiation between public load balancer and internal load balancer then what are the different types of load balancers queues back and pools how can you apply load balancer rules what do you mean by session persistence and health probesetc so while i'm explaining this concept i will take you back and forth the portal so that you exactly know what i mean about so what is an azure load balancer the azure load balancer delivers high availability andnetwork performance to your applications the load behancer distributes inbound traffic to backend resources using load balancing rules and health probes the load balancing rules determine how traffic is distributed to the back end and health probe ensure that the
resources in the back end are healthy and the load balancer can be used for inbound as well as outbound scenarios and scales up to millions of tcp and udp application flows so keep this diagram in mind since itcovers the four components that must be configured for your load balancer the first one is front end ip configuration then the back end pools health probes and the load balancing rules these are the main four components you needto configure when you think about load balancer let's talk about the public load balancer there are two types of load balancers public and internal a public load balancer maps the public ip address and port number of incoming trafficto the private ip address and port numbers of the vm and vice versa for the response traffic from the vm by applying load balancing rules you can distribute specific types of traffic across multiple vms or services for example
you can spread the load of incoming web traffic requests across multiple web servers the following figure shows the internet client sending web page requests to the public ip address of a web app on tcp port azure load balancerdistribute the request across these three vms in the load balanced set so what is an internal load balancer an internal load balancer direct traffic only to resources that are inside a virtual network or that use a vpn toaccess azure infrastructure frontend ip address and virtual network are never directly exposed to the internet endpoints internal line of business application run in azure and are accessed from within azure or from an on-premises resources for example an internalload balancer could receive database requests that need to be distributed to the backend sql servers an internal load balancer directs traffic only to resources that are inside the virtual network and internal load balancer enable the following types of
load balancing so let's look at these one by one first one is within a virtual network load balancing from vms in virtual network to a set of vms that reside within the same virtual network the second type isfor cross-premises virtual network that is a load balancing for on-premises computers to a set of vms that reside within the same virtual network and the third type is for multi-tier applications for load balancing for internet facing multi-tier applicationswhere the back and tier are not internet facing the backend tiers require traffic load balancing from the internet facing tier and the last type is for line of business applications load balancing for line of business applications that arehosted in azure without additional load balancer hardware or software this scenario includes on-premises servers that are in the set of computers whose traffic is load balanced please note that a public load balancer could be placed in front of
an internal load balancer to create a multi-tier application let's understand the different types of load balancers cues so i'm going to take you to the portal to show you how to create your first load balancer i'm on myazure portal i'm going to go to load balancer if you don't find load balancer here just search for the load balancer on the global search box click on load balancers i already have an azure load balancer configured withinmy subscription so i'm going to create click new basic details like your subscription select a resource group or create a new resource group give a name for your load balancer and select a region where you would like toplace it and the type of the load balancer is it an internal load balancer or a public facing external load balancer and there are two different skews basic and standard some of the consideration while selecting this queue is
skews are not mutable you may not change this queue for an existing resource a standalone virtual machine resource availability set resource or virtual machine skill set resource can reference one skew never both another consideration is a load balancerrule cannot span two virtual networks frontend and their related backend instances must be in the same virtual network and there is no charge for the basic load balancer the standard load balancer is charged based on the number ofrules and data processed please note that any new designs and architecture should consider using a standard load balancer let's talk about back-end pools to distribute traffic a back-end address pool contains the ip address of the virtual nics thatare connected to the load balancer i'm going to go back to my azure portal and i'm going to go to an existing load balance i configure i'm going to select the load balancers and select the load balancer which
i already has under settings of the load balancer you can see there is a back end pool so click on the back end pool to see what are the ip you configured for the back end if you wishyou can add more configuration to the existing backend information so how you configure the back end pool depends on whether you are using a standard or basic skew in the standard sku you can have up to 1000 instancein the back end pool in the basic sku you can have up to 100 instances let's understand something about load balancer rules a load balancer rule is used to define how traffic is distributed to the backend pool therule maps a given frontend ip and port combination to a set of backend ip address and port combination to create the rule the frontend backend and health probe information should already be configured so let me show you where
you can configure the load balancer rules i'm on my azure portal go to load balancers and select an existing load balancer or create a new one and under settings you can find load balancing rules as you can seethat i don't have any rules configured at the moment and i'm going to click on add so read out the warning a prop must exist before you can create the rule so i need to configure the health propfirst before creating the rule so let's let me show you what are the settings you so let me show you what are the settings you need to understand before setting up the rule a load balancing rule can beused in a combination of nat rules for example you could use nat from the load balancing public ip address to tcp 3389 on specific virtual machine this allows remote desktop access from outside of azure so what about session
persistence by default azure load balancer distributes traffic by default azure load balancer distributes network traffic equally among multiple vm instances the load balancer uses phi tuple source ip source port destination ip destination port and protocol type to maptraffic to available servers it provides stickiness only within the transport session session persistence specify how traffic from a client should be handled the default behavior is that successive requests from a client may be handled by any virtual machineyou can change this behavior to none client ip and client ip protocol so none specifies any virtual machine can handle the request client ip specifies the successive requests from the same client ip address will be handled by thesame virtual machine client ip and protocol specifies that successive requests from the same client ip address and protocol combination will be handled by the same virtual machine please note that keeping session persistence information is a very important in
applications that use a shopping cart all right so let's understand what is health probes we already touched down health probe when we started creating a load balancing rule i'm gonna take you back to the azure portal as youcan see that before creating a rule a prob must exist so i'm going to click on this it takes me directly to the health prob or i can come under settings i can click on health props so idon't have one configured now i'm going to click on add a health probe allows the load balancer to monitor the status of your app the health probe dynamically adds or removes vms from the load balancer rotation based onthe response to health checks when a health probe fails to respond the load balancers stop sending new connections to the unhealthy instances there are two main ways to configure health probes http and tcp so let's talk about both
in the http probe the load balancer regularly props your endpoint say every 15 seconds by default the instance is healthy if it responds to http 200 within the timeout period which is default 31 seconds any status other thanhttp 200 causes this prop to fail you can apply the port the uri for requesting the health set in the tcp health probe the probe relies on establishing a successful tcp connection to a defined prop port if thespecified listener on the vmxs the prop succeeds if the connection is refused the prop fails you can specify the port interval and unhealthy threshold and please note that there is also a guest agent prop this probe uses guestagent inside the vm it is not recommended when http or tcp custom prop configurations are possible so that concludes the load balancing lesson we are still on module 6.
Explains application gateway routing, path-based and multi-site routing, listeners, rules, backend pools, and WAF. Highlights layer 7 routing and web application protection.
in this lesson we are going to learn about azure application gateway we are still on module 6 which is all about network traffic management application gateway manages the request that client applications can send to a web app anapplication gateway routes the traffic to a pool of web servers based on the url of a request this is known as application layer routing the pool of web servers can be azure virtual machine azure virtual machine scale setsazure app service and even on premises servers the application k will automatically load balance requests sent to the servers the application gateway will automatically load balance requests sent to the servers in each back-end pool using a round-robin mechanismso the load balancing work with the osi layer 7 routing implemented by application gateway routing which means that it load balances request based on the routing parameters which can be host name and paths used by the application gateway
rules in comparison other load balancers such as azure load balancer function at an osi layer 4 level and distribute traffic based on ip address of the target of a request operating at osa layer 7 enables load balancing totake advantage of other features that application gateway provides so what are the other features that it provides application gateways support the http https http 2 and web socket protocols and the web application firewall to protect against web applicationvulnerabilities end-to-end request encryption is part of the azure application gateway and azure application gateway provides auto scaling to dynamically adjust capacity as your web traffic and load change so let's understand the application gateway routing client send request toyour web application to the ip address or dns name of the gateway and then the gateway routes these requested to the selected web server in the backend pool using a set of rules configured for the gateway to determine
where the request should go and there are two primary methods for routing traffic a path-based routing and a multi-site routing so let's understand the path based routing first a path-based routing enables you to send requests with different pathin the url to the different pool of the backend servers for example you could direct request with the path slash video to the backend pool containing servers that is optimized to handle the video streaming and direct the imagesrequests to the pool of servers that handle the image retrieval so what's the main difference in the multi-site routing the multi-site hosting enables you to configure more than one web application on the same application gateway instance in themulti-site configuration you register multiple dns names for the ip address of the application gateway specifying the name of each site and then the application gateway uses separate listeners to wait for the request for each site each listener passes
the request to a different rule which can route the request to servers in different backend pool for example you could configure the application gateway to direct all requests for contoso.com to servers in one back-end pool and the requestfor fabricam.com to another back-end pool please keep this diagram in your mind when i am talking about this multi-site routing and multi-site configurations are useful for supporting multi-tenant applications where each tenant has its own set of virtual machinesor other resources hosting web applications some of the additional features you can think about application gateway routing are redirection rewrite http headers customer error pages etc application gateway has a series of components that combine to route requests toa pool of web servers and to check the health of these web servers let's understand these components in detail so what is front-end ip address the client requests are received through the front-end ip address you can configure application
gateway to have a public ip address a private ip address or both application gateway can't have more than one public or one private ip address then what are listeners application gateway uses one or more listeners to receive incomingrequest a listener accepts traffic arriving on a specified combination of protocol port host and ip address each listener routes request to a backend pool of servers following routing rule that you specify a listener can be a basic ormulti-site a basic listener only routes a request based on the path of the url and the multi-site listener can also route request using the name element of the url and listeners can also handle ssl certificates for securing yourapplication between the user and the application gateway so let's understand about the routing rules a routing rule binds a listener to the backend pools a rule specifies how to interpret the host name and the path elements in the
url of the request and direct the request to the appropriate backend pool a routing rule also has an associated set of http settings these settings indicate whether traffic is encrypted between application gateway and backend servers and other configurationinformation such as protocol session stickiness connection draining request timeout period and health props so then what about the backend pools a back in pool reference a collection of web servers you provide a backend pool references a collection ofweb servers you provide the ip address of each web server and the port on which it listens for requests when configuring the pool each pool can specify a fixed set of virtual machines a virtual machine scale set anapp hosted by azure app service or a collection of on-premises servers as well each back-end pool has an associated load balancer that distributes work across these pool then there is an additional optional feature which you can configure is
called web application firewall or rav this is very important for you to understand the web application firewall or vaf is an optional component that handles incoming requests before they reach a listener the web application firewall checks each requestfor many common threads based on the open web application security project which is known as owasp these include sql injection cross site scripting command injection http request snuggling http response splitting remote file inclusion bots crawlers and scanners andhttp protocol violation and anomalies vaf is enabled on your application gateway by selecting the vaf tier when you create a gateway and last but not the least is health probes and health probes are an important part of assistingthe load balancer to determine which servers are available for load balancing in the back end pool the application gateway uses a health prop to send a request to a server if the server returns an http response with the
status code between 200 and 399 the server is deemed healthy if you don't configure a health prop application gateway creates a default probe that waits for 30 seconds before deciding that a server is unavailable so that concludes the
Describes Azure Traffic Manager and how it routes users to endpoints around the world using DNS. Covers priority, performance, geographic, weighted, multi-value, and subnet routing methods.
lesson on azure application gateway and in this lesson we're going to learn about azure traffic manager microsoft azure traffic manager allows you to control the distribution of user traffic to your service endpoints in different data centers around theworld the traffic manager works by using a domain name system or dns to direct end user requests to the most appropriate endpoint and the service endpoints supported by the traffic manager include azure vms web apps and cloud servicesand you can also use traffic manager with external non-azure endpoints as well and the traffic manager selects an endpoint based on the configured traffic routing method and the traffic manager supports a range of traffic routing methods to suitdifferent application needs once the endpoint is selected the clients then connect directly to the appropriate service endpoint and the traffic manager provides endpoint health checks and automatic endpoint failover enabling you to build high availability applications that are resilient
to failure including the failure of an entire azure region so let's understand some of the benefits of traffic manager so here are some of the specific ways you can use the traffic manager let's go through one by onetraffic manager help you improve availability of critical applications this traffic manager allows you to deliver high availability for your critical applications by monitoring your endpoints in azure and providing automatic failover when an endpoint goes down you can usetraffic manager to improve responsiveness for your high performance applications so azure allows you to run cloud services or websites in data centers located around the world so traffic manager provides fast page loads and better user experience by servingusers with the hosted service that is closest to them and traffic manager upgrade and perform service maintenance without downtime you can seamlessly carry out upgrade and other plan maintenance you can seamlessly carry out upgrade and other planned maintenance
operations on your applications without downtime for end users by using traffic manager to direct traffic to alternative endpoints when maintenance is in the progress and you can combine on-premises and cloud-based application together so traffic manager supports both externalnon-azure endpoints enabling it to be used with hybrid cloud and on-premises deployments and you can use traffic manager to distribute traffic for large complex deployments as well traffic routing methods can be combined using nested traffic manager profiles tocreate sophisticated and flexible traffic routing configurations to meet the needs of larger more complex deployments when you configure the traffic manager you need to choose the right routing method there are different types of routing methods available within thetraffic manager each of these routing methods provide you with a unique set of features so let me explain each of these routing method in detail so what is priority routing when a traffic manager profile is configured for priority
routing it consists a prioritized list of service endpoints the traffic manager sends all traffic to the primary which is the highest priority endpoint first if the primary endpoint is not available the traffic manager routes the traffic to thesecond endpoint and so on availability of the endpoint is based on the configured status which is enabled or disabled and the ongoing endpoint monitoring the priority traffic routing method allows you to easily implement a failover pattern so youconfigure the endpoint priority explicitly or use the default priority based on the endpoint order so let's understand what is performance routing the performance routing method is designed to improve the responsiveness by routing traffic to the location that isclosest to the user the closest endpoint is not necessarily measured by geographic distance instead traffic manager determines closeness by measuring network latency the traffic manager maintains an internet latency table to track the round trip between ip address range
and each azure data center with this method traffic manager look up the source ip address of the incoming dns request in the internet latency table and the traffic manager chooses an available endpoint in the azure data center thathas the lowest latency for the ip range and the traffic manager chooses an available endpoint in the azure data center that has the lowest latency for that ip address range then returns the end point in the dns responseso what's the main difference in the geographic routing so when the traffic manager profile is configured for geographic routing each endpoint associated with that profile needs will have a set of geographic location assigned to it any request fromthose regions get routed only to that endpoint some planning is required when you create geographical endpoint a location cannot be in more than one endpoint so let's look at the traffic manager weighted routing method the weighted traffic routing
method allows you to distribute traffic evenly or use a predefined weighting in the weighted traffic routing method you assign a weight to each endpoint in the traffic manager profile configuration the weight is an integer from one two thousandthis parameter is optional if omitted traffic manager uses the default weight of one the higher the weight the higher the priority additionally we have two more routing methods the multi-value routing distributes traffic only to ipv4 and v6 endpointsand the subnet routing distributes traffic based on source ip address so that concludes the module 6 and the lesson for azure traffic manager i hope the information provided was useful and in this video we're going to test the
Reviews questions on force tunneling, internal load balancers, load balancing choices, health probes, application gateway routing, Traffic Manager, and WAF. Reinforces the network traffic management module.
knowledge on what we have learned so far in the previous lesson let's look at the question number one which of the following two features of azure networking provide the ability to redirect all internet traffic back to your company'son-premises server for packet inspection we need to select two answers which is gonna complete the whole solution so what are these two features in azure networking which can provide you this functionality is it user defined route absolutely correctis it cross-premises network connectivity definitely wrong is it traffic manager no traffic manager provide a different functionality altogether is it force tunneling absolutely correct and not system routes so user defined routes and force tunneling are the correct answersyou can use force tunneling to redirect internet bound traffic back to your company's on-premises infrastructure and force tunneling is commonly used in scenarios where organizations want to implement packet inspection or corporate audits and force tunneling in azure is
configured via virtual network user defined routes or udryour company provides customers a virtual network in the cloud and you have dozens of linux virtual machine in another virtual network you need to install an azure load balancer to direct traffic between the virtual network what should youdo we have learned about this when we talked about the load balancer so which load balancer would you choose here because you need to redirect the traffic to the right virtual network so do you install the private loadbalancer definitely not is it the public load balancer no you need to route the traffic to an internal virtual network so is it an external load balancer absolutely not so the correct answer is install an internal load balancerazure has two types of load balancer public and internal an internal load balancer directs traffic only to resources that are inside a virtual network or that uses a vpn to access azure infrastructure
let's look at question number three your company has a popular regional website the company plans to move it to microsoft azure and hosted in canada east region the web team has established the following requirements for managing the webtraffic so what are these requirements so the requirements are evenly distribute incoming web requests across a farm of 10 azure vms support many incoming requests including spikes during peak times minimize the complexity and minimize ongoing cost which ofthe following would you select for this scenario we just need to select one so based on all these requirements what do you think is going to be the right answer solution which you can implement is it a trafficmanager no traffic manager is to route traffic based on a particular routing method is it application gateway definitely not it's not azure cloud services so the correct answer is azure load balancer in this scenario the requirements call for
load balancing of website with minimal complexity and cost the website is in a single region which rules out azure traffic manager which is geared towards a distributed web application and azure cdn is complex and expensive and it isbest suited for delivering static web content at various locations worldwide with maximum performance and azure cloud services are suited for applications and apis not for this scenario so the correct answer is load balancer all right let's look atthe question number four you deploy an internal load balancer between your web tier and app to your servers you configure a custom http health probe all right so that's the key word here which two of the following arenot true so please make sure you understand this so we are trying to find which scenario is not appropriate in this sentence and we have to select two false answers okay let let me read out each statement to
find out which one is not true the load balancer manages the health prob absolutely correct so that is not the right answer by default health probe check the end point every 30 seconds that is not true because thehealth prop checks the end point every 15 seconds the next statement is the instance is healthy if it responds with http 200 error which is absolutely correct so we learned about that and we learned about the health probein load balancer you can change the amount of time between health project absolutely correct you can definitely modify that and the last statement is you can change the number of failures within a time period which is wrong youcan change the number of consecutive failures but you cannot specify a time period for the failures
let's look at question number five which criteria does application gateway use to route requests to a web server so what is that criteria which azure application gateway use we need to select one statement from this is it theuser authentication information absolutely not the region in which the servers hosting the web application are located no that is that is traffic manager is it the ip address of the web server that is the target of the requestno that is a different routing method altogether so the correct answer is the host name port and path in the url of the request azure application gateway uses the host name port and the path in the url ofthe requestwhich load balancing strategy does the application gateway implement you need to select one answer is it distribute request to each available server in the back end pool in turn round robin absolutely correct so we hit the jackpot so
the first statement itself is correct so application gateway distribute request to each available server in the backend pool using the round dropping method so that's the strategy application gateway implement you have several websites and are using traffic managerto distribute the network traffic you're bringing a new endpoint online but are not sure that it is ready to accept a full load of request which traffic manager routing algorithm should you use you need to select one sowhat's the algorithm you can use for your website to distribute the network traffic to accept the full load of request is it round robin definitely not not the priority not the geographic one so the correct answer is weightedyou will use the weighted routing algorithm this will put the end point into the rotation with a minimum amount of traffic your company has a website that allows users to customize their experience by downloading an app demand for
the app has increased so you have added another virtual network with two more virtual machines these virtual machines are dedicated to serving the app downloads you need to ensure the additional download requests do not affect the website performanceyour solution must route all the download requests to the two new servers you have installed recently what action will you recommend you need to route the traffic to the new servers you have installed so what is the routingmethod you would choose we just need to select one answer is it adding an application gateway definitely not a routing table is not going to solve the problem it is not going to resolve the problem by creating alocal network gateway or a user defined route so the correct answer is configure the traffic manager traffic manager lets you control the distribution of user traffic to your endpoints running in different data centers around the world and the
traffic manager uses dns and can route traffic to your two new download servers let's look at the last question you are deploying the application gateway and want to ensure incoming requests are checked for common security threats like cross-sitescripting and crawlers to address your concerns what should you do so we learned about this when we were talking about application gateway so the correct answer is install the web application firewall the web application firewall is an optionalcomponent that handles incoming requests before they reach a listener the web application firewall checks each request for many common threads based on the open web application security project or owasp
Introduces Azure storage and its major service categories, account kinds, and replication options. Also explains how storage endpoints are structured and how storage accounts are accessed.
all right so that concludes the module 6 that was all about network traffic management we are entering a brand new module in this video the new module is number seven and it is called azure storage and the firstlesson what we are going to learn on this azure storage it's all about storage accounts so let's have a look at what all the things we are going to learn in this particular video we will start with differenttypes of azure storage accounts and what are the different types of storage services available within azure and within azure storage services what are the different account kinds we need to be aware of and when you talk about theazure storage we need to understand the different ways of replicating this azure storage as well and once you create the azure storage how can you access these storage and in terms of security how do you secure your storage
with service endpoints so while i'm explaining about these concepts i will go back and forth between the presentation and the portal so that you know exactly what i'm talking about azure storage is the microsoft cloud storage solution formodern data storage scenarios ancient storage offers a massively scalable object store for data objects a file system service for the cloud a messaging store for reliable messaging and a nosql store azure storage is durable and highly available redundancyensures that your data is safe in the event of transient hardware failures you can also opt to replicate data across data centers or geographical regions for additional protection from local catastrophe or natural disasters all the data written toazure storage is encrypted by the service and azure storage provide you with fine-grained control over who has access to the data azure storage is designed to be massively scalable to meet the data store and performance need for today's
applications and microsoft azure handles hardware maintenance updates and critical updates for you and the data in azure storage is accessible from anywhere in the world over http or https microsoft provides sdks for azure storage in variety of languagesdotnet java node.js python php ruby go and others as well as a mature rest api and azure storage supports scripting in azure powershell or azure cli and the azure portal and azure storage x and the azure portal andthe azure storage explorer offers easy visual solutions for working with your data azure storage is a service that you can use to store files messages tables and other type of information you can use azure storage on its ownfor example as a file share but it is often used by developers as store for working data such stores can be used by websites mobile apps desktop applications and many other types of custom solutions azure storage is also
used by iis virtual machines and pass cloud storage and you can generally think of azure storage in three categories storage for virtual machines unstructured data and structured data so let's talk about these three categories in detail so whatdo i mean by storage for virtual machine usually these storage comes in either disk or file shares discs are persistent block storage for azure ios virtual machine and files are fully managed file shares in the cloud so whatis unstructured data then this includes blobs and data lake stores and blobs are highly scalable rest-based cloud object store and data lake store is hadoop distributed file system or hdfs as a service and finally the third category iscalled structure data this include tables cosmos db and azure sql database tables are a key value or auto scale nosql store cosmos db is a globally distributed database service and azure sql db is a fully managed database as
a service built on sql and when it comes to the storage account there are two different tiers the standard and the premium the standard storage accounts are backed by magnetic drives or htd and provides the lowest cost pergb they are best for applications that require bulk storage or where data is accessed infrequently then there is premium storage premium storage accounts are backed by solid state drives or ssds and offer consistent low latency performance they canalso be used with azure virtual machine disk and best for i o intensive applications like databases please note that it is not possible to convert a standard storage account to a premium storage account or vice versa you mustcreate a new storage account with the desired type and copy data if applicable to a new storage account let's talk about the azure storage services the first one is container or blob so we have four different types of
azure storage services containers file shares azure queues and azure tables so let me give you more details around these different azure storage services the first azure service is called azure containers so i'm in my azure portal once youcreate an azure storage account you can come here to find a container this is nothing but a blob storage azure blob storage is microsoft object storage solution for the cloud and the blob storage is optimized for storing massiveamounts of unstructured data such as text or binary data and the blob storage is ideal for serving images or documents directly to a browser storing files for distributed access streaming videos or audios storing data for backup and restoredisaster recovery and archiving and storing data for analysis by an on-premises or azure hosted service and objects in these blob storage can be accessed from anywhere in the world via http or https users or client application can access
blob wire urls the storage account rest api azure powershell azure cli or azure storage client library the storage client libraries are available for multiple languages including dotnet java not js python php and ruby the second service is calledfile shares or azure files azure files enable you to set up highly available network file shares that can be accessed by using the standard server message block or smb protocol that means that multiple vms can share the samefile with both read and write access you can also read the file using rest interface or storage client libraries one thing that distinguishes azure file from files on a corporate file share is that you can access the filefrom anywhere in the world using the url using a url that points to the file and includes the shared access signature standard token you can generate sas token they allows they allow specific access to the private asset for
specific amount of time many on-premises applications use file share this feature makes it easier to migrate those applications that store data to azure if you mount these file share to the same drive letter that the on-premises application usethe part of your application that access the file share should work with minimal if any changes configuration files can be stored on file shares and access from multiple vms as well tools and utilities used by multiple developers ina group can be stored on a file share ensuring that everybody can find them and that they use the same version another use case scenario is storing the diagnostic log metric and crash drum are just some of theexamples of data that can be written to the file share and processed or analyzed later and the third type is called queue storage azure queue service is used to store and retrieve messages queue messages can be up to
64 kb in size and queue can contain millions of messages and queues are generally used to store list of messages to be processed asynchronously for example say you want your customer to be able to upload pictures and youwant to create thumbnails for each picture you could have your customer wait for you to create the thumbnail while uploading the picture an alternative would be to use a queue when the customer finishes upload and write a messagein the queue then have an azure function retrieve the message from the queue and create the thumbnails each of the part of the processing can be scaled separately giving you more control when turning it for your usage andthe fourth type of azure storage service is tables azure table storage is now part of azure cosmos db in addition to existing azure table storage service there is a new azure cosmos db table api offering that provides throughput
optimized tables global distribution and automatic secondary indexes to learn more and try out the new premium experience please check out the azure cosmos db table api so let's understand the azure account kinds there are five different kinds ofazure storage blob storage general purpose v1 and v2 then block block storage and file storage each type supports different feature and has its own pricing model consider these differences before you create a storage account to determine the typeof account that is best for your applications so let me show you how you can create a new storage account and how you can determine which account kind you need to select i'm on my azure portal select yourstorage account or type for storage account on the global search box as you can see that i have couple of azure storage accounts already in my subscription click on add to create a new storage account select a resource
group or create a new one i'm going to select an existing resource group and you have to provide a unique storage account name otherwise it won't get accepted and pick a region where you would like to host thisstorage account and the performance tier we talked about there is standard and premium and once you select one it is not possible for you to change the standard here so please make the decision wisely and then comes theaccount kind so let's talk about these general purpose v1 account storage is a legacy account type for blobs files queues and tables please use the general purpose v2 account instead when possible b2 is the newest kind the basicstorage account types for blobs files queues and tables and you can use general purpose v2 storage v2 for most scenarios using azure storage another kind is blob storage accounts the blob only storage account use general purpose v2 account
instead when possible so even in this scenario you can either use general purpose v2 because that offers the block blob functionality within that and the last kind is file storage account files only storage account with premium performance characteristicsthis is recommended for enterprise or high performance scale applications please note that all storage accounts are encrypted using storage service encryption or sse for data at rest we need to understand the replication options for the storage as wellthis following table provides a quick overview of the scope of durability and availability that each replication strategy will provide you for a given type of event lrs or locally redundant storage is the lowest cost replication option and offersthe least durability compared to other options if a data center level disaster for example fire or flooding occurs in an azure data center all replicas may be lost or unrecoverable zone redundant storage or zrs or zrs synchronously replicates
your data across three storage clusters in a single region each storage cluster is physically separated from other and resides in its own availability zone each availability zone and the zrs cluster within it is autonomous with separate utilities andnetwork capabilities storing your data in a zrs account ensures that you will be able to access and manage your data if a zone becomes unavailable vrs provide excellent performance and extremely low latency let's understand what is jio redundantstorage jio redundant storage or grs replicates your data to a secondary regions which is hundreds of miles away from the primary location of the store data and grs cost more than lrs but grs provide a higher level ofdurability for your data even if there is a regional outage and grs is designed to provide at least 99.69 durability if your storage account has grs enabled then your data is durable even in the case of complete regional
outage or a disaster in which the primary region isn't recoverable so within grs we have ra grs as well which is called read access jio redundant storage this is based on grs storage itself so ragrs replicates your datato another data center in a secondary region and also provides you with an option to read from the secondary region with radrs you can read from the secondary regardless of whether microsoft initiates a failover from the primary tothe secondary and the last kind is geozone redundant storage which is available both in ra and the regular kind so jio zone redundant storage combines the high availability on zone redundant storage with the protection from regional outages asprovided by the jio redundant storage so please note that microsoft recommends using geozone redundant storage for applications requiring consistency durability high availability excellent performance and resiliency from disaster recovery so once you create a storage account how do you
access these storage accounts every object that you store in an azure storage has a unique url address the storage account name forms the domain name for the address the combination of subdomain and domain name which is specific toeach service forms an endpoint for your storage account for example if your storage account is named as my storage account then the default endpoint for your storage accounts are like these what i have mentioned over here you havethe block service table service queues and files which incidentally ends with blob dot co dot windows dot net then table dot co dot windows dot net q dot co dot windows dot net and file dot co dot windows
Shows how to restrict storage access using firewalls and virtual networks. Explains how selected networks and service endpoints help secure storage accounts.
dot net so what are the different ways you can secure your storage account or storage account endpoints so let me take you to the azure portal to show you what exactly you need to do i'm on my azureportal select the storage account which you would like to predict i'm going to select a sample storage account right underneath settings you can scroll down to find firewalls and virtual networks the step necessary to restrict the network accessto the azure services varies across services for accessing a storage account for accessing a storage account you would use the firewalls and virtual network blade to add the virtual networks that will have access right now my storage accountis allowed for all network i can select selected network and notice you can also configure to allow access to one or more public ip ranges firewalls and virtual network allow for restricting access to storage account from a specific
subnet on a virtual network and subnets and virtual network must exist in the same region or region pair as the storage account please note that it is important to test and ensure the service endpoint is limiting access as
Covers blob storage containers, access levels, hot/cool/archive tiers, lifecycle management, blob types, upload methods, and pricing. Explains how blob storage is used for unstructured data and scalable storage scenarios.
expected so that concludes the first lesson in azure storage and in this video we're going to talk about blob storage let's have a look at the things what we are going to learn on this lesson we will startwith what is blob storage what what do you mean by a blob container and what are the different access keys available within blob and how do you take care of the blob storage and what is the management looklike and how can you upload and download and manipulate files within a blob storage and what about the pricing for this blob storage so when i explain about these concept i will take you back and forth the portaland the presentation so that it makes sense to you what i'm talking about a blob storage is a service that stores unstructured data in the cloud as objects or blobs a blob storage can store any type of text
or binary data such as documents media file or application installer and blob storage is also referred as an object storage some of the common use cases of blob storage are serving images or documents directly to your browser storingfiles for a distributed access such as installation streaming video and audio storing data for backup and restore and disaster recovery and archiving and storing data for analysis by an on-premises or azure hosted service and the blob storage offersthree types of resources the storage account the container in the storage account and the blobs in the container this following diagram shows the relationship between these resources so please note that within the storage account you can group asmany blobs as you needed in a container so before i dive deep into containers let me quickly show you how to create a blob container in the azure portal i'm on my azure portal i'm gonna go to storage
account even though i have multiple storage account i'm gonna create a brand new storage account for this demonstration click on add a new storage account make sure you select the right subscription and create a new resource group orselect an existing resource group i'm going to select an existing resource group and i'm going to give a name to my storage account and i'm going to pick australia east as my region i'm going to keep the performanceas standard and the kind as general purpose v2 because that's the most recommended storage account kind which you should be using for any sort of general purpose and for the replication even though we learned about different replications availableto keep the cost down i'm going to select as locally redundant storage or lrs and the type or the tier of the blob i'm going to choose it as hot don't worry i will talk about the different tiers
available in the next session right now i'm going to leave it as hot i'm not going to modify anything on networking or any any other components i'm going to hit on review and create the validation has been passedhit on create the storage account creation won't take much time a storage account will create within a minute or so looks like my storage account has been completed i'm going to click on go to resource now that ihave created my storage account as you can see that there are different kinds of storage we can create i'm going to go to the blob storage which is containers and click on create new container to create your firstcontainer a container provide a grouping of set of blobs all blob must be in a container an account can contain an unlimited number of containers a container can store an unlimited number of blobs as well when you create
a container just simply give a name so when you select a name a name may only contain lower case letters numbers and hyphens and must begin with a letter or a number the name must also be between 3to 63 characters long then comes the public access level there are three levels private blob and container this public access level specifies whether data in the container may be accessed publicly or not by default container data is privateto the account owner so what is private use private to ensure there is no anonymous access to the container and blob and use blob to allow anonymous and public read access to the blob only and use container toallow anonymous public read and list access to the entire container including the blobs so i'm going to keep it as private no anonymous access and hit on create while that is happening please note that you can also create
the blob container with powershell using new dash ac storage container command i have my blob created now so let's understand what is blob access tiers if you remember last time when we were creating the blob container there wasa tear section which i just ignored and selected hot so let me go back and tell you what is this access tier all about i'm going to go back to the storage account and create a sample storage accountso that you know what i'm talking about i'm not going to fill in all the details we have done that but if you look at this i'm going to select it to blob storage so that you see allthe options so i'm going to leave all the details by default so that you know all so you know what i'm talking about so i just want you to focus on blob access tier by default it is hot
you can change the access tier the azure storage provides different options for accessing block blob data based on the usage patterns each access tier in azure storage is optimized for a particular pattern of data usage by selecting thecorrect access tier for your need you can store your block blob data in the most cost effective manner so you have three options i know that you can only see two in general there are three options hot cooland archive so let me explain what is hot a hot tier is optimized for frequent access of objects in the storage account accessing data in the whole tier is most cost effective while storage cost is somewhat higher newstorage accounts are created in the hot tier by default the second tier is called cool tier the cool tier is optimized for storing large amount of data that is infrequently accessed and stored for at least 30 days storing
data in the cool tier is the most cost effective but accessing that data may be somewhat more expensive than accessing data in the hot tier and the third option is archive the archive tier is the most cost effectiveoption for storing data but accessing that data is more expensive than accessing data in the hot or cool tiers please note that if there is a change in usage pattern of your data you can switch between these accesstiers at any time let's understand the blob lifecycle management data sets have unique life cycle early in the life cycle people access some data often but the need for access drop drastically as the data ages some data staysidle in the cloud and is rarely accessed once stored some data expires days or months after creation while other data sets are actively read and modified throughout their lifetimes azure blob storage lifecycle management offers a rich rule-based policy
for general purpose v2 and blob storage accounts use the policy to transition your data to the appropriate access tier or expire at the end of the data's life cycle so let me show you where you can add thisrule in the life cycle management i'm on my azure portal i'm going to go back to my storage account i created for this scenario and under settings or no under blob service go to lifecycle management as you cansee that i don't have any lifecycle management rule created so far click on add a rule this is where you can add a new rule for your lifecycle management the lifecycle management policy lets you transition blobs to acooler storage tier to optimize for performance and cost and this let you delete blobs at the end of the lifecycle as well and you would be able to define rules to be run once per day at the storage
account level and you would be able to apply rules to containers or a subset of blobs so how do you upload blobs a blob can be any type and size file azure storage offers three types of blobs blockblobs page blobs and append blobs you specify the blob type and access tier when you create the blob so let me show you how you can upload files to the blob storage and how you can find the blobtype i'm on my azure portal select the same storage account we created i'm going to scroll down to blob service and click on containers and this is the sample container we created for this demo and if you noticethe access level is set to private i can always go and modify and change the access level whenever i want i'm going to keep it by default let's click on upload let's open up another tab where i can
select the file which i like to upload from my local computer but for this topic i'm going to select advanced and this gives me the type of blob i am trying to upload there are three types block blobpage blob and append blob blog blobs are the default one which consists of blocks of data assembled to make a blob most scenarios use blob storage employee blob blobs and block blobs are ideal for storing text and binarydata in the cloud like files images and videos the second option is page blob page blob can be up to eight terabytes in size and are more efficient for frequent read write operations azure virtual machines use page blobsas os and data disk and the third kind is called append blobs append blobs are like block blobs in that they are made up of blocks but they are optimized for app end operations so they are useful for
logging scenarios now we have learnt about how to create blob files and what are the different types and access tiers within the blob storage let's learn about what are the ways you can upload files to blob storage thereare multiple methods to upload data to blob storage including ac copies storage data movement library blob fuse and import export so let me give you a high level view on what this is so that you are aware ofthese tools the first one is ac copy az copy is an easy to use command line tool for windows and linux that copies data to and from blob storage across containers or across storage accounts then we have theazure storage data movement library is a dotnet library for moving data between azure storage services the az copy utility is built with the data movement library then we have azure data factory which supports copying data to and from
blob storage by using account key shared access signature service principle or managed identities for azure resources authentications the fourth option is blob fuse so blob fuse is a virtual file system driver for azure blob storage you can useblob fuse to access your existing block blob data in your storage account through the linux file system the next option is azure data box disk this is a service for transferring on-premises data to blob storage when large datasets or network constraints make uploading data over the wire unrealistic you can use azure data box disk to request solid state disk ssds from microsoft you can then copy your data to those disk and ship them back tomicrosoft to be uploaded into blob storage and the last one is azure import export azure import export service provide a way to export large amount of data from your storage account to the hard drive that you provide and
that microsoft then ships back to you with your data once the copy is being done and of course you can always use azure storage explorer as well let's understand the blob storage pricing before we move into the nexttopic all storage account use a pricing model for blob storage based on the tier of each blob when using a storage account the following billing consideration apply performance tier in addition to the amount of data stored the costof storing data varies depending on the storage tier the per gigabyte cost decreases as the tier gets cooler then we have data access cost data access charges increase as the tier gets cooler for data in the cool andarchive storage tier you are charged a per gigabyte data access charge for reads then there is transaction cost there is a per transaction charge for all tiers that increases as the tier gets cooler then there is jio replication
data transfer cost as well this charge only applies to accounts with jio replication configured including grs and ra grs jio replication data transfer inquires a per gigabyte charge then there is additional outbound data transfer cost as well outbounddata transfer which is data that is transferred out of azure region incur billing for bandwidth usage on per gigabyte basis fences with general purpose storage accounts all right so that concludes the lesson on blob storage and in this
Explains shared access signatures, authorization options, and how SAS tokens are generated and controlled. Also covers storage service encryption, customer-managed keys, and SAS security best practices.
lesson we're going to learn about storage security let's look at from a high level point of view what are the topics we are going to learn in this lesson we will talk about the storage security and what isshared access signature then we will touch upon uri and sas parameters and during all these topics don't worry about the demonstration i will go back and forth to show you exactly what i mean by each topic so youare completely aware of what the concept is all about then we will touch base on storage service encryption and customer managed keys and finally i will finish this lesson with storage security best practices azure storage provides a comprehensiveset of security capabilities that together enable developers to build secure applications in this video i will focus on shared access signature but also cover storage encryption and some best practices some of the high level security capabilities of azure
storage are encryption authentication data in transit data encryption and shared access signatures every request made against a shared resource in the blob file queue and table service must be authorized authorization ensures that resources in your storage account areaccessible only when you want them to be and only to those users or application to whom you grant access so options for authorizing requests to the azure storage include azure active directory shared key shared access signature and anonymousaccess to containers and blobs so let's understand what is shared access signature a shared access signature or sas is a uri that grants restricted access rights to azure storage resources let me show you where you can find thestorage access signature i'm on my azure portal within storage account select an existing storage account under settings you can find shared access signature you can provide a shared access signature to clients who should not be trusted with your
storage account key but whom you wish to delegate access to certain storage account resources by distributing a shared access signature uri to these clients you grant them access to a resource for a specific period of time sas isa secure way to share your storage resources without compromising your account keys a shared access signature gives you a granular control over the type of access you grant to clients who have the sas please note that there aretwo types of sas accounts and services the account says delegates access to resources in one or more of the storage services and the services delegate access to resources in just one of the storage account and a stored accesspolicy can provide an additional level of control over service level sas on the server side let's understand the uri and sas parameters as you create a sas a uri is created using the parameters and tokens the uri consists
of your storage resource uri and sas token so let me show you how to create that i'm in my storage account within shared access signature select the type of sas key select the type of sas uri you wouldlike to create i'm going to allow access to the blob storage and only to the container and i just want to limit the permission to read and i would like to end this access within a certain amount withina certain number of days if i want i can further drill down and allow an ip address as well and i can click on generate sas and connection string when you do that you get your sas token andthe sas url and the connection string you can basically copy this token and give it to the user or the company who is trying to access the data let's understand the storage service encryption azure storage service encryption or
sse for data at rest help you protect your data to meet your organizational security and compliance requirements with this feature the azure storage platform automatically encrypts your data before persisting into azure manage disk as your blob queue tablestorage or azure files and decrypts the data before retrieval the handling of encryption encryption address decryption and key management in storage service encryption is transparent to users so let me show you where you can do that so withinthe storage accounts under settings you can click on you can click on encryption all data written within the azure storage platform is encrypted through 256-bit aes encryption one of the strongest block ciphers available please note that storage serviceencryption is enabled for all new and existing storage account and cannot be disabled because your data is secured by default you don't need to modify your code or applications so what is customer managed key if you prefer you
can use the azure keyword to manage your encryption keys with the key wallet you can create your own encryption keys and store them in the key vault or you can use azure keyword apis to generate encryption keys solet me show you how to access the customer manage keys so within the azure portal go to your storage account and inside encryption you can see the customer manage keys or you can go to encryption scope and adda new customer managed key as well using custom keys give you more flexibility and control when creating disabling auditing rotating and defining access controls please note that you use customer manage keys with sse you can either create anew keywalt and key or you can use an existing key vault and key the storage account and the key vault must be in the same region but they can be in different subscriptions all right so let's look at
some of the storage security best practices when you use shared access signature in your application you should be aware of two potential risk if the shared access signature is compromised it can be used by anyone who obtains itif a shared access signature provided to a client application expires and the application is unable to retrieve a new sas from your service then the application functionality may be hindered you could use these following recommendations for using sharedaccess signature can help you mitigate these risks always use https to create or distribute sas if a sas key is passed over http and intercepted an attacker performing a man in the middle attack is able to read thesas and then use it just as the intended user could have potentially compromising sensitive data or allowing for data corruption by the malicious user and please use reference stored access policies when possible so stored access policies give you
the option to revoke permissions without having to regenerate the storage account keys the next recommendation is use near-term expiration times on an ad hoc sas in this way even if a sas is compromised it's valid only for ashort time this practice is especially important if you cannot reference a stored access policy so the near term expiration times also limit the amount of data that can be written to a blob by limiting the time available toupload to it another recommendation is have clients automatically renew the sas key if necessary the client should renew the sas key well before the expiration a security best practice is to provide a user with the minimum required privilegesand understand that your account will be billed for any sort of usage if you provide right access to a blob a user may choose to upload a 200 gb blob if you have given them read access as well
they may choose to download it 10 times inquiring 2 tb in egress cost another recommendation is validate data written using sas when a client application writes data to your storage account keep in mind that there can be problemswith that data and don't assume sas is always the correct choice sometimes the risk associated with a particular operation against your storage account outweigh the benefit of sas so that concludes the lesson on shared access signature and storage
Describes Azure Files, file shares, snapshots, and how they differ from blobs. Then explains Azure File Sync, its components, and the steps to configure synchronization with Windows Server.
security in this video we're going to learn about azure files and azure file sync let's have a high level view on what are the things we are going to learn on this video i will help you understand howto differentiate azure files versus azure blobs and how can you manage your azure files and when it comes to backing up your azure files how can you take the snapshot and what are the different options available within thesnapshot and while i'm explaining about all these concept i will take you back and forth between presentation and the portal to show you exactly what i mean so you understand all these concepts in detail after azure files wewill talk about azure file sync and what are the components involved in the azure file sync and how to set up your azure file sync as well alright so let's understand the main difference between azure files and azure
blobs azure file storage offers shared storage for applications using industry standard smb protocol microsoft azure virtual machine and cloud services can share file data across application components wire mounted shares and on-premises application can also access file data inthe share sometimes it is difficult to decide when to use file shares instead of blobs or disk shares so you can review this table that comprises the different features of azure blob and azure files azure files can beused when you lift and shift application to the cloud or you can use to store shared data across multiple vms and you can use to store development and debugging tools as well and blob storage support streaming and randomaccess scenarios where you can upload binary data other distinguishing features when selecting azure files are azure files are true directory objects while azure blobs are a flag namespace azure files are accessed through file names and azure blobs are
accessed through a container and azure files provide shared access across multiple virtual machine azure disks are exclusive to a single virtual machine please note that azure files offers fully managed file shares in the cloud that are accessible viathe industry standard smb protocol azure file shares can be mounted concurrently by cloud or on-premises deployment of windows linux and mac operating systems so before we learn about how to manage file share let me show you how tocreate a file share in the azure portal i'm on my azure portal i'm gonna go to the storage account you can create a brand new storage account but i'm gonna use an existing storage account we created for thisdemo once you are inside the storage account you can either access the file share from the overview blade or you can scroll down and you can find file shares or file services click on file shares as you can
see that i don't have any file share at the moment click on create a new file share and i'm going to create a new file share and i'm going to assign a quota of 100 gb and you havedifferent tiers premium transaction optimized hot and cool i'm going to select hot at the moment and hit on create so that created the file share so let's understand how to map these file shares on windows so i'm goingto select the file share and you can connect to your azure file share with windows or windows server all of this information is available by selecting the connect from the file share page you can use this to connectto windows 10 or windows server if you are trying to connect to your linux or a mac operating systems you can select these commands subsequently so i'm going to stick to windows at the moment so before connecting to
the drive you can select the appropriate drive letter so let me quickly go back to my local computer to see which drive lifter is not assigned as you can see that i only have one drive which is mylocal hard disk and then i have a network location which is again a file share i can see that it is already mapped and i'm using a letter w so i'm going to go back to the azure portalthis time i'm going to select x so to map this 104 file share all i have to do is select the drive letter and copy this command and open powershell in my local computer and please make sure toselect the powershell in the normal mode not on an administrative privilege so now i have my powershell open what i'm gonna do i'm gonna put this window side by side to show you one of the end results so
i'm gonna paste the command which i just copied and i'm gonna execute it so looks like the command is run successfully and i can see that the file share we just created is mapped to my computer as wellnow i can double tap and open the file drive and i can create a new folder or a file and now i can use this folder just like any other local drive on my computer so let's understand thefile share snapshots azure files provide the capability to take share snapshot of file shares let's show you how to enable the snapshot so i'm in my azure portal i'm inside the file share within the file share if irefresh it i can see the folder i created just now i can upload a new folder or a file you through this portal itself under operations you can find snapshots you can add a new snapshot here snapshot capture
the share state at that point in time a shared snapshot capability is provided at the file share level retrieval is provided at the individual file level to allow for restored individual files you cannot delete a share that hasshare snapshot unless you delete all the share snapshot first and the share snapshots are incremental in nature only the data that has changed after your most recent shared snapshot is saved this minimizes the time required to create sharesnapshot and saves on storage cost even though share snapshots are saved incrementally you need to retain only the most recent share snapshot in order to restore the share you can use the share snapshot for these use case scenariosprediction against application error and data corruption prediction against accidental deletions and unintended changes and general backup purposes so let's learn about azure file sync use azure file sync to centralize your organization's file share in azure files while keeping
the flexibility performance and compatibility of an on-premises file server azure file sync transforms windows server into a quick cache of your azure file share you can use any protocol that's available on windows server to access your data locallyincluding smp nfs and ftps and you can have as many caches as you need across the world there are many use case scenarios and advantages of using file sync so let me explain one by one the first oneis lift and shift lift and shift is the ability to move applications that require access between access and on-premises systems this provides right access to the same data across windows server and azure files this lets companies with multipleoffices have a need to share files with all offices second use case scenario is branch offices branch offices need to backup files or you need to set up a new server that will connect to azure storage another use
case scenario is backup and disaster recovery once file sync is implemented as your backup will backup your on-premises data also you can restore file metadata immediately and recall data as needed for rapid disaster recovery and the last optionis file archiving only recently accessed data is located on local servers non-use data moves to azure in what it is called as cloud tiering and please note that cloud tiering is an optional feature of azure file sync inwhich frequently accessed files are cached locally on a server while all other files are tiered to azure files based on policy settings to gain most out of azure file sync it's important for us to understand the terminologies thefirst one is storage sync service the storage sync service is the top level azure resource for azure file sync the storage sync service resource is a pair of azure storage account resource and can similarly be deployed to azure
resource groups a distant top level resource from the storage account resource is required because the storage sync service can create a sync relationship with multiple storage accounts via multiple sync groups a subscription can have multiple storage sync serviceresources deployed the next concept we need to understand is sync group a sync group defines the sync topology for a set of files endpoint with a sync group are kept in the sync with each other if for exampleif you have two distant sets of files that you want to manage with azure file sync you want to create two sync groups and add different endpoints to each sync group a storage sync service can host as manysync groups as you need the next concept you need to understand is registered server the registered server object represents a trust relationship between your server and the storage sync service you can register as many servers to the storage
sync service instance as you want however a server can be registered with only one storage sync service at a time and the next one we need to understand is the azure file sync agent the azure file sync agentis a downloadable package that enables windows server to be synced with the azure file share the azure file sync agent has three main components the file sync server exe the storage sync sys and the powershell management command letsthen there are additional two more components which is server endpoint and the client endpoint so let's understand the file sync steps there are several high level steps for configuring file sync the first step is to deploy the storagesync service the storage sync service can be deployed from the azure portal you will need to provide name subscription resource group and location the second step is to prepare windows server to use the azure file sync in this
step for each server that you intend to use with the azure file sync server node in a failover cluster you will need to configure the server the preparation steps include temporarily disabling internet explorer enhanced security and ensuring youhave the latest powershell version and the third step is to install the azure filesync agent the azure filesync agent is a downloadable package that enables windows server to be synced with the azure file share the azure file syncagent installation package should install relatively quickly we recommend that you keep the default installation path and that you enable microsoft update to keep azure file sync up to date and the last but not the least is register windowsserver with storage sync service when the azure file sync agent installation is finished the server registration ui automatically opens registering windows server with a storage sync service establishes a trust relationship between your server and the storage sync service
and the registration requires your subscription id resource group and storage sync service a server can be registered with only one storage sync service at a time so that concludes azure file sync and azure file share and in this
Introduces Azure Storage Explorer, import/export jobs, Data Box, and AzCopy. Compares tools for moving data into and out of Azure storage depending on size and bandwidth constraints.
lesson we're going to learn about how to manage azure storage within this lesson we're going to learn about what is storage explorer how can you import and export a service what is azure data box and how can youuse ac copy and what do you mean by data transfer tool selection and when i'm explaining about these concept i will go back and forth to show you a demonstration around how to use these tools and services soyou so exactly know what i mean by that let's talk about azure storage explorer azure storage explorer is a standalone app that makes it easy to work with azure storage data on windows mac operating system and linux youcan download azure storage explorer for free so as soon as you go to the azure storage explorer page this is where you can download and you can select different versions of your operating system what you are using with
storage explorer you can access multiple accounts and subscription and manage all your storage content to fully access resources after you sign in azure storage explorer require both management and data layer permissions this means that you need azure activedirectory permissions which gives you access to your storage account the containers in the account and data in the container so let me download the storage explorer and show you how to connect your azure all right so the downloadis finished i'm gonna launch this application to install it i'm going to install it for only this user accept the agreement and install it because it's a small application the installation is fairly quick so i completed the installationi'm going to launch the storage explorer now all right so now the storage explorer is installed you can see the information about the you can see the latest version and the information about the storage explorer if you want
to modify the settings this is where you can change the settings i like to keep it as dark all the time but i know that not many people prefer that so i'm going to change it to light forthis demonstration and click on connect to connect to your azure subscription so it gives you an option to add an azure account is it azure china germany user us government or other environment so i'm going to select azureand you have multiple options as well do you want to connect using a connection string or shared access key or a storage account name etc so i'm going to click next gives me a prompt to connect you anaccount using username and password so i provided the username and password and i'm going to sign in to the azure account all right so now it is connected to my azure subscription so you can see that it is
connected to my azure subscription now i can see all my storage account over here i can simply expand the storage account which i want to connect to and expand the type of storage service and i can see thereis a file i can either upload or download any files within it i'm going to simply select upload and i'm going to select upload a file so i'm gonna i'm gonna upload a particular file it's a png filei'm going to upload to the root folder so you can connect to an azure subscription and work with the local development storage or you can attach to an external storage so that's one way of managing your storage accountlet's look at the second way of managing your storage account it's called import and export service azure import export service is used to securely import large amount of data to azure blob storage and azure files by shipping disk
drives to an azure data center this service can also be used to transfer data from azure blob storage to disk drives and ship it to your on-premises sites data from one or more disk drives can be imported eitherto an azure blob storage or azure files with the azure import export service you can supply your own disk drives and transfer data yourself so let's look at some of the use case scenarios of azure import export serviceconsider using azure import export service when uploading or downloading data over the network is too slow or getting additional network bandwidth is cost prohibitive scenarios where it is useful include migrating data to the cloud content distribution backup anddisaster recovery so let's understand the import job process an import job securely transfers large amount of data to the azure blob storage and azure files by shipping disk drives to azure data center in this case you will be
shipping hard drive containing your data in order to perform an import you will create an azure storage account then identify the number of disk that you will need to and identify the number of disks that you will needto accommodate all the data that you want to transfer then identify a computer that you will need to perform the data copy and run the wai import export tool to copy the data and use the azure portal tocreate the import job and ship the disk to the destination you specified when creating the import job once the disk arrive at the destination the azure data center staff will carry out the data copy to the target azurestorage and ship the data and ship the disk back to you the next step is export job export job transfer data from azure storage to hard disk drives and ship to your on-premises sites in order to perform an
expert you follow these process identify the data in the azure storage blob that you intend to export identify the number of disks that you will be needed to accommodate all the data that you want to transfer use theazure portal to create the export job referencing the storage account and ship the required number of disk to the azure region hosting the azure storage account and once the disk arrive at the destination azure data center staff willcarry out the data copy from the storage account to the disk that you provided let's understand what is data box you can use data box to move stored or in-flight data to azure quickly and cost effectively there aredata box products for both offline and online scenarios so use databox offline data transfer products to move large amounts of data to azure when you are limited by time network capability or cost scenarios for offline data box products
include one-time migration incremental transfers and periodic updates you can use data box disk data box and data box heavy for any sort of offline transfer you can move your data to azure using common copy tools such as robocopyall data is aes encrypted and the devices are wiped clean after upload in accordance with nist special publication 800-88 revision 1 standards let's understand the data box online scenarios databox online scenarios you use either data box edge ordata box gateway so what is databox gateway databox gateway transfers data to and from azure it's a virtual appliance based on virtual machine provisioned in your virtualized environment or hypervisor the virtual device resides in your on-premises and youwrite data to it using nfs and smb protocols the device then transfers your data to azure block blob page blob or azure files so what is data box edge data box edge is an on-premises physical network appliance transfers
data to and from azure you can analyze process and transform your on-premises data before uploading to the cloud using ai enabled edge computing capabilities azure data box edge is an ai enabled edge computing device with network data transfercapabilities you can use azure data box gateway for cloud arcable data aggregation and integration with on-premises workload and you can use databox edge for pre-processed data or inference azure machine learning or transfer data over network to azure allright so what is azid copy or ac copy an alternative method for transferring data is using ac copy the version of ac copy is version 10 now is the next generation command line utility for copying data to andfrom azure blob and file storage which offers a redesigned command line interface and a new architecture for high performance reliable data transfers using ac copy you can copy data between a file system and a storage account or between
storage accounts as well so what are the new features of this ac copy now ac copy supports azure data like storage gen2 and supports copying an entire account to another account and account to account copy is now usinga new put from url apis and there is some general performance improvements as well we need to understand about what is the authentication options available with ac copy as well you can authenticate with azure active directory or usingsas tokens choosing the right tool for transfer is the trickiest part let's look at this particular following table to understand which tool do you select depending on your data set you have the smallest data set to the largestdata set and considering different bandwidth requirement you can figure out which solution you can use within azure it's either going to be azure input export or ac copy or any other data box solution now that we have completed
Reviews questions on anonymous blob access, Azure Files, append blobs, blob storage, SAS policies, Data Box Heavy, replication options, and AzCopy. Reinforces the storage module concepts.
the module 7 which is all about azure storage in this video we're going to go through azure storage module review questions you work for an open source development company you use microsoft azure for a variety of storage needsup to now all the storage was used for internal purposes only it is organized in block blobs each block block is in its own container each container is set to default settings in total you have 50 block blobsthe company has decided to provide read access to the data in the block blobs as part of releasing more information about their open source development as part of releasing more information about their open source development efforts you needto reconfigure the storage to meet the following requirements so what is the requirement the requirement is all block blobs must be readable by anonymous internet users and you need to configure the storage to meet the requirements so what
should you do you just need to select one answer so let's look at the requirement your requirement is to provide a block blob which is readable by anonymous internet users so while creating block blob you have multiple settingshow you can allow somebody else to access your container so let's go through the statements create a new container move all blobs to the new container and then set the public access level to blob which is correct sowe hit the jackpot the first option itself is the correct answer in this scenario you need to reconfigure 50 containers while you can do that it goes against the requirement to reduce the administrative overhead of future access changesa shared access signature could work here but not with the settings outlined in the answer choice in this scenario you should create a new container move the existing blobs and then set the public access level to blob in
the future when access changes are required you can configure the single container which would contain all blobs your company is planning to store log data crash dump files and other diagnostic data for azure vms in azure the companyhas issued the following requirements so what are the requirements administrators must be able to browse to the data in the file explorer access over smb 3.0 must be supported and the storage must support coders you need to choosethe storage type to meet the requirements which storage type should you use you just need to choose one so it's not queues blob or table there is only one storage service in azure which support smb 3.0 and otherrequirement what it is mentioned over here so the correct answer is azure files azure files support smb 3.0 and is reachable via file explorer and support codas let's look at question number three your company provides cloud software to
audit administrative access in microsoft azure resources the software logs all administrative actions including all clicks and text input to log files the software is about to be released from beta and the company is concerned about storage performance youneed to deploy a storage solution for the log files to maximize performance what should you do you just need to select one answer to complete the solution easy to deploy azure files using smb 3.0 we are not lookingfor an azure file smb solution it's not a table storage and queue storage yes absolutely we need a blob storage but not block blobs so the correct answer is deploy blob storage using append blobs append blobs optimize appendoperations in this scenario the company need to write data to log files most often appending data until a new file is generated block blobs are cost efficient but not designed specifically for append operations so performance isn't as high
let's look at the question number four your company is building an app in azure the app has the following storage requirements the storage must be reachable programmatically through a rest api the storage must be globally redundant and storagemust be accessible privately within the company's azure environment and the last requirement is storage must be optimal for unstructured data as well which type of azure storage should you use for this app you just need to select oneso based on this requirement the correct answer is blob storage because azure blob storage is optimal for understanding data and meet the requirement for the company's app you use a microsoft azure storage account for storing large number ofvideo and audio files you create containers to store each type of file and wants to limit access to those files for specific periods additionally the files can only be accessed through shared access signature you need the ability to
revoke access to the files and to change the period for which users can access the files what should you do in order to accomplish this in the most simple and effective way you just need to select one answeris it by creating a sas for each user and delete the sas when the user want to prevent access absolutely not you use rights management service to control access that is for document services that is not the rightanswer or do you implement stored access policies for each container to enable revocation of access or change of duration absolutely correct you should implement stored access policies which will let you change access based on permission or duration byreplacing the policy with a new one or deleting it all together to rework access you need to provide a contingent staff employee temporary read only access to the contents of an azure storage account container named media it is
important that you grant access while adhering to the security principle of least privilege what should you do you need to select one answer do you set the public act do you set the public access level to the containerdefinitely not do you generate a shared access signature sas token for the container absolutely correct you should generate a sas token for the container which provide access either to the entire container or blobs your organization maintains historical imagesfor large media companies there are thousands of photo requiring over 600 tb of storage your data center has only limited bandwidth and you need to quickly move the data to azure blob storage additionally security of the data includingchain of custody logs and 256 bit encryption is required which of the following products would you recommend using so the requirement is more than 600 tb of storage and it required 256 bit encryption as well so the correct
option is data box heavy the data box heavy supports one petabyte total capacity per order and up to 800 tb usage capacity per order let's look at question number eight you are using blob storage which of the followingis true you need to select one answer the cool access tier is for the frequent access of object in the storage account definitely not is it the hot access tier is for storing large amount of data that isinfrequently accessed totally wrong the performance tier you select does not affect pricing that is not the right answer the correct answer is you can switch between hot and cool performance tiers at any time changing the storage account tierfrom cool to hot requires a charge equal to reading all the data existing in the storage account however changing the account storage tier from hot to cool inquires a charge equal to writing all the data into the cold
tier you are planning a delegation model for your azure storage and the company has issued the following requirement for the non-production environment you must have an automated time limited access and the production environment you must have an unrestrictedaccess to the storage resources you need to configure storage access to meet the requirements what should you do each answer presents the part of the solution and we need to select two answers use shared access signature for non-productionapps absolutely correct because for the non-production environment we need to have an automated time limited access so sas can give you that use shared access signature for the production apps we are looking at unrestricted access so definitely notuse access keys for non-protection app definitely not we need to use shared access signature use access keys for prediction app absolutely correct because that will give us unrestricted access to the storage resources so the shared access signature provide
a way to provide more granular storage access than access keys and access keys provide unrestricted access to the storage resources which is the requirement for the production app in the scenario your company has a file server named fs01and the server has a single shared folder that users access to shared files the company wants to make the same files available from microsoft azure and the company have following requirements microsoft azure should maintain the exact same dataas the shared folder all right and the file deleted on either side on-prem or cloud shall be subsequently or automatically deleted from the other side and we need to implement a solution and we need to select one answerso we have learned about this when we learned about azure files and file sync so the correct answer is azure file and file sync so let me explain why it is in this scenario only azure file sync can
keep fs01 and azure synced up and maintain the same data all right let's look at question number 11.which of the following replicates your data to a secondary region maintains six copies of your data and is a default replication option so we learned about this when we talked about different types of replication available in the storageaccount so the correct answer is read access jio redundant storage and rajrs is the default replication option you have an existing storage account in microsoft azure it stores unstructured data you create a new storage account and you needto move half of the data from the existing storage account to the new storage account what tool should you use you need to select one is it the azure portal definitely not is it the file server resource managerno it's not the robocopy as well so the correct answer is az copy command line tool the key in this scenario is that you need to move data between storage account the easy copy tool can work with two
different storage account the other tool do not copy data between storage accounts just in case if you're wondering what other tool you can use you can use azure storage explorer alright so that concludes the module 7 which is
Introduces Azure virtual machines as IaaS and explains common use cases such as testing, hosting, backup, and HPC. Covers planning factors including networking, naming, region selection, pricing, sizing, disks, operating systems, and connection methods.
all about azure storage we are starting a brand new module in this video the new module is called azure virtual machine and the first lesson we are going to learn in this video it's all about virtual machine planninglet's have a look at the things we are going to learn in this video we will start with what is infrastructure assist cloud what are the components involved in infrastructure as a cloud and what are the scenarios thenbefore you select placing your workload in azure what are the planning checklists you need to keep in mind and when it comes to where to place these workloads what about the location and the pricing of these workloads beforeyou selecting a virtual machine you need to understand the different types of sizes and the families available within virtual machine and how about these virtual machine disk both for data and the operating system and what are the other
storage options available for a virtual machine and we will touch base on the supported operating system and the virtual machine connections when i explain about these concept i will take you back and for the azure portal so thatit makes total sense to you what i am trying to convey as your virtual machine is azure virtual machine is one of the several types of on-demand scalable computing resources that azure offers typically you will choose a virtualmachine if you need more control over your computing environment than the choices such as app service or cloud services offer azure virtual machines provide you with operating system storage and networking capabilities and can run a wide range ofapplications virtual machines are part of the infrastructure as a service or is offering ios is an instant cloud infrastructure provisioned and managed over the internet you can quickly scale up and down with the demand and pay only for
what you use there are so many business scenarios where is perfectly makes sense so let me tell you each one by one the first scenario which i can think of is test and development teams can quickly set upand dismantle test and development environments bringing new application to market faster ios make it quick and economical to scale up dev test environment up and down another business scenario is for website hosting running website using is can beless expensive than traditional web hosting what about storage backup and recovery another scenario where you can leverage is is for storage backup and recovery organizations avoid the capital outlay for storage and complexity of storage management which typically requiresa skilled staff to manage data and meet legal and compliance requirements is is useful for handling unpredictable demand and steadily growing storage needs it can also simplify planning and management of backup and recovery systems another business scenario is
about high performance computing high performance computing on supercomputers computer grids or computer cluster help solve complex problems involving millions of variables or calculations examples include earthquake are protein folding simulations climate and weather predictions financial modeling and evaluating productdesigns another business scenario is big data analysis big data is a popular term for massive data sets that contain potentially valuable patterns trends and associations mining data sets to locate or tease out these hidden patterns requires a hugeamount of processing power which is economically provides last but not the least is extended data center you can add extra capacity to your data center by adding virtual machines in azure instead of inquiring the cost of physically addinghardware or space to your physical location you can connect your physical network to azure cloud network seamlessly all right so before provisioning a vm to azure which requires so much so before you start provisioning vms in azure you
need some sort of a planning before you create a single vm we make sure you have thought about network naming the vm deciding the location of the vm how to determine the size of the vm understanding the differentpricing model storage of the vm and selecting the and selecting the vms etc let's look at the first planning which is all about starting with the network virtual networks or vnets are used in azure to provide private connectivitybetween azure virtual machine and azure services vms and services that are part of same virtual network can access one another by default services outside the virtual network cannot connect to the services within the virtual network you can howeverconfigure the network to allow access to the external service including your on-premises servers one another planning we need to make sure is that to name our vms correctly one piece of information people often don't put much thought into
is the name of the vm the vm name is used as the computer name which is configured as part of the operating system you can specify a name of up to 15 characters on a windows vm and 64characters on a linux vm the name also defines a manageable azure resource and it's not trivial to change later this means that you should choose the name that are meaningful and consistent so you can easily identify what thevm does a good convention is to include the following information names something which has the vm should include things like environment like a dev prod or qa or test location where the vm belongs the instance count and whatsort of a product it is and the type of roles which you have installed on that vm another type of planning is to decide the location of the vm azure has data centers all over the world filled with
servers and disk these data centers are grouped into geographic regions example west u.s north europe southeast asia etc to provide redundancy and availability when you create and deploy a virtual machine you must select a region where you wantthese resources this lets you place your vms as close as possible to your users to improve performance and to meet any legal compliance or tax requirements two other things to think about regarding the location choice are the locationcan limit your available options because each region has different hardware available and some configurations are not available in all regions another thing to keep in mind is there are price differences between these locations so if your workload isn'tbound to a specific location it can be very cost effective to check your required configuration in multiple in multiple region to find the lowest price another thing to consider while planning for a virtual machine is the know the
pricing options there are two separate cost the subscription will be charged for every vm compute and storage by separating these costs you scale them independently and only pay for what you need let's talk about the compute cost thecompute expenses are priced on per hour basis and built on per minute basis for example you're only charged for 55 minutes of usage if the vm is deployed for 55 minutes you're not charged for compute capacity if youstop and delocate the vm since this is released the hardware so if you de-allocate the compute you are not being charged for the compute capacity the hourly price varies between the vm sizes and the operating system you selectthe cost of the vm include the charge of the windows operating system and linux based instances are cheaper because there is no operating system license charge let's understand the storage cost your charge separately for the storage the vm
uses the status of the vm has no relation to the storage changes that will be inquired even if the vm is stopped deallocated and you are in bill for the running vm you will be charged for the storageused by the disk for the compute cost there are two payment options one is pay as you go another one is reserved virtual machine instances with the consumption based option you pay for the compute capacity by the secondand you are able to increase or decrease compute capacity on demand as well as start or stop at any time the reserved virtual machine option is an advanced purchase of a virtual machine for one or three years ina specified region this commitment is made up front and in return you get up to 72 percent price savings compared to the pay as you go pricing and these reservations are flexible and can easily be exchanged or returned
for an early termination fee you can prefer this option if the vm has to run continuously or you need to budget predictability and you can commit to using this vm for at least a year let's understand the nextplanning method it's all about virtual machine sizing once you have the name and the location set you need to decide on the size of your virtual machine rather than specify processing power memory storage capacity independently azure provides differentvm sizes that offers variations of these elements in different sizes and azure provides a wide range of vm size options allowing you to select the appropriate mix of compute memory and storage for what you want to do sothe best way to determine the appropriate vm size is to consider the type of workload your vm needs to run based on the workload you would be able to choose from a subset of available vm sizes some of
the workloads are classified as general purpose compute optimized memory optimized storage optimized gpu and high performance compute and you can find different family sizes for each of these different types of vm type and if you are wondering howto resize your virtual machine so let me show you how you can resize a virtual machine i am in my azure portal selecting an existing virtual machine under settings you can find size within size as you notice ifmy vm is on b2 ms i can go back to size and select any other size which is available over here if i want more option i can click on see more sizes and select a vm which iwould like to resize this vm to and click on this resize option azure allows you to change the vm size when the existing size no longer meets your need you can resize the vm as long as your current
hardware configuration is allowed in the new size this provides a fully agile and elastic approach to the vm management if you stop and de-allocate the vm you can then select any size available in your region please note thatbe cautious when resizing production vms they may need to be rebooted which can cause a temporary outage and change some configuration settings such as the ip address another planning we need to consider in our mind is about virtualmachine disk every virtual machine has one attached operating system disk the os disk has a pre-installed os which was selected when the vm was created the disc has the maximum capacity of two terabytes it's registered as a satadisk and labeled as c drive by default and every vm contains a temporary disk as well which is not a managed disk so let's understand what is temporary disk the temporary disk provides short-term storage for applications and processes
and is intended to only store data such as a page or swap files data on the temporary disk may be lost during a maintenance event or when you redeploy a vm during a standard reboot of the vm thedata on the temporary disk should persist however there are cases where the data may not persist such as moving to a new host therefore any data on the temp drive should not be the data that is critical tothe system then there is data disk a data disk is a managed disk that is attached to the virtual machine to store application data or other data you need to keep data disks are registered as kc drives andare labeled with the letter that you choose each data disk has a maximum capacity of 4 terabytes the size of the virtual machine determines how many data disk you can attach to it and the type of storage you
can use to host the disk let's understand the azure virtual machine storage options azure premium storage delivers high performance low latency disk support for virtual machines with io intensive workloads the vm disks that use premium storage store dataon a solid-state drive which is ssds to take advantage of the speed and performance of the premium storage disk you can migrate existing disk to a premium storage in azure you can attach several premium storage disk to avm using multiple disk gives your application up to 256 terabytes of storage per vm with premium storage your application can achieve up to 80 000 i o operations per seconds per vm and the disk throughput of up to2000 megabytes per seconds per vm even though managed disks are the only one which is supported let's talk about what is unmanaged disk the original method is to use unmanaged disk in an unmanaged disk you can manage the
storage account that you use to store the virtual disk files that compressed of your vm disk vhd files are stored as page blob in the azure storage account so now you don't have to worry about it just learnabout what is managed disk and azure manage disk is a virtual hard drive you can think of it's like a physical disk in an on-premises server but virtualized and azure managed disks are stored as page blobs which area random i o storage object in azure we call a manage disk managed because it is an abstraction over page blobs blob containers and azure storage accounts with managed disk all you have to do is provision the diskand azure takes care of the rest for the best performance for your application we recommend that you migrate any vm disk that requires higher aops to premium storage and please note that managed disks are required for a single
instance virtual machine sla of 99.95 let's talk about the supported operating system azure provides a variety of operating system images that you can install into your vms so let me show you what are the operating system available ona high level i'm going to create a new virtual machine and if i scroll down to images this is where you can see all the available operating systems and you can browse for all public and private images herethis is including several versions of windows and flavors of linux if you are looking for more than just base operating system you can search the azure marketplace for more sophisticated install images that include the os and popular softwaretools installed for a specific scenarios for example if you need to choose a new wordpress site the standard technology stack would consist of a linux server apache word server a mysql database and php instead of setting up and
configuring each component you can leverage a marketplace image and install the entire stack at once finally if you can't find a suitable operating system image you can create your disk image with what you need and upload it toazure storage and use it to create an azure vm please keep in mind that azure only supports 64-bit operating systems so before we move on let's understand the windows server software licensing and linux server software licensing model allmicrosoft software that's included in the azure virtual machine environment must be licensed correctly by default virtual machines include a license for many common products including microsoft server microsoft exchange sql server sharepoint server etc certain virtual machine offering mayinclude additional microsoft software on a per hour or evaluation basis and licenses for other software's must be obtained separately please note that microsoft do not support an upgrade of windows operating system of a microsoft azure virtual machine instead
you should create a new virtual machine that is running the supported version of the operating system that is required and then migrate the workload and azure supports many linux distributions and versions including centos by open logic core osdebian oracle linux red hat enterprise linux and ubuntu please note that linux indoors distribution support and upgrade of the operating system of a microsoft azure virtual machine in case of a full open source license if license specific distributionis used then follow partner specific rules to upgrade bring your own license or other and let's understand the virtual machine connections there are several ways to access virtual machine in azure for a windows based virtual machine you willuse the remote desktop client to connect to the windows based vm host on azure most versions of windows natively contains support for the rdp to connect to a linux based vm you need a secure shell protocol ssh client
for example pati which is a free and open source terminal emulator serial console and network file share application but he supports several network protocols including scp ssh telnet r logon and raw socket connection it can also connect toa serial port please note that how to connect to rdp and ssh will be covered more in detail in the coming videos another way of connecting to azure machines using bashed in connections the azure bastion service is anew fully platform managed pass service that you provision inside your virtual network once you go inside a virtual machine under operations you can find bastion there and bastion provides secure and seamless rdp or ssh connectivity to your virtualmachines directly in the azure portal over ssl when you connect via azure bastion your virtual machine do not need a public ip address and bastion provides secure rdp and ssh connectivity to all vms in the virtual network using
azure bastion rotates your virtual machine from exposing rdp or ssh port to the outside world while still providing secure access using rdp and ssh with azure bastion you connect to virtual machine directly from your azure portal you don't
Walks through the portal steps for creating Windows and Linux virtual machines. Also explains Linux authentication with SSH keys and the use of Azure Bastion for secure access.
need an additional client agent or a piece of software so that concludes the first lesson of the module 8 which is all about azure virtual machine in this video we're going to talk about creating virtual machines let's havea high level look at the things what we're going to talk about in this video we're going to talk about creating virtual machines in the azure portal and what is a windows virtual machine and how to connect toa windows virtual machine same thing for linux virtual machine and linux virtual machine connections and while i'm explaining about each of these topics i will take you back and forth between this azure portal and the presentation so youexactly know what i'm talking about so when you are creating virtual machine in the portal one of the first decisions is the image you use and azure supports windows and linux operating systems and there are server and client
platforms available within azure so let me take you through the portal to show you what are the things you need to fill before creating a virtual machine i'm on my azure portal you can click on either create aresource and start from there or you can go to virtual machine and click on add a new virtual machine to create your first virtual machine first select your subscription then create a resource group or select an existing resourcegroup i'm going to select an existing resource group the next step is to provide a name so i provided a name for my virtual machine and we talked about naming convention in the previous video and select an appropriateregion where you want to host this virtual machine ideally closer to where the user is going to access we will talk about the availability option in the next video so please ignore that part at the moment then we
have different images to choose from and the size of the virtual machine we talked about how to select the size in the previous video as well and there are multiple ways you can connect it you can either usessh or rdp so i'm going to select a windows virtual machine now because it is windows the option to connect is either rdp or azure bastion and provide the username and password once you fill the basic details ifyou happen to on premises software assurance license you can select azure hybrid usage benefit and this will give you savings on your licensing if not don't select that so that is the basic page the next page is allabout disk this is where you would select the type of the disk you want to attach to your virtual machine you have options from a normal hard disk your standard and a premium high fast this you can define
the encryption type and you have an ability to modify the disk type the next tab is all about virtual network where would you like to place this virtual machine so you can create these details beforehand before selecting yourvirtual machine or by default this window will provide you a standard default option so you can verify that and you can proceed to the next page management tab will give you option for monitoring auto shutdown and backup aswell if you do want to automatically shut down your vm on a specific time you can mention that over here and you can enable the backup as well that will give you an ability to create a recovery servicesvault we will learn about the recovery services vault and azure backup in the future videos in detail then we have an option to modify the guest operating system as well this is where you will be able to add
additional configuration agents scripts or applications via virtual machine extensions or cloud in it and you have an ability to add a tag for your resources as well once you complete all this detail you click on review and createthe first process is the azure checks if the information what you're provided is adequate for creating the first virtual machine once you get the green tick box you click on create to create your first windows virtual machine sowhen you are creating virtual machine in the portal one of the first decisions is the image you use and azure supports windows and linux operating systems and there are server and client platforms available within azure so let metake you through the portal to show you what are the things you need to fill before creating a virtual machine i'm on my azure portal you can click on either create a resource and start from there or you
can go to virtual machine and click on add a new virtual machine to create your first virtual machine first select your subscription then create a resource group or select an existing resource group i'm going to select an existingresource group the next step is to provide a name so i named my vm as devvm so i provided a name for my virtual machine and we talked about naming convention in the previous video and select an appropriateregion where you want to host this virtual machine ideally closer to where the user is going to access we will talk about the availability option in the next video so please ignore that part at the moment then wehave different images to choose from and the size of the virtual machine we talked about how to select the size in the previous video as well and there are multiple ways you can connect it you can either use
ssh or rdp so i'm going to select a windows virtual machine now because it is windows the option to connect is either rdp or azure bastion and provide the username and password once you fill the basic details ifyou happen to have on-premises software assurance license you can select azure hybrid usage benefit and this will give you savings on your licensing if not don't select that so that is the basic page the next page is allabout disk this is where you would select the type of the disk you want to attach to your virtual machine you have options from a normal hard disk to a standard and a premium high fast you can definethe encryption type and you have an ability to modify the disk type the next tab is all about virtual network where would you like to place this virtual machine so you can create these details beforehand before selecting a
virtual machine or by default this window will provide you a standard default option so you can verify that and you can proceed to the next page management tab will give you option for monitoring auto shutdown and backup aswell if you do want to automatically shut down your vm on a specific time you can mention that over here and you can enable the backup as well that will give you an ability to create a recovery servicesvault we will learn about the recovery services vault and azure backup in the future videos in detail then we have an option to modify the guest operating system as well this is where you will be able to addadditional configuration agents scripts or applications why i have virtual machine extensions out cloud in it and you have an ability to add a tag for your resources as well once you complete all these detail you click on review
and create the first process is the azure checks if the information what you're provided is adequate for creating the first virtual machine once you get the green tick box you click on create to create your first windows virtualmachine to manage an azure windows vm you can use same set of tools that you have used to deploy it however you will also want to interact with the operating system running within the vm so you have variousmethods available either using rdp or windows remote management or bastion service the next one is linux virtual machine creating a linux virtual machine is exactly similar to how you create a windows server except that you choose the imageas a linux virtual machine of your choice and to interact with your linux operating system you choose ssh so you come and select the inbound port as ssh and you use a tool you can use either bastion or
party or ssh connectivity to connect and interact with your vm and azure supports many linux distribution and versions including centos core os debian oracle linux red hat and ubuntu so let's understand some of the things you need toknow about linux distribution there are hundreds of linux images in the marketplace linux has the same deployment option as the windows virtual machines you can use either powershell portal or command line interfaces you can manage your linux virtualmachine with a host of popular open source devops tools such as puppet and chef so let's talk about the ssh connection ssh is an encrypted connection protocol that allows secure sign-ins over unsecured connections ssh is the default connectionprotocol for linux vms hosted in azure although ssh itself provides an encrypted connection using password with ssh connection still leaves the vms vulnerable to brute force attack or guessing of passwords a more secure and preferred method of connecting
the vm using ssh is by using a public private key pair also known as ssh keys the public key is placed on your linux vm or any other service that you wish to use with the public creek withthe public key cryptography and the private key remains on your local system which protects the private key and you do not have to share it when you use an ssh client to connect to your linux vm the remotevm is the client to make sure that it processes the private key if the client has the private key it's granted access to the vm please note that azure currently requires at least 2048 bit key length and the
Explains maintenance types, availability sets, fault and update domains, and availability zones. Then covers vertical and horizontal scaling, VM scale sets, and autoscale rules.
ssh rsa format for public and private keys so that concludes the create a virtual machine part of this azure module which is all about azure virtual machine in this video we're going to learn about virtual machine availability let'shave a high level view on what are the things we're going to learn on this lesson we will start with different types of maintenance and downtime and what you need to be aware of when you think about unplannedhardware maintenance and unexpected downtime then we will dive deep into different types of availability sets what is an update and fall domain and what is this azure availability zone then we will learn about the scaling concepts skill setand implementing different types of skill sets and when it comes to scalability we need to understand the auto scaling capability as well so how can we implement the auto scale so when i'm explaining about each of these concepts
i will take you back and forth the azure portal and the presentation so exactly know what i mean by these so without wasting any more time let's get into it so let's start with understanding what's the main differencebetween maintenance and downtime as an azure administrator you must be prepared for planned and unplanned failures there are three scenarios that can lead to your virtual machine in azure being impacted unplanned hardware maintenance unexpected downtime and planned maintenanceso let's talk about these three concepts in detail the first concept is unplanned hardware maintenance and unplanned hardware maintenance even occurs when the azure platform predicts that the hardware or any platform component associated to a physical machine isabout to fail when the platform predicts a failure it will issue an unplanned hardware maintenance event azure uses live migration technology to migrate the azure virtual machines from the failure hardware to a healthy physical machine live migration is
a vm preserving operation that only passes the virtual machine for a short time but performance might be reduced before and or after the event so let's learn about unexpected downtime unexpected downtime is when the hardware or the physicalinfrastructure for the virtual machine fails unexpectedly this can include local network failures local disk failures or other rack level failures when detected the azure platform automatically migrates your virtual machine to a healthy physical machine in the same datacenter during the healing procedure virtual machines experience downtime and in some cases loss of temporary drive and the last one is plant maintenance plan maintenance events are periodic updates made by microsoft to the underlying azure platform to improveoverall reliability performance and security of the platform infrastructure that your virtual machines run on most of these updates are performed without any impact upon your virtual machine or cloud services please note that microsoft does not automatically update your
virtual machine operating system or software you have complete control and responsibility for that however the underlying software host and hardware are periodically patched to ensure reliability and high performance at all times let's understand about availability sets an availabilityset is a logical feature used to ensure that a group of related virtual machines are deployed so that they aren't all subjected to a single point of failure and not all upgraded at the same time during a hostoperating system upgrade in the data center virtual machines placed in an availability set should perform an identical set of functionalities and have the same software installed azure ensures that the vms you place within an availability set run acrossmultiple physical servers compute racks storage unit and network switches if a hardware or software feature failure occurs only a subset of your vms are impacted and your overall application stays up and continues to be available to your customers
and the availability sets are an essential capability when you want to build reliable cloud solutions when creating an availability set keep these principles in your mind for redundancy configure multiple virtual machines in availability set and configure each applicationtier into separate availability sets and combine a load balancer with availability sets and use managed disk with the virtual machines so we need to understand the service level agreements as well for all virtual machines that have two ormore instances deployed in the same availability set microsoft guarantee you will have virtual machine connectivity to at least one instance at least 99.95 of the time and for any single instance virtual machine using premium storage for all operatingsystem disk and data disk microsoft guarantees that you will have virtual machine consistency of at least 99.9 percent please note that you can create a virtual machine and an availability set at the same time a vm can only
be added to an availability set when it is created to change the availability set you need to delete and then recreate the virtual machine let's understand the update and fault domains and update domain allows azure to perform incrementalor rolling upgrades across the deployment each of the domain contains a set of virtual machines and associated physical hardware that can be updated and rebooted at the same time during plan maintenance only one update domain is rebooted ata time by default there are five update domains but you can configure up to 20 update domains next concept we need to understand is fault domain a fault domain is a group of nodes that represent a physical unitof failure a fault domain defines a group of virtual machine that share a common set of hardware switches that share a single point of failure for example a server rack serviced by a set of power or network switches
virtual machines in and availability sets are placed in at least two fault domains this mitigates against the effects of hardware failures network outages power interruptions or software updates think of fault domain as nodes belonging to a same physicalrack think of fault domain as nodes belonging to the same physical rack please note that placing your virtual machine into an availability set does not protect your application from operating system or application specific failures for that you needto review other disaster recovery and backup techniques let's learn about availability zones availability zones is a high availability offering that protects your application and data from data center failures some of the consideration while thinking about availability zones areavailability zones are unique physical locations within an azure region each zone is made up of one or more data centers equipped with independent power cooling and networking to ensure resiliency there are minimum of three separate zones in all
enabled regions the physical separation of availability zone within a region rotates application and data from data center failures the zone redundant service replicates your applications and data across availability zone to protect from single point failure with availability zonesazure offers industry best which is 99.99 vm sla uptime let's understand the scaling concepts generally there are two types of scaling vertical scaling and horizontal scaling let's talk about vertical scaling first vertical scaling also known as scale upand scale down means increasing or decreasing virtual machine sizes in response to a workload vertical scaling makes virtual machines more or less powerful vertical scaling can be helpful when a service built on virtual machine is under utilized forexample at weekends reducing the virtual machine size can reduce monthly cost another useful scenario is increasing virtual machine size to cope up with the large demand without creating additional virtual machines the second concept is horizontal scaling horizontal scaling
also referred to as scale out and scaling where the number of vms is altered depending on the workload in this case there is an increase or decrease in number of virtual machine instances vertical scaling also usually requires avirtual machine to stop and restart horizontal scaling is generally more flexible in a cloud situation and it allows you to run potentially thousands of virtual machine to handle load reprovisioning means removing an existing virtual machine and replacing itwith a new one let's understand what is scale sets virtual machine scale sets are an azure compute resource you can use to deploy and manage a set of identical vms with all vms configured the same vm scale setsare designed to support true auto scale no pre-provisioning of vmc is required and as such make it easier to build large-scale services targeting big compute big data and containerized workloads so as demand goes up more virtual machine instances
can be added and as debug goes down virtual machine instances can be removed as well this process can be manual or automated or combination of both some of the benefits of vm scale sets are all vm instances canbe created from a same base operating system image and configuration and skill set supports use of azure load balancer for basic level 4 traffic distribution and azure application gateway for more advanced layer 7 traffic distribution and ssl terminationand skill sets are used to run multiple instances of your application so if one of those vm instances has a problem customers continue to access your application through one or the other vm instances with minimal interruption customer demandfor your application may change throughout the day or week to match customer demand scale sets can automatically increase the number of view instances as application device increases and reduce the number of vm instances as debt decreases this is
known as auto scale and the scales that support up to 1000 vm instances so if you create and upload your own custom bab pages the limit is 300 bm instances so let me show you how you can implementthe vm scale set i'm going by azure portal search for virtual machine scale set in the global search box and select that as you can see that i don't have any vm scale set at the moment i'm goingto create one so the default look and feel is similar to how you create a vm instead of naming your virtual machine you name your virtual skill set name and the instance details the main difference what you seeis over scaling this is where you have an ability to add initial instance code this is the number of virtual machine in the scale set it can have up to 1000 vms and instant size is where you decide
the base size of your virtual machine so let's understand what is azure spot instance low priority vms are allocated from microsoft azure xs compute capacity enabling several types of workload to run for a significantly reduced cost then youhave the same ability to add the same managed disk or under your disk and then you can enable the scaling methods as well and you can choose the algorithm so microsoft recommends deploying with maximum spreading for most workloadas this approach provides the best spreading in most cases an isu virtual machine scale set can automatically increase or decrease the number of vm instances that run your application this means that you can dynamically scale to meet thechanging need and i'm sure all of you know the benefits of auto scaling right so you can use auto scaling for automatically adjust the capacity you can scale out or scale in you can schedule events like scheduling events
to automatically increase or decrease the capacity of your skill set at fixed times and it is generally less overhead as well overall it reduces the management overhead to monitor and optimize the performance of your application please note thatthe auto scale minimizes the number of unnecessary vm instances that run your application when demand is low while customers continue to receive an acceptable level of performance as demand grows and additional vm instances are automatically added so let'sunderstand how do you implement this auto scale when you create a scale set you can enable the auto scale as well you should also be defining a minimum and maximum and a default number of vm instances so whenyou auto scale rules are applied these instant limits make sure that you do not scale out beyond the maximum number of instance or scale it beyond the minimum number of in the scale out cpu threshold the scale out
cpu threshold gives you an ability to put the cpu usage percentage threshold for triggering the scale out auto scale rule then you have rules like number of vms to increase by this gives an ability that the number ofvirtual machine to add to the scale set when the scale out auto scale rule is triggered then we have the scale in rule as well the cpu usage percentage threshold for triggering the scale in auto scale rule andsimilarly the number of vms to decrease by will give you an ability to reduce the number of virtual machine to remove the scale set when the scale and auto scale rule is triggered all right so that concludes lesson
Introduces VM extensions and how they automate post-deployment configuration. Covers custom script extensions and Desired State Configuration for managing Windows and Linux VMs.
two of module eight and this lesson we're going to talk about virtual machine extensions let's have a look at the things what we are going to learn on this video we will learn about what are azure virtual machineextensions how to create and configure the custom script extensions how do you define the desired state configuration for azure virtual machines and when i talk about all these concepts i will take you back and forth between these presentationand the azure portal so you exactly know what i mean by these so what are azure virtual machine extensions creating and maintaining virtual machines can be a lot of work and much of it is repetitive requiring the samesteps each time fortunately there are several ways to automate the task of creating maintaining and removing virtual machines one way is to use virtual machine extension as your virtual machine extensions are small applications that provide post deployment configuration
and automation task on azure vms let me quickly show you where you can find these extensions i'm on my azure portal i'm going to click on virtual machines select an existing virtual machine right under settings you would beable to find extensions you can click on add to add a new extension for example if a virtual machine requires software installation anti-virus protection or configuration script inside a vm extension can be used extensions are all about managingyour virtual machines azure vm extensions can be managed with azure cli powershell azure resource manager template and azure portal azure extensions can be bundled with a new vm deployment or run against any existing systems as well for examplethey can be part of a larger deployment configuring applications on vm provision or run against any support and extension operating systems post deployment so these are different extensions for windows and linux machines and have a large choice of
first and third party extensions in this video i will focus on two extensions custom script extensions and desired state extensions both tools are based on powershell let's talk about the custom script extensions custom script extension or csc canbe used to automatically launch and execute virtual machine customization task post configuration your script extension may perform very simple task such as stopping the virtual machine or installing a software component however the script could be more complex andperform a series of tasks you can install the csc from the azure portal by accessing azure virtual machine extension blade so let me show you how to do that so i'm on my azure portal i'm going to selectan existing virtual machine just like we selected before i'm going under settings select extensions you can see that i already have one extensions added i'm gonna add one more extension this time i'm gonna search for microsoft custom script
extension select that and click on create once the cac resource is created you will provide a powershell script file your script file will include the powershell commands you want to execute on the virtual machine optionally you can passin arguments once the file is uploaded it executes immediately and the script can be downloaded from azure storage or github as well or provided to the azure portal at extension runtime some of the considerations while performing the customscript extension are timeout dependencies failure events and sensitive data these custom script extensions have 90 minutes to run if your deployment exceeds this time it is marked as timeout keep this in mind that when you are designing yourscript and of course your virtual machine must be running to perform this task when it comes to dependencies for cse if your extension requires networking or storage access make sure that content is available and finally consider about sensitive
data as well your extension may need sensitive information such as credentials storage account names and storage account access keys so when you create the script how will you protect or encrypt this information so think about that for aminute let's learn about the desired state configuration the desired state configuration or it is known as dse dsc is a management platform in windows powershell that enables deploying and managing configuration data for software services and managing the environmentin which these services run the dac provides a set of windows powershell language extensions windows powershell commandlets and resources and that you can use to declaratively specify how you want your software environment to be configured it also providesa means to maintain and manage existing configurations the dse centers around creating configurations a configuration is easy to read script that describes an environment made up of computers which is notes with specific characters with specific characteristics these characteristics
can be as simple as ensuring a specific windows feature is enabled or as complex as deploying sharepoint use desired state configuration when the cse will not work for your application in this example we are installing iis on thelocal host the configuration will be saved as a dot ps1 file and notice that the dac script consists of the configuration block the node block and one more resource block configuration block is the outermost script block so youdefine it by using configuration keyword and providing a name in this instance iis install in the node block this defines the node or computers or vms that you are configuring in this configuration this is on the node thisis one node block that targets the computer that is called localhost in the resource block this is where the configuration sets the properties of the resources that it is configuring in this case there is one resource block that
uses windows feature windows feature indicates the name of the role or feature that you want to ensure is added or removed ensure indicates if the role or the feature is added and your choice are present and absent pleasenote that windows powershell dse comes with a set of built-in configuration resources for example file resource log resource and user resource so you have successfully completed module 8 and we learned everything we want to know for the azn104
Reviews questions on availability sets, cost-saving VM choices, Linux authentication, DSC support, autoscale, tier placement, and Azure Bastion. Reinforces the virtual machine module.
exam in terms of azure virtual machines in this video we're going to go through the review questions on what we have learned on the previous lessons let's look at the question number one you host a service with twovirtual machines you discover that occasional outages cause your service to fail what two actions can you do to minimize the impact of the outages you need to select to answer to complete the whole part of the solution sowhat are the two solutions you can pick from the below which can minimize the impact of the outages what you are having right now is it adding a third instance of the virtual machine definitely not adding a newvirtual machine is going to add more resources to your whole solution that is not going to resolve the outage problem is it to add a network gateway definitely not network gateway is either for a vpn solution or immediate
peering put the virtual machine in a scale set definitely not putting a virtual machine in a scale set will give you an auto scale capability so the correct answer is add a load balancer and put the virtual machinein an availability set so to minimize the impact put the virtual machine in an availability set and add a load balancerlet's look at question number two you are researching microsoft azure for your company the company is considering deploying windows based vms in azure however before moving forward the management team has asked you to research the cost associated withthe azure vm you need to document the configuration options that are likely to save the company money on their azure vms which option should you document and each answer present part of the solution and we need to select4 to complete the whole solution so i'm going to read out each statement to pick the right option which can help us save the money on the windows vm which this particular company is going to use all right
so first statement is use hard disk or hdd instead of solid state drive absolutely so if you i'm not sure that is going to be a wise choice it's absolutely depending on the application type what you're using butif you use hard disk instead of ssd you can reduce this cost use unmanaged premium storage instead of manage standard storage that is not going to make any difference premium storage is basically same cost even if you useunmanaged or managed bring your own windows custom images that is not going to reduce any cost if you bring your custom image you are still paying for the license use different azure regions absolutely correct so not all azureservices are priced same on all azure regions some regions have lower priced year so please make sure to check that when you deploy a solution use the least powerful vms that meet your requirement absolutely correct so sometimes by
choosing the right vm is the way forward not by having the most or well powered virtual machine for your workload always keep an eye on azure monitor or azure metrics to check if you are utilizing the vm atthe optimal level place all vms in the same resource group no placing all vm in the same resource group will give you a same life cycle bring your own windows license for each vms absolutely correct so this iscalled azure hybrid usage benefit so if you bring your own license microsoft will give you up to 49 discount on your virtual machine cost so on this scenario you will need to document which of these options presented arelikely to save company money for the azure vms so in this scenario we all learned different ways of saving money on azure vmslet's look at question number three you're planning to deploy several linux vms in azure the security team issues a policy that linux vms must use an authentication system other than passwords you need to deploy an authentication method for
the linux vm to meet the requirement which authentication method should you use you need to select one option from here so it is definitely not secure wall certificate that is for different solution shared access signature is for yourstorage account so that is not the right answer access keys are again for your storage account so that's not the right answer multi-factor authentication is for securing your user accounts or identities so that's not the right answer sothe correct answer is ssh key pair azure support two authentication methods for linux vms passwords and ssh access keys and shared access signature are the access method for azure storage not for azure vms let's look at question numberfour your company has windows server 2012 r2 vms and ubuntu linux vms in microsoft azure the company has a new project to standardize the configuration of servers across the azure environment the company opts to use desired state configuration
or dse across all vms you need to ensure that dse can be used across all the vms what two things should you do select two so is it gonna be solved by replacing the ubuntu vm with the redhat vms definitely not is it by deploying dac extension or windows server vm absolutely correct and at the same time because you have windows server and ubuntu vms you need to deploy dse extension for linux vms as wellso the dac is available for windows server and linux based vms in this scenario you just need to deploy the extension to the existing vm to start using dse let's look at question number five another it administrator createsan azure virtual machine scale set with five years later you notice that vms are all running at maximum capacity with cpu being fully consumed however additional vms are not deployed in the scale set you need to ensure that
additional vms are deployed when the cpu is 75 consumed so what should you do select one so is it by deploying the scale set automation script absolutely not is it by adding skill set automation script to the libraryagain it's a completely wrong solution can you increase the number of cloud yep you can increase it but that is not going to resolve the issue all you have to do is enable the auto scale option when youhave a skill set you can enable automatic scaling with the auto scale option when you enable this option you define the parameters of when to scale to meet the requirement of this scenario you need to enable the autoscale option so that additional vms are created when the cpu is 75 please note that the automation script is used to automate the deployment of the skill set and not related to automating the building of additional vmc the
skill set
your company is deploying a critical business application to microsoft azure the uptime of the application is of at most importance the application has the following components two web server two application servers two database servers you need to designthe layout of the vms to meet the following requirements each vm in a tier must run on different hardware another requirement is uptime of the application must be maximized so you need to deploy the vms to meet therequirements so what should you do and we need to select one easy to deploy one vm from each tier into one availability set and re and reminding vm to the separate availability set definitely not that defeats the wholepurpose what we are trying to achieve deploy the vms from each tier into a dedicated availability set for the tier absolutely correct an availability set should hold vms in the same tier because that ensures that the vms are
not dependent on the same physical hardware if you deploy vms in a single tier across multiple availability sets then you have a chance of a tier becoming unavailable due to a hardware issue in this scenario each tier shouldhave a dedicated availability set which is web availability set and app availability set add a database availability set let's look at the last question of this module your organization has a security policy that prohibits exposing ssh ports tothe outside world you need to connect to the azure linux virtual machine to install software what should you do and select one we learned about this when we talked about different ways of connecting to a virtual machine ifit is a windows machine you can connect via rdp and bastion for a linux machine you can connect via ssh and bashed in service as well so the correct answer is bastion service azure bastion service is a new
fully platform managed pass service that you provision inside your virtual network it provides secure and seamless rdp and ssh connectivity to your virtual machines directly in your azure portal or ssl when you connect via azure bastion your virtualmachines do not need a public ip address and bastion provides secure rdp and ssh connectivity to all vms in virtual network in which it is provisioned using azure bastion protects your virtual machine from exposing rdp and ssh portto the outside world while still providing secure access using rtp and ssh with the azure bastion you connect to the virtual machine directly from the azure portal you don't need an additional client agent or a piece of hardware
Introduces Azure App Service plans, pricing tiers, and how apps share compute resources. Also explains scale up, scale out, and autoscale rules for app service plans.
or software so that concludes module 8 and module 8 review questions we are starting a brand new module in this video it's all about serverless computing and the first lesson we are going to learn out of serverless computingis about azure app service plans let's have a look at the high level topics we are going to discuss during this video people learn about azure app service plans what are the different pricing tiers available within the appservice plans how do you scale these plans and what are the scale out options when i'm discussing about each concept i will take you back and for the azure portal and the presentation so you exactly know what i'mtalking about in app service an app runs in an app service plan an app service plan defines a set of compute resources for a web apron these compute resources are analogous to the server form in conventional web hosting
one or more apps can be configured to run on same computing resources first of all let me show you how to create an app service plan i'm on my azure portal i'm gonna search for app service so clickon app service plans as you can see that i don't have any at the moment click on create an app service plan by default you have to select the subscription and create or select an existing subscription and basicallyprovide the name of your app service plan when you create an app service plan in a certain region for example central u.s a set of compute resources is created for that plan in that region whatever app you putinto the app service plan runs on these compute resources as defined by your app service plan each app service plan defines the region the number of vm instances the size of vm instances etc we need to understand how
the app runs and scales in the free and shared tiers an app receives cpu minutes on shared vm instances and cannot scale out in the other tiers app runs and scales as follows when you create an app inapp service it is put into an app service plan when the app runs it runs on all vm instances configured in the app service plan if multiple apps are the same app service plan they all share the samevm instances if you have multiple deployment slots for an app all deployment slot also run on same vm instances if you enable diagnostic logs perform backups or run web jobs they also use cpu cycles and memory on thesevm instances in this way the app service plan is the scale unit of the app service apps if the plan is configured to run five virtual machine instances then all apps in the plan run on all five instances
if the plan is configured for auto scaling then all apps in the plan are scaled out together based on the auto scale settings some of the consideration of creating the app service plans are you can potentially save moneyby putting multiple apps into one app service plan you can continue to add apps to an existing plan as long as plant has enough resources to handle the load however keep in mind that apps in the same appservice plan all share the same compute resources to determine whether the new app has the necessary resources you need to understand the capacity of the existing app service plan and the expected load of the new app overloading anapp services plan can potentially cause downtime for your new and existing apps we need to understand the app service plan pricing tiers the pricing tier of an app service plan determines what app service feature you get and how
much you pay for this plan so let's look at this plan individually we have free shared basic standard premium and isolated plans let's talk about the free and shared together the free and shared service plans are base tiersthat run on same azure vms as other apps some apps may belong to other customers these tiers are intended to use only for development and testing purposes there is no sla provided for free and shared service plans andfree and shared plans are metered on a per app basis let's talk about the basic plan the basic service plan is designed for apps that have lower traffic requirements and doesn't need advanced auto scale and traffic management featurespricing is based on the size and number of instances you run built-in network load balancing support automatically distribute traffic across these instances the basic service plan with linux runtime environment support web app for containers so what about this
candidate plan this candidate service plan is designed for running production workloads rising is based on the size and the number of instances you run built-in network load balancing support automatically distribute traffic across in instances and the standard planincludes auto scale that can automatically adjust the number of virtual machine instances running to match your traffic needs the standard service plan with linux runtime environment support web app for containers all right so let's have a look atthe premium plan the premium service plan is designed to provide enhanced performance for production apps the upgraded premium plan or premium version 2 features dv2 serious vms with faster processors ssd storage and double memory to core ratio comparedto the standard one the new premium plan also support higher scale via increased instance count while still providing all the advanced capabilities found in the standard plan the first generation of premium plan is still available for existing customers
scaling needs all right so let's look at the last one which is isolated model the isolated service plan is designed to run mission-critical workloads that are required to run in a virtual network the isolated plan allows customers torun their apps in a private dedicated environment in an azure data center using a db2 series vm with faster processors ssd storage and double the memory to core ratio compared to the standard the private environment used with anisolated plan is called app service environment the plant can scale up to 100 instances with more available upon request let's have a look at the different types of app service plan scaling methods there are two workflows for webapp scaling scale up and scale out apps can be scaled manually or automatically let's have a look at where you can do that about my azure portal you can click on app service plans and select the app service
plan you created under settings under networking you can find scale up and scale out the scale up get more cpu memory disk space and extra features like dedicated virtual machine vms custom domain names and certificates and staging slotsauto scaling and more you can scale up by changing the pricing tier of the web app plan that your app belonged to scale out gives you increase the number of vm instances that run your app you can scaleout as many as 30 instances depending on your pricing tier app service environments in isolated tier further increases your scale out count to 100 instances auto scale is based on pre-defined rules and schedules let's understand the app serviceplan scale out let me take you to the azure portal and show you where you can find that about my azure portal and select the app service plan i created just for this demo under settings we were talking
about scale up i just changed the pricing tier to reflect some modification on the scale out plan click on scale out this is where you get to modification manual scale and custom auto scale auto scale allows you tohave right amount of resources running to handle the load on your application it allows you to add resources to handle increase in load and also save money by removing resources that are sitting idle you specify a minimum andmaximum number of instances to run and add or remove vms automatically based on set of rules when rule conditions are met one or more auto scale actions are triggered so let's look at the auto scale settings an autoscale setting is read by the auto scale engine to determine whether to scale up or down and auto skill settings are grouped into profiles this rule may trigger and scale action up or down this rules include metric based
and time-based triggers the metric based rules measure application load and add or remove vms based on that load for example do this action when the cpu usage is about 50 example of a metric are cpu time average responsetime and request and then there is time based timer based or schedule based rules allow you to scale when you see time patterns in your load and want to scale before a possible load increase or decrease occurs forexample trigger a web hook every 8 a.m on saturday in a given time zone all right so that concludes the app service plan on the serverless computing module in this lesson we're going to learn about azure app services
Explains why to use Azure App Service and how to create an app service in the portal. Covers continuous deployment, deployment slots, slot swapping, and auto-swap behavior.
let's have a look at the things what we're going to learn on this lesson we will learn about what is azure app service and what are the reasons for you to use azure app service then i will takeyou through the portal to show you how to create an app service and what is continuous deployment we will learn about deployment slot and creating deployments load as well and in terms of how do you secure your appservice and we will learn about how to add a custom domain name to your applications and after you create your app service so it is important for us to understand how to backup an app service and monitor yourapp service using application insights when i'm explaining about each of these topics i will take you back and forth between the presentation and the azure portal so you exactly know what i am talking about azure app service brings
together everything you need to create websites mobile backends and web apps and web apis for any platform or device application run and scale with ease on both windows and linux based environments so within azure app services there aremany deployment choices so before we move forward let's understand the reasons to use azure app service the first reason is azure app service provide multiple languages and frameworks so app service has first class support for asp.net java rubynot js php or python you can also run powershell and other scripts or executables as background services the second reason to use app service is devops optimization you can set up continuous integration and deployment with azure devops githubbitbucket docker hub or azure container registry and you can promote updates through test and staging environments as well you can manage your apps in app service by using azure powershell or cross-platform command line interface another reason to use
app service is global scale with high availability you can scale up or out manually or automatically we have seen an example of this in the last video you can host your apps anywhere in the microsoft global data centerinfrastructure and the app service sla promises high availability and the fourth reason to use the azure app service is connections to sas platforms and on-premises data you can choose from more than 50 connectors for enterprise systems such assap sas services such as salesforce and internet services such as facebook another reason for using app service is the application templates you can choose from an extensive list of application templates in the azure marketplace such as wordpress joomladerple etc let's understand one more reason to use app service before we go and learn how to create an app service app server is run on serverless code you can run a code snippet or script on demand without
having to explicitly provision or manage infrastructure and pay only for the compute time your code actually uses so please note that az 104 azure administrator certification focus only on implementation task not in depth so let's learn about creatingan app service when creating an app service you will need to specify a resource group and a service plan let me quickly take you to the azure portal and show you exactly how it has been done bought byazure portal now you can search for app service in the global search box and select the app services as you can see that i don't have any app services at the moment click on add app services pick thesubscription where you want to host the app service create a new resource group or select an existing resource group and give a name to your app service the name must be unique and will be used to locate your
app you can map a custom domain name if you prefer to use that instead then to publish the app service can host either a code or a docker container the software stack can run the app including the languageand sdk versions for linux app and custom container apps you can also set up an optional startup command or file choices include dot net core dot net framework node.js php python and ruby various version of each are availablethen you have your operating system choice it can be either linux or windows and then choose your region under region your choice will affect app service plan availability so i'm going to click on review and create after thevalidation you click on create so our deployment has been completed i'm gonna click on go to resource so once the app service is created additional configuration information is available so i'm gonna go under settings and click on configuration
i can connect to my app service using this url so certain configuration setting can be included in this developer's code or configured in the app service let's understand about continuous deployment the azure portal provides out-of-the-box continuous integration anddeployment with azure devops github bitbucket ftp or a local git repository on your deployment machine you can connect your web app with any of the above sources and app services will do the rest for you by auto syncingcode and any future changes on the code into the web app that compiles your secure code furthermore with azure devops you can define your own build and release processes that compiles your source code runs the test build arelease and finally deploys the release into your web app every time you commit the code all that happens implicitly without any need to intervene so when it comes to continuous deployment there are two deployment methods automated and manual
so let me give you an idea about what is an automated deployment automated deployment or continuous integration is a process used to push out new features and bug fixes in a fast and repetitive pattern with minimal impact onend users azure supports automated deployment directly from several sources some of the options available are azure devops github and big bucket and then there is manual deployment as well there are a few options that you can use tomanually push your code to azure some of the ways you can do that are using git cli zip deploy visual studio or ftps let's learn about the deployment slots when you deploy your web app web app on linuxmobile backend or api app to azure app service you can use a separate deployment slot instead of a default production slot when you are running either standard premium or isolated app service plant here so let me show you
how to access a deployment slot i'm on my azure portal you can directly go to your app services by clicking on this or you can search for app services on the global search box select the app services ifyou don't have an app service create a new one by clicking on add and we have talked about how to create an app service plan and app services in the previous video i'm going to select this demo appservice and under the deployment you can find deployment slots these deployment slots are live apps with their own host names app content and configuration elements can be swapped between two deployment slots including the production slot let's understand coupleof deployment slots advantages you can validate app changes in a staging deployment slot before swapping it with a production slot and deploying an app to a slot first and swapping it into production ensures that all instance of the
slot are warmed up before being swapped into protection this eliminates downtime when you deploy your app and after you swap the slot with previously staged app now has the previous production app auto swap streamlines azure devops scenarios whereyou want to deploy your app continuously with zero cold starts and zero down time for customers of the app when auto swap is enabled from a slot into the production every time you push the code change to thatslot app service automatically swaps the app into the production after it's warmed up in the source slot please note that the auto swap is currently supported in the web apps on linux let's have a look at how to
Shows how to configure deployment slots and introduces App Service authentication and authorization. Explains how the built-in authentication module processes requests and supports multiple sign-in providers.
create a deployment slot you can click on add slot the new deployment slot can be empty or cloned when you clone a configuration from another deployment slot the clone configuration is editable some configuration elements follow the content acrossa swap whereas other configuration elements stay in the same slot after a swap i'm gonna click close you can see that i have two slots running as well this is where i would be able to define the trafficpercentage let's understand how can you secure an app service azure app service provide built-in authentication and authorization support so you can sign in users and access data by writing minimal or no code in your web app api andmobile backend and also azure functions please note that you are not required to use azure app service for authentication and authorization many web frameworks are bundled with security features and you can use them if you like so let
me show you how it works i'm going to go back to my azure portal with an azure portal select an app service and i'm going to select the one which we created for the demo if you scroll downunder settings you would be able to find authentication and authorizationby default it is turned off i'm going to turn on so the authentication and authorization module runs in the same sandbox as your application code when it is enabled every incoming http request passes through it before being handledby your application code this module handles several things for your apps this will authenticate users with specific provider it can validate stores and refreshes token this can manage the authenticated session and it can inject identity information into requestvendors as well and some of the authorization behavior we need to be aware of is one allow anonymous request no action this option refers authorization of unauthenticated traffic to your application code for authenticated request app service also passes
along authentication information in an http headers this option provides more flexibility in handling anonymous request it lets you present multiple sign-in providers to your users please remember restricting access in this way applies to all calls to your app
let's understand about custom domain names i'm going to take you back to the portal one more time and under settings of the app service you can find custom domain names as you can see that i don't have anycustom domain names verified at the moment so when you create a web app azure assigns it to a subdomain of azurewebsite.net for example if your web app is named as 104 app service the url is called 104appservice.azurewebsites.netazure also assigns a virtual ip address for a prediction web app you may want users to see a custom domain name after obtaining your domain and creating your dns record you can use the portal to validate the customdomain name and add it to your web app but please make sure you test it before making it alive let's talk about how can you backup an app service the backup and restore feature in azure app service lets
you easily create app backups manually or on a schedule so let me show you where you can turn on the backup i'm still on my app service i'm gonna escape out of this and under settings you can findbackups you can configure the backups to be retained up to an indefinite amount of time and you can restore the app to a snapshot of a previous state by overwriting the existing app or restoring to another app aswell so when you turn on the backup what gets backed up the app service can backup app configuration file content database connected to your app to an azure storage account and container that you have configured your app touse some of the consideration you have to keep in mind while configuring the backup is the backup and restore feature requires the app service plan to be standard tier or a premium tier you can configure backup manually or
on a schedule as well and you need an azure storage account and container in the same subscription as app that you want to backup full backups are the default if a file is on the site but not inthe backup it gets deleted and backups can be up to 10 gb of app and database content let's understand how can you monitor your app service application insights is a feature of azure monitor and you can use applicationinsights to monitor your live applications it will automatically detect performance anomalies and includes powerful analytics tools to help you diagnose issues and to understand what users actually do with your app it's designed to help you continuously improve performanceand usability it works for apps on a wide variety of platforms including.net not js and java w you can use application inside to monitor application hosted on premises hybrid or any other public cloud as well it integrates with
your devops process and has connection points to a variety of development tools it can monitor and analyze telemetry from mobile apps by integrating with visual studio app center application insights has plenty of features and it is aimed atthe development team to help you understand how your app is performing and how it is been used so that concludes the azure app service lesson in this video we're going to start a brand new lesson it's called containerservices we're going to learn what's the main difference between containers and virtual machine we're going to learn about aci which is azure container instances and how can you group these containers and we will talk about docker a bitso while i'm going through these concepts wherever it is relevant i will take you back and for the azure portal and the presentation so you exactly know what i'm talking about hardware virtualization has made it possible to run
multiple isolated instances of operating system concurrently on same physical hardware containers represent the next stage in the virtualization of the computing resources container based virtualization allows you to virtualize the operating system this way you can run multiple applicationswithin the same instance of an operating system while maintaining isolation between these applications this means that containers within a vm provide functionalities similar to the vms within a physical server to better understand this concept it is helpful tocompare the containers and virtualization table so to better understand the concept it is good to go through this particular table on each of these features in terms of isolation operating system deployment slot fault tolerance and persistent storage soi'm not going to read out this you would be able to go through this at your own time and don't worry about this presentation i will make sure to put a link to download this presentation on my blog
so before we move forward let's look at container advantages continuous give you increased flexibility and speed when deploying and sharing the application code and containers are simplified application testing and containers are streamlined and accelerated application deployment let's understandazure container instances containers are becoming the preferred way to package deploy manage cloud applications azure container instances offer the fastest and simplest way to run a container in azure without having to manage any virtual machines and without havingto adopt a higher level service azure container instance is a great solution for any scenario that can operate in isolated containers including simple applications task automation and build jobs let's have a quick look at what are the highlevel features of azure container instance it's completely a platform as a service and containers can start in seconds without the need to provision and manage virtual machines and containers can be directly exposed to the internet with an ip
address and an fqdn container applications are as isolated in a container as they would be in a virtual machine and container nodes can be scaled dynamically to match actual resource demands for an application and containers give you apersistent storage as well and azure container instance support direct mounting of azure file shares azure continuous instance support scheduling of multi-container group that share host machine resources for both linux and windows containers and azure container instances can bedeployed into an azure virtual network directly so let's understand what is a container group the top level resource in azure container instance is the container group a container group is a collection of containers that get scheduled on thesame host machine the containers in a container group shares a life cycle resources local network and storage volumes it's similar in concept to a part in kubernetes so let's have a look at an example container group so this
container group is scheduled on a single host machine and is assigned a single and it is assigned a dns name label exposes a single public ip address with one exposed port which is 80 and consists of two containersone container listened to port 80 while other container listens to 1433 and both of these containers include two azure file shares as volume and each container mounts one of these shares locally so what are the deployment options forthis container group so here are two common ways to deploy a multi-container group use a resource manager template or a yaml file a resource manager template is recommended when you need to deploy additional azure service resources for examplean azure file share due to the yaml format's more concise nature a yaml file is recommended when your deployment includes only container instances and what do you need to understand about container group networking a container group can share
an external facing ip address one or more ports on the ip address and a dns label with a fully qualified domain name so to enable external client to reach a container within the group you must expose the porton the ip address and from the container because containers within the group share a port namespace and port mapping isn't supported a container group's ip address and fqdn will be released when the container group is deleted let's understandwhat is docker docker is a platform that enables developers to host applications within a container a container is essentially a standalone package that contains everything that is needed to execute a piece of software this means it includes thingslike the application executable code the runtime environment such as dotnet core system tools and settings the docker platform is available on both linux and windows and can be hosted on azure the key thing that a docker provide is
the guarantee that the containerized software will always run the same regardless of whether it is been run locally on windows linux or in the cloud on azure this means for instance that software can be developed locally within adocker container shared with qa resources for testing and then deployed to production in azure cloud once deployed to the azure cloud the application can easily be scaled up and down using the azure container instances or aci let's understandsome of the docker terminologies so what is a container this is an instance of a docker image it represents the execution of single application processes or service it consists of the contents of the docker image an execution environmentand a standard set of instructions when scaling a service you create multiple instances of a container from the same image or a bad job can create multiple containers from the same image passing different parameters to each instance what
is a container image this refers a package with all the dependencies and information required to create a container the dependencies include frameworks and the deployment and execution configuration that a container run time uses an image derives from multiplebase images that are layers stacked on top of each other to form the container file system an image is immutable once it has been created then we need to know about build this refers to an action of buildinga container image based on the information and context provided by the docker file then other terminologies like pull push and docker files are important too all right so that concludes the azure container instance lesson and this is thelast lesson from this module in this lesson we're going to learn about azure kubernetes service we will start with what is aks what are some of the terminologies you need to understand within aks how do you configure these
clusters and node within azure kubernetes services we will talk about networking storage and security for the aks how does it integrate with your azure active directory how can you scale your azure kubernetes services and to azure container instanceas well and we will touch upon azure kubelet as well when i am explaining about these topics i will definitely take you through azure portal to show you what exactly i mean by that so you completely understand whati talk about kubernetes is a rapidly evolving platform that manages container based applications and their associated networking and storage components the focus is on application workloads not the underlying infrastructure components and kubernetes provides a declarative approach to deploymentsbacked by a robust set of apis for management operations you can build and run modern portable micro services based applications that benefit from kubernetes orchestrating and managing the availability of those application components azure kubernetes service or aks provides
a managed kubernetes service that reduces the complexity for deployment and core management task including coordinating upgrades the aks cluster masters are managed by the azure platform and you only pay for the aks nodes that run your applications aksis built on top of the open source container service engine or acs engine and aks makes it simple to deploy and manage kubernetes cluster in azure a case reduces the complexity and operational overhead by managing kubernetes by offloadingmuch of that responsibility to azure as hosted kubernetes service azure handles critical tasks like health monitoring and maintenance for you in addition the service is free you only pay for the agent not within your cluster not for themasters some of the core features of azure kubernetes services are it is flexible deployment options identity and security management integrated logging and monitoring cluster node scaling cluster node updates http application routing and gpu enable nodes let's understand some
of the azure kubernetes service terminology pools are group of nodes with identical configurations and nodes are individual virtual machines running containerized applications and container is a lightweight and portable executable image that contains software and all its dependencies deploymenthas one or more identical parts managed by kubernetes and manifest is the yaml file describing a deployment let's understand the azure kubernetes service clusters and nodes a kubernetes cluster is divided into two components cluster master nodes and nodeslet's talk about the cluster master node when you create an aks cluster a cluster master is automatically created and configured this cluster master is provided as a managed azure resource abstracted from the user there is no cost forthe cluster master only the nodes that are part of the aks cluster so what are nodes and node pools to run your applications and supporting services you need a kubernetes node an aks cluster contains one or more nodes
that runs the kubernetes node components and container on time the kublet is the kubernetes agent that processes the orchestration request from the cluster master and scheduling of running the requested containers the virtual networking is handled by the coupproxy on each node the proxy routes network traffic and manages ip addressing for services and parts the container run time is the component that allows containerized application to run and interact with additional resources such as virtual network andstorage in aks docker is used as the container on time let's understand the aks networking to allow access to application or for application components to communicate with each other kubernetes provides an abstraction layer to virtual networking kubernetes nodesare connected to a virtual network and provide inbound and outbound connectivity for parts the cube proxy component runs on each node to provide these network features let's understand these services first talk about cluster ip cluster ip creates an
internal ip address for use within the aks cluster this is good for internal only application that supports other workloads within the cluster then there is node port node port creates a port mapping on the underlying node that allowsthe application to be accessed directly within the node ip address and port then we have the load balancer load balancer creates an azure load balancer resource configures an external ip address and connects the requested parts to the loadbalancing backend pool to allow customers traffic to reach the application load balancing rules are created on the desired port all right so let's understand aka storage applications that run in azure kubernetes services may need to store and retrievedata for some application workloads this data storage can use local fast storage on the node that is no longer needed when the ports are deleted other application workloads may require storage that persist on more regular data volumes within
the azure platform multiple parts may need to share the same data volumes or reattach data volumes if the pod is rescheduled on a different node finally you may need to inject sensitive data or application configuration information into partssome of the core concepts we need to understand are volume persistent volume storage classes and persistent volume claims again for a z104 azure administrator exam you just have to know it from a high level point of view let'slook at the azure kubernetes service security to protect your customer data as you run application workload in azure kubernetes service the security of your cluster is a key consideration kubernetes includes security components such as network policies and secretsazure then adds in components such as network security groups and orchestrated cluster upgrades these security components are combined to keep your aks cluster running the latest os security updates and kubernetes releases and with secure power traffic and access
to secure credentials let's understand these core concepts in a case the kubernetes master components are part of managed service provided by microsoft each aks cluster has their own single tenanted dedicated kubernetes master to provide the api server scheduleretc this master is managed and maintained by microsoft then there is no security aks nodes are azure virtual machines that you manage and maintain the nodes run an optimized ubuntu linux distribution with a docker container on time whenan aks cluster is created or scaled up the nodes are automatically deployed with the latest operating system security updates and configurations and you can use azure kubernetes service and integrate with azure active directory the security of aks clustercan be enhanced with integration of azure active directory built on decades of enterprise identity management azure ad is a multi-tenant cloud-based directory and identity managed service that combines core directory services application access management and identity protection with azure
ad you can integrate on-premises identities into aks cluster to provide a single source for account management and security with azure id integrated with aks clusters you can grant users or groups access to kubernetes resources within a namespace oracross the cluster as you run application in azure kubernetes service you may need to increase or decrease the amount of compute resources as the number of application instances you need to change the number of underlying kubernetes node mayalso need to change you may also need to quickly promotion a large number of additional application instances there are multiple ways you can scale it you can manually scale parts or notes or you can enable cluster autoscaler aswell to rapidly scale your aks cluster you can integrate with azure container instances or aci kubernetes has built-in components to scale the replica and node count however if your application need to rapidly scale the horizontal part auto skiller
may schedule more ports can be provisioned by the existing compute resources in the node pool and as your container instance lets you quickly deploy container instances without additional infrastructure overhead when you connect with aks aci becomes a securedlogical extension of your aks cluster your application require no modification to use the virtual nodes let's understand what is virtual cubelet virtual cubelet is an open source kubernetes cubelet implementation that masqueraders as cubelet in this example of akubernetes cluster virtual kubelet used to allow us to back our kubernetes cluster with services such as container instances and azure batch these services then host our individual nodes on behalf of the cluster the virtual cubelet registers itself asa node and allows developers to deploy ports and containers with their own apis this lets the virtual cube let provide a shim layer with pseudo kubelet implementation enabling you to use other services for your individual instances so that
concludes the last lesson of module 9 which was all about serverless computing and we learned about azure kubernetes services in this lesson in this video we're going to go through module 9 serverless computing review questions let's look atquestion number one you have multiple apps running in a single app service plan true or false and each app in the service plan can have different scaling rules is it true definitely not it's false the app service planis the scale unit of app services if the plan is configured to run five vm instances then all apps in the plan run on all five instances if the plan is configured for auto scaling then all apps inthe plan are scaled out together based on the auto scale settings let's look at the question number two which of the following settings are not swapped when you swap an app select three options is it handler mapping definitely
not what about publishing endpoints yes you can swap your publishing endpoints what about general settings such as framework version 32-bit or web sockets you can't do that yes you can do always on and add custom domain names aswell so the correct answer is publishing endpoints always on and custom domain names some configuration elements follow the content across a swap whereas other configuration elements stay in the same slot after a swap you are administering a productionweb app the app requires scaling to 5 instances 40 gb of storage and a custom domain name which app service plan should you select and select one based on the requirement the correct answer is standard the standard appservice plan meets the requirement at the least cost let's look at the question number four you are backing up your app service which of the following is included in the backup we need to select two to complete the
whole solution is it app configuration absolutely correct and another solution which is included in the backup for app service is azure database for mysql not the firewall enabled storage not the ssl enabled azure database or files or databaseso the correct answer is app configuration and azure database for mysql app service can backup app configuration file content and database connected to your apps and backups can be up to 10 gb of app and database content let'slook at question number five you decide to move all your services to azure kubernetes service which of the following components will contribute to your monthly azure charge as you know that using azure kubernetes service in azure is totallyfree except one the correct answer is not virtual machines you only pay for the virtual machine instances storage and networking resources consumed by the kubernetes cluster the service itself is free
which of the following is not true about container groups select one is it is scheduled on multiple host machine absolutely it is not true rest everything is true you can assign container instance a dns name label you canexpose a single public ip address and container group can consist of two two or more containers and include azure files as well so one which is not true is the first option a container group is scheduled on asingle host machine not on multiple host machines which of the following is the kubernetes agent that processes the orchestration request from the cluster master and schedules running the requested containers you need to select one so the correct answeris cubelet the cubelet process the orchestration request from the cluster master and schedules the running the requested containers you are configuring networking for the azure kubernetes service which of the following maps incoming direct traffic to the pods you
just need to select one is it aks node definitely not not the cluster ip or the load balancer the correct answer is node port node ports map incoming direct traffic to the ports let's look at the last questionwhich method does azure app service use to obtain credentials for user attempting to access an app you just need to select one so the correct answer is redirection to a provider endpoint microsoft azure app service app redirects requestto the endpoint that signs in user for that provider so that concludes module 9 and we just finished the module 9 review questions we are starting a brand new module on this video module 10 is all about dataprotection and the first lesson we're going to learn in this module it's about file and folder backup we're going to learn about azure backup and how can you kick off your azure backup using recovery services vault and what
are the different types of backups available and we're going to implement on-premises file and folder backup solution and we will learn about other microsoft azure recovery services agents as well when i'm explaining about these concepts i will takeyou back and for the azure portal and the presentation so you exactly know what i mean by this azure backup is the azure based service you can use to backup and restore your project in the microsoft cloud asyour backup replaces your existing on-premises or offsite backup solution with a cloud-based solution that is reliable secure and cost competitive azure backup offers multiple components that you can download and deploy on an appropriate computer server or in thecloud the component or agent that you deploy depends on what you want to protect all azure backup components can be used to backup data to the recovery services vault in azure some of the key benefits of using azure
backup are you can use azure backup to offload on-premises data to the cloud you would be able to use azure backup to backup your azure is virtual machines and with azure backup you get unlimited data transfer so azurebackup does not limit the amount of inbound or outbound data you transfer or charge for the data that is transferred so azure backup is the only service microsoft doesn't charge you for any egress traffic and azure backup isthe best way you can keep your data secure azure backup offers you add consistent backups and the ability to retain short and long term data as well and azure backup offers multiple storage options you can either choose lrsor grs so let's go and explore more about azure backup so before i talk about the recovery services world let's go and quickly create a recovery services vault so you know exactly what i'm talking about i'm on my
azure portal you can search for recovery services vault on the global search box as you can see that i don't have a recovery services vault created at the moment i'm going to create one for this demo select thesubscription and create a new resource group or select an existing one i'm going to select an existing one and provide the vault name so i'm going to call it as recovery vault 104 and i'm going to keep itin australia east and select review and create and this is not going to take much time most probably within a minute you will have your first recovery services fault it didn't even take one minute so i'm going toclick on go to resource all right so now we have our first recovery services vault created so the recovery services vault is a storage entity in azure that houses data the data is typically copies of data or configuration
information for virtual machines workloads servers or workstations you can use recovery services wall to hold backup data for various azure services such as isbns linux or windows and azure sql databases along with backup recovery services wall support systemcenter dpm as well and you can integrate with your windows server azure backup server and many more and this recovery services vault makes it easier for you to organize your backup data while minimizing the management overhead you canuse the recovery services wall for backing up azure file servers as well as you can see that if your workload is running on azure you have an option to backup virtual machine sql server sap hana and azure fileshare if your workload is running on-prem you have an ability to backup files and folder ipv virtual machines vmware sql server sharepoint exchange system state or bare metal recovery as well please note that within an azure subscription you
can create up to 25 recovery services vault per region to implement on-premises files and folder backup there are several steps to configuring the azure backup on on-premises files and folders and the backup agent can be deployed on anywindows server vm or physical machines so the first step is to create the recovery services world so we have just learned about how to create that and the second step is to download the agent and credential files solet me show you how to do that so i'm on my azure portal now once you create the recovery services vault select the recovery services vault go inside the vault and click on backup under backup select on premisesand select the type of workload you are trying to backup as files and folder and click on prepare the infrastructure and this is where recovery services will provide a link to download the azure backup agent and the backup
agent will be installed on the local machine and there is also a credentials file that is required during the installation of the agent so to kick off the project you must have the latest version of the agent afteryou install the agent so i'm going to install the engine and register the agent so click next next next and install the agent so after you install the agent you have to use the credential certificate to register theagent as well so we haven't downloaded the certificate i will download it when we get to the prompt of registering the agent all right so now looks like it is completed the installation i'm going to click on proceedto registration it is asking me to point to the vault credentials so i'm going to download the wall credentials now i have downloaded the credentials click on browse and select the key looks like it is accepted click next
to register so i'm going to generate a i'm going to generate a pass phrase if i want to keep it in a location i can browse and i can keep it in location safe click finish and now thisis registering the server with the azure backup this job is going to take at least a minute or so to validate your credentials with the microsoft azure recovery services vault all right so now the microsoft azure backup isavailable for this particular server so i'm going to launch the microsoft azure recovery services agent so this is the agent if i want to schedule a backup i can click on schedule backup this is going to give mean option to add item i can back up the entire drive click next this is where you can schedule the backup do you want a daily or a weekly if you notice we can have it so we can
have a maximum of three times backup per day if you feel like having a weekly backup you can schedule a weekly backup as well then you have an ability to select a retention point daily retention weekly monthly retentionand yearly retention as well along with the number of retention points and the time and ability to keep this data on multiple restore points select next this is where you will decide do you want to transfer the dataover the network or transfer using microsoft azure data box disk or if you are going to use import export service you have an ability to move the data into the import export service as well click next and thepolicy what we're going to select is files and folder and hit finish to start your first backup so that's how you will implement your on-premises files in folder backup using azure backup agent let's know a bit more about
the azure recovery services agent we just now installed this agent has many features this agent can backup files and folders on physical or virtual windows operating system vms can be this on premises or in azure as well youdon't need a separate backup server for this agent to work you can use this agent for backup and restore content and this agent doesn't support linux operating system so now that we have learned about recovery services vault andazure backup agent and in this video we're going to learn about virtual machine backup let's have a look at the things what we're going to learn on this video we will talk about virtual machine data protection how canyou protect different specific workloads within your virtual machines and we will have a look into different options available for a virtual machine snapshot what are the other ways you can do azure backup using your recovery services vault and
we will learn about implementing virtual machine backup restore and the possibility of using azure backup server and different components available between azure backup server and other backup components available within azure when you delete stuff within azure recovery servicesvault what do you have to be aware of the soft delete and we will touch upon azure site recovery which is a totally different solution it is used for disaster recovery or bcdr strategy and we'll finish off withazure to azure architectural scenario as well so when i'm going through each of this topic i will definitely take you through back and forth the azure portal and the presentation so you exactly know what i'm talking about allright so let's understand the virtual machine data protection you can protect your data by taking backups at regular intervals there are several backup options available for vms depending on your use case let's go through this one by one
let's talk about azure backup first for backing up azure vms running protection workload use azure backup azure backups support application consistent backups for both windows and linux vms azure backups create recovery points that are stored in jio redundantrecovery walls when you restore from recovery point you can restore the whole vm or just specific files let's look at snapshots in development and test environments snapshot provide a quick and simple option for backing up vms that usemanage disk a manage this snapshot is a read only full copy of a managed disk that is stored as a standard managed disk by default with snapshot you can backup your managed disk at any point in time thesesnapshots exist independent of the source disk and can be used to create new managed disk they are built based on the use size for example if you create a snapshot of a managed disk with a provision capacity of
64 gb and actually use data size of 10 gb that snapshot is built only for the used data size of 10 gb let's understand what is azure site recovery azure site recovery protects your vm from a major disasterscenario when a whole region experiences an outage due to a major national disaster or widespread service interruption you can configure azure site recovery for your vms so that you can recover your application with a single click in matterof minutes and you can replicate to an azure region of your choice as well let's understand the workload protection needs there are several methods for backing up virtual machines the first step is to enable backup for individual azurevirtual machines so let me tell you how to do that so let me show you how to turn on individual virtual machines backup i'm on my azure portal go to your virtual machines and select an existing virtual machine
on the left hand side under operations you would be able to find backup you can either select an existing recovery services vault or create a brand new recovery services wall for backing up this vm i'm going to selectan existing recovery services vault we created you can choose a default policy or you can create a brand new policy so this is a good time for me to show what a policy looks like you can name yourpolicy and at what frequency you want to back up your snapshot as you notice for a daily backup you can have only one snapshot per day and you have an ability to read an instant recovery snapshot for howmany days so this is where you can define that and what time of the day do you want to start the backup and for how many number of days and would you like to retain your weekly backup monthly
and yearly backup once you define your policy hit ok and now you have your backup policy created and your recovery services wallet all you have to do is hit on enable backup so this will start your first snapshotbackup of your azure virtual machine so now we have seen how to take a snapshot let's learn about virtual machine snapshot bitmore an azure backup job consists of two faces first the virtual machine snapshot is taken and secondthe virtual machine snapshot is transferred to the azure recovery services vault a recovery point is considered creating only after both steps are completed as part of this upgrade a recovery point is created as soon as a snapshot isfinished and the recovery point of snapshot type can be used to perform a restore using the same restore flow you can identify this recovery point in the azure portal by using snapshot as the recovery point type and after
the snapshot is transferred to the vault the recovery point type changes to snapshot and vault let's have a look at the recovery services vault vm backup options i'm going to go back to the azure portal and i'm goingto go back to the recovery services vault so we just created a recovery services fall vault for this demonstration and under backup this is where you would be able to see all the possible backup option so we talkedabout backing up an azure virtual machine if you happen to have a storage account with an azure file storage then you can turn on the snapshot backup for that as well similarly you would be able to backup yoursql server and sap hana in azure vm as well so let me quickly show you how to backup your azure file share i'm gonna go back to the storage account i'm gonna pick a storage account we created for
this demonstration scroll down to file share or file service and select the file share and click on file share we created under operation this is where you can see the snapshots and you can schedule and configure the backupas well just like azure vm backup you can create a new recovery services wallet and point the backup there and select an existing recovery services vault and point the file share backup over there as well you can chooseto use an existing policy or you can have a brand new policy for your azure file share snapshot backup let me go back to my recovery services vault and i want to show you this time what are allthe options available for you for an on-premises backup i'm going to select on-prem this is where you have an ability to have a backup for your hyper-v virtual machines vmware virtual machines on-prem system state and bare metal depending
on the option you select azure will give you an ability to download and install the appropriate tool for the hyper-v azure offers you to install the azure microsoft azure backup server we call it as maps mabs so youcan download and install the server component and download the wall credentials and register your web server with your recovery services vault and this will give you an ability to backup your hyper-v virtual machines let's understand the key stepswhile implementing your vm backups backing up azure virtual machine using the azure backup is easy and follows a simple process the first step as we have seen in the previous example is to create a recovery services vault soto backup your files and folders you need to create a recovery services vault in the region where you want to store the data you also need to determine how you want your storage replicated either geo-redundant or local redundant
by default your vault has geo-redundant storage the second step is to use the portal to define the backup you can protect your data by taking snapshot of your data at defined intervals these snapshots are known as recovery pointsand they are stored in recovery services vault and the third and final step is backup the virtual machine the azure vm agent must be installed on the virtual machine for the backup extension to work however if your vmwas created from the azure gallery then the vm agent is already present on the virtual machine vms that are migrated from the on-premises data center would not have the vm agent installed in this case the vm agent needsto be installed once the virtual machine snapshots are safely in the recovery services vault it is easy to recover them once you trigger the restore operation the backup service creates a job for tracking the restore operation and the
backup service also creates and temporary displays notification so you can monitor how the backup is proceeding another method of backing up virtual machine is using data protection manager or dpm or microsoft azure backup server which is map serverthis method can be used for specialized workloads virtual machines or files and folders and volumes specialized workloads can include sharepoint exchange and sql servers there are several advantages of backing up machines and apps using map server backing upto maps provide app aware backup optimized for common apps such as sql server exchange and sharepoint for on-premises machines you don't need to install mars agent on each machine you want to backup another advantage is if you wantmore flexibility and granular scheduling options please try to leverage maps which is microsoft azure backup server for backing up your workload and server let's have a quick comparison to see what are the capabilities of mars and maps mars
is recovery services agent and maps is azure backup server mars protects the files and folders where it maps protects files and folders and volumes vms applications and workloads mars give you an ability to store all the data inthe recovery services vault but maps give you recovery services vault and a local attached disk as well so this is sometimes very unique for your customer scenario maps is a tool what you can use for storing data locallyfirst and then moving the data back to the cloud for long term storage and retention so let's learn about soft delete azure storage now offers soft delete for blob objects so that you can more easily recover your datawhether it is erroneously modified or deleted by an application or other storage account user so how does the soft delete works when enabled soft delete enables you to save and recover your data when blobs or blob snapshots are
deleted this protection extends to blob data that is erased as the result of an overwrite when the data is deleted a transition to soft delete state instead of being permanently deleted when the soft delete is on and youoverride data a soft delete snapshot is generated to save the state of the overwritten data and the soft delete objects are invisible unless explicitly listed you can configure the amount of time soft delete data is recoverable before itis been permanently so let me show you how you can configure the soft delete on a storage account i'm on my azure portal i'm going to go back to your storage account and click on a storage account wecreated for this demonstration on the left hand side scroll down till you find file service and click on soft delete so by default this is disabled you can enable this and you can modify the retainment period of days
you want to keep this soft delete data please note that soft delete is backwards compatible so you don't have to make any changes to your application to take advantage of the predictions this feature offers let's understand azure siterecovery site recovery helps ensure business continuity by keeping business apps and workloads running during outages the site recovery replicates workload running on physical virtual machines from a primary site to a secondary location the site recovery replicates workloads runningon physical and virtual machine from a primary site to a secondary location when an outage occurs at a primary site you fail over to the secondary location and access apps from there after the primary location is running againyou can fail back to it let's look at some of the replication scenarios so before we look into the replication scenarios let me quickly show you how you can enable the site recovery in the azure portal i'm on
my azure portal now i'm going to go back to recovery services vault select the recovery services vault instead of backup select getting started on site recovery this is where you can start your first site recovery are you tryingto protect your azure virtual machine or vmware to azure or hyper-v to azure depending on your scenario you can pick up a solution so some of the scenarios where you can use site recovery are replicate azure vms fromone region to another replicate on-premises vmware vms hyper-v vms physical servers azure stack vms to azure replicate aws windows instances to azure and replicate on-premises vmware vms hyper-v and physical servers to your secondary sites as well depending onthe option what you select let's assume we want to move a vmware machine to azure so select the prepare the infrastructure i'm going to select i have completed the planning and click next this is going to give me
option to configure the server are your machines virtualized yes absolutely do i have a configuration server i don't so i have an option to click on add configuration server and download this obf template and install on my on-premisesvmware infrastructure then i will be able to connect to the vcenter and vsphere host then after this step i would be able to add the target settings replication policy and after the first assessment i would be able tosee all the vms which is available on my on on-prem environment let's understand the azure to azure scenario when you enable replication to an azure vm this is the following step which happens the first step is the siterecovery mobility service extension is automatically installed on the vm and the extension register the vm with the site recovery and continuous replication begin for the vm and the second step is the site recovery processes the data in the
cache and send it to the target storage account or to the replica managed disk the third step is after the data is processed crash consistent recovery points are generated every five minutes app consistent recovery points are generated accordingto the settings specified in the replication policy and the final step is when you initiate a failover when you initiate a failover the vms are created in the target resource group target virtual network target subnet and the targetavailability set during a failover you can use any recovery point all right so that concludes the data prediction module we just finished the last lesson which was all about virtual machine data protection in this video we're gonna gothrough whatever things we have learned on the data protection module so let's look at the first question you need to backup files and folders to azure which three steps must you perform so the first step is anyways download
install and register the backup agent so we have seen a demonstration where i have download the agent and then i downloaded the certificate to register so that is definitely the first step so what is the second step isit to synchronize the configuration the next step is to backup files and folders and then what is the next step is it create a backup services wall definitely not so the first step is to create a recovery servicesvault if you are looking from an order so after you create the recovery services world you download the agent and install the backup agent and then you backup the files and folders let's look at question number two youare responsible for creating a disaster recovery plan for your data center you are able to recreate virtual machines from scratch this includes the operating system its configuration settings and patches which of the following will provide a bare metal
backup of your virtual machine you need to select one option so what can you do to backup a bare metal is it azure backup mars agent definitely not mars agent can be used to backup your files in folderis it this snapshot no this snapshot is for your azure virtual machines is it azure site recovery that is for your bcdr so the correct answer is azure backup server azure backup provides a bare metal backup capability let'slook at question number three you have several azure vms that are currently running production workloads you have a mix of windows server and linux servers and you need to implement a backup strategy for your production workloads which featureshould you use in this case we just need to select one answer so we have a mix of both windows and linux server so how do you backup so the correct answer is azure backup for backing up virtual
machines running production workload use azure backup azure backup supports application consistent backup for both windows and linux virtual machines you plan to use azure backup to protect your virtual machines and data and are ready to create a backupwhat is the first thing you need to do so the first step in bcdr and backup is to create a recovery services vault when performing a virtual machine backup you must first create a recovery services vault in theregion where you want to store the data recovery points are stored in the recovery services vault while creating a backup policy is a good practice it is not a dependency to creating a backup the azure vm agent isrequired on azure virtual machines for backup extension to work however if the vms are created from the azure gallery then the vm agent is already present on the virtual machine let's look at question number five you deploy several
virtual machines to azure you are responsible for backing up all data processed by the vms in the event of a failure you need to restore the data as quickly as possible which of these options would you recommend torestore a database used for development on the disk data you just need to select one so if your machines are deployed in azure so the correct answer is azure virtual machine backup use the azure backup to restore vmto a specific point in time and to restore individual files azure backup supports application consistent backup for both windows and linux vms let's look at question number seven your organization needs a way to create application aware snapshots andbackup linux virtual machines and vmware virtual machines you have files folders volumes and workloads to protect you recommend which of these following solutions select one so it is definitely not azure backup mars agent or snapshot or enable backup
for individual azure vms so the correct answer is azure backup server azure backup server provides app aware snapshot support for linux virtual machine and vmware virtual machines and the azure backup server can protect files folders volumes and workloadsyou plan to use virtual machine soft delete which of the following statement are true and we need to select two i'm going to read out these statements to see if that statement is true soft delete provides 20 daysextended retention of period definitely not if you delete a backup soft delete will still provide recovery of data absolutely correct that is the whole purpose of soft delete and soft delete is built in protection at no additional costagain absolutely correct if you delete a backup soft delete still provide recovery of data and soft delete is built in protection at no additional cost all right so that concludes module 10 module 10 was all about data protection
and we are entering a brand new module called monitoring and this is going to be the last module for this examination course let's have a quick look at what are the things we are going to learn on thisvideo we will start with different types of azure monitoring service what are the key capabilities of ash monitoring and how can use monitoring for data platform we will touch base on log data data types and we will havea look at why azure advisor is such a cool service within azure and we will learn about activity log and how to query the activity log while i'm explaining about each of these concept i will take you backand forth between azure portal and the presentation so that so that it makes complete sense to you what i'm talking about monitoring is the act of collecting and analyzing data to determine the performance health and the availability of
your business application and the resources that it depends on an effective monitoring strategy help you understand the detailed operation of the components of your application it also help you increase your uptime by proactively notifying you of critical issuesso that you can resolve them before they become problems azure includes multiple services that individually perform a specific role or task in this monitoring space together these services deliver a comprehensive solution for collecting analyzing and acting on telemetryfrom your application and the azure resources that support them they can also work to monitor critical on-premises resources to provide a hybrid monitoring environment as well understanding the tools and data that are available is the first step indeveloping a complete monitoring strategy for your application this diagram gives you a high level view of azure monitor at the center you can see data stores for metrics and logs which are the two fundamental types of data used
by azure monitor on the left are the sources of the monitoring data that populate these data stores on the right are the different functions that azure monitor performs with this collected data such as analysis alerting and streaming toexternal services so let's look at the key capabilities of the azure monitor the first ability is to monitor and visualize metrics so these metrics are numerical values available from azure resources helping you understand the health operation and performanceof your system the second capability is query and analyze logs these logs are activity logs diagnostic locks and telemetry from monitoring solution analytics queries help with troubleshooting and visualizations you can set up alerts and actions these alerts notifyyou of any critical condition and potentially take automated corrective actions based on triggers from metrics or logs all the data collected by azure monitor fits into one of two fundamental types metrics or logs metrics are numerical values that
describe some aspect of a system at a particular point in time they are lightweight and capable of supporting near real-time scenarios and logs contain different kinds of data organized into records with different sets of properties for each typetelemetry such as events and traces are stored as logs in addition to performance data so that it can all be combined for analysis for many azure resources the data collected by azure monitor is displayed on the overview pagein the azure portal for example virtual machines have several charts displaying performance metrics you can click on any of these graphs to open the data in the metric explorer in the azure portal which allows you to chart thevalues of multiple metrics over time you can view the chart interactively or pin them to the dashboard to view them with other virtualizations the log data collected by azure monitor is stored in log analytics which include a rich
query language to quickly retrieve consolidate and analyze collected data you can create and test queries using log analytics page in the azure portal and then either directly analyze the data using these tools or save queries for use withthe visualization or alert tools azure monitor uses a version of data explorer query language that is suitable for a simple log queries but also include advanced functionalities such as aggregations joins and smart analytics you can quickly learn thequery language using multiple lessons particular guidance is provided to users who are already familiar with sql and splunk let's understand the different data types azure monitor can collect data from a variety of sources you can think of monitoringdata for your application in tiers ranging from your application any operating system and services it relies on down to the platform itself so what is application monitoring data this is the data about the performance and functionality of the
code you have written regardless of its platform guest voice monitoring data is the data about the operating system on which your application is running this could be running in azure on the cloud or on-premises azure resource monitoring datais all about data about the operation of an azure resource and ancient subscription monitoring data is about the operation and management of an azure subscription as well as data about the health and operation of azure itself and azuretenant monitoring data is it's all about the operation of the tenant level azure services such as azure active directory so as soon as you create an azure subscription and start adding resources such as virtual machine and web appsazure monitor starts collecting data activity log records when resources are created or modified please note that azure monitor can collect log data from any res client using data collector api this allows you to create custom monitoring scenarios and
extend monitoring to resources that don't expose telemetry through other sources let's learn about azure advisor this is one of the coolest feature or a service which i love in azure so let me show you how to access azureadvisor i'm gonna search for advisor in the global search box and click on advisor so advisor is a personalized cloud consultant that help you follow best practices to optimize your azure deployments it analyzes your resource configuration and usagetelemetry and then recommend solution that can help you improve the cost effectiveness performance high availability and security of your azure resources the advisor cost recommendation page helps you optimize and reduce your overall as you spend by identifying idealand underutilized resources you can select the recommendation action for the recommendation to implement the recommendation please note that azure advisor provides recommendations for virtual machines availability sets application gateways app services sql servers and reddish cache let's learn about
activity log the azure activity log is a subscription log that provides insights into subscription level events that have occurred in azure this includes a range of data from azure resource manager operational data to updates on the service healthevents so let me show you how to access the activity log about my azure portal you can search for activity log here and select activity log with the activity log you can determine that what who and when forany right operations which is put post and delete taken on resources in your subscription you can also understand the status of the operation and other relevant properties through activity logs you can determine what operations were taken on theresource in your subscription who started the operation when the operation occurred the status of the operation the value of other properties that might have helped you in the research of the operation please note that the activity logs are
kept for 90 days you can query for any range of date as long as the starting date is in more than 90 days you can also retrieve events from your activity log using azure portal cli official command let'sand azure monitor rest api so that concludes the first lesson from the module 11.in this lesson we're going to learn about azure alerts let's have a quick look at what are the things we are going to learn on this video we will start with azure monitor alerts and we will learn abouthow to create alert rules then we need to understand what are the action groups and when i'm explaining about each of these topics i will take you back and forth between azure portal and the presentation so you exactlyknow what i mean by these the monitor alert experience has many benefits so let me take you to the azure portal how to access these alerts i'm on my azure portal i'm going to search for alerts and this
is a global alerts mechanism i'm going to select a virtual machine pick a virtual machine and under monitoring you can find alerts so similarly this is where you can come and see the alert for this specific virtual machineand you have a global alert mechanism as well so what is the main benefit of alerts you get better notification system all newer alerts use action groups which are named groups of notification and action can be reused inmultiple alerts you get better workflow as well the new alert authoring experience guides these user along the process of configuring an alert rule which makes it simpler to discover the right things to get alerted on you can alsoview log analytics alerts in azure portal as well and you get a unified authoring experience and then there is a separation of fired alerts and alert rules let's learn about creating alert rules alerts proactively notify you when important
conditions are found in your monitoring data they allow you to identify and address issues before the user of your system node is them alerts consist of alert rules action groups and monitor conditions so let me go into alertsand create a new alert rule the first step is to select the source for this example i'm going to pick all done all resources which is part of this as 104 resource group i'm going to add a conditioni want to check all administrative operations for last 6 hours or i can see that for last one week click done so whenever the activity log has an event with category administrative and the signal is all administrative operationsi can create an action group here so click on select an action group i'm going to create a new action group select an existing resource group action group name and review and create i can set up the notification
type as either email or email sms message push notification or voice as well i'm gonna ignore that at the moment i'm gonna click on create so the action group is created now i can create an alert rule i'mgonna name it as all admin activity and enable rule upon creation so i'm going to create an alert rule so that's how you create an alert rule now that we have learnt about alerts in this lesson we're goingto learn about log analytics let's have a look at what are the things we are going to learn on this lesson we will start with what is log analytics and i will take you through the azure portal toshow you how to create a workspace and what are the connected sources available within log analytics and similarly the data sources as well and we will learn about how to query and what is the query language syntax you
can use it in the log analytics while i'm explaining about these concepts i will take you back and forth the azure portal and the presentation so you exactly know what i mean by these log analytics is a servicethat helps you collect and analyze data generated by resources in your cloud and on-premises environment these log queries help you to fully leverage the value of the data collected in the azure monitor logs a powerful query language allowsyou to join data from multiple tables aggregate large sets of data and perform complex operations with minimal code virtually any questions can be answered and analysis performed as long as the supporting data has been collected and you understandhow to construct the right query so let me show you how to access the log analytics workspaces i already have one default created just now i'm going to select the log analytics workspace some features of the azure monitor
such as insights and solutions processes log data without exposing you to the underlying queries to fully leverage other features of azure monitor you should understand how queries are constructed and how you can use them to interactively analyze datain azure monitor logs so how do you create your first log analytics it's super simple so within the azure portal go to log analytics and click on add a log analytics workspace all you have to do is createa new resource group or select an existing one and name your log analytics instance name and pick a region and under the pricing tier this is where you can see how much it is gonna cost and hit onreview and create that's how you create a log analytics workspace let's understand the connected sources connected sources are the computers and other resources that generate data collected by log analytics this can include agents installed on windows and linux
computers that connect directly or agents in a connected system center operation manager management group log analytics can also collect data from azure storage so what about the data sources data sources are the different kind of data collected fromeach connected source these can include events and performance data from windows and linux agents in addition to sources such as iis logs and custom text logs the data source include windows even logs windows performance counters linux performance countersiis logs custom field and custom logs each data source has additional configuration options for example the windows even lock can be configured to forward error warning or information messages and log analytics provide a query syntax to quickly retrieveand consolidate data in the repository you can create and save log searches to directly analyze data in the portal or have log searches run automatically to create an alert if the result of the query indicates an important condition
to give you a quick graphical view of the health of the overall environment you can add visualizations for saved searches for saved log searches to your dashboard to analyze data outside of the log analytics you can export thedata from the repository into tools such as power bi or excel you can also leverage the log search api to build custom solutions that leverage log analytics data or to integrate with other systems when you build a queryyou start by determining which tables have the data that you are looking for each data source and solution stores its data in dedicated tables in the log analytics workspace many queries will only require data from single table butothers may use a variety of options to include data from multiple tables so that concludes the lesson on log analytics in this lesson we're gonna learn about network watcher let's have a quick look at the things what we're
going to learn on this video we will start with what is a network watcher how do you start a network watcher diagnostics different ways of diagnostic events within your network watcher like ipflow next hop security rules vpn packetcapture etc and how do you use logs and monitoring within network watcher network watcher provides tools to monitor diagnose view metric and enable or disable logs for resources in azure virtual network network watcher is a regional service thatenables you to monitor and diagnose conditions at network level scenario you can use network watcher to automate automate remote network monitoring with packet capture gain insights into your network traffic using flow logs diagonals vpn connectivity issues as welllet me show you how you can access your network watcher i'm going to take you to my azure portal you can search for network watcher on the global search box and select the network watcher connection monitor is a
feature of network watcher that can monitor communication between a virtual machine and an the connection monitor capability monitors communication at irregular intervals and inform you of reachability latency and network topology changes between the vms and the endpoint forexample you might have a web server vm that communicates with the database server vm someone in your organization may unknown to you apply a custom rule and network security rule to the web server or database server vm orsubnet if the endpoint become unreachable connection troubleshoot informs you of the reason potential reasons might be dns name resolution problem the cpu memory or firewall within the operating system of avm or the hop type of a custom routeor security rule for the vm or subnet of the outbound connection connection monitor also provides the minimum average and maximum latency observed over time then we have different types of network watcher diagnostics ipflow next hop etc so let
me talk about ipflow first you can use verify ipflow to quickly diagnose connectivity issue from or to the internet and from or to the on-prem environment for example confirming if a security rule is blocking ingress or egress trafficto or from a virtual machine ipflow verify is ideal for making sure security rules are being correctly applied if ipflow verify doesn't show a problem you will need to explore other areas such as a firewall restrictions the nextone is dexhop to determine if traffic is being directed to the intended destination by showing the next hop this will help determine if networking routing is correctly configured next hop also returns the route table associated with the nexthop if the route is defined as a user defined route that route is returned otherwise the next hob return system route so depending on your situation the next hop could be internet virtual appliance virtual network gateway vnet local
minute pairing or none the next one is effective security rules if you have several nsgs and are not sure which security rule are being applied you can examine the effective security rules here you can check the priority sourceprotocol action all of this in one single detail or the pane of glass and the diagnostic vpn troubleshoot will help you troubleshoot gateway and connections this virtual network gateway provide connectivity between on-premises resources and other virtual network withinazure monitoring gateway and their connections are critical to ensuring communication is working as expected vpn diagnostics can troubleshoot the health of the gateway network watcher packet capture allows you to create capture sessions to track traffic to and froma virtual machine filters are provided for the capture session to ensure you capture only the traffic you want packet capture helps to diagnose network anomalies both reactively and proactively other users including gathering network statistics gaining information on network
intrusions to debug client server communications and much more being able to remotely trigger packet captures eases the burden of running a packet capture manually on a desired virtual machine which saves valuable time let's understand the diagnostics connection troubleshootingthe connection troubleshoot feature of network watcher provide the capability to check direct tcp connection from virtual machine to a virtual machine fully qualified domain uri or ipv4 addresses network scenarios are complex they are implemented using network security groupsfirewalls user defined routes and resources provided by azure complex configuration make troubleshooting connectivity issues challenging the network watcher helps reduce the amount of time to find and detect connectivity issues the results returned can provide insight into whether aconnectivity issue is due to a platform or a user configurations issue let's understand the logs the first one is nsg floor logs nsg flow logs allow you to view information about ingress and egress ip traffic through nsg floor
locks are written in json format and show outbound and inbound flow on a per rule basis the json format can be visually displayed in rbi or third party like kibana and the last topic is monitoring topology suppose youhave to troubleshoot virtual network created by your colleagues unless you were involved in the creation process of the network you might not know about all the aspects of your infrastructure you can use the network topology tool to visualizeand understand the infrastructure you're dealing with before you start troubleshooting the network topology capability enable you to generate a visual diagram of resources in the virtual network and the relationship between these resources this is an example topology ofa subnet which is in my subscription the topology tool generates a graphical display of your azure virtual network its resources its interconnections and their relationship with each other please note that to generate the topology you need a network
watcher instance in the same region as the virtual network all right so that concludes the module 11 and that was the last lesson of this az104 azure administrator associate examination course in this video we're going to go throughmodule 11 which is all about azure monitoring and we're going to go through review questions from the previous module your organization has a very large web farm with more than 100 virtual machines you would like to use loganalytics to ensure these machines are responding to request you plan to automate the process so you create a search query you begin the query by identifying the source table which source table do you use and you need toselect one answer the right answer is heartbeat the heartbeat table will help you identify computers that haven't had a heartbeat in a specific time frame for example the last six hours your organization has an app that is used
across the business the performance of this app is critical to the day by day operations because the app is so important for it administrators have been identified to address any issues you have configured an alert and need toensure the administrators are notified if there is a problem in which area of the portal will you provide the administrator email address select one so we have learned about this when we were configuring the action group so ifyou remember while configuring the action group we learned about adding options like email sms push notification etc so the correct answer is action group when creating the alert you will select email as the action type you will thenbe able to provide the administrator email address as part of the action group let's look at question number three your organization has several linux virtual machines you would like to use log analytics to retrieve error messages for these
machines you plan to automate the process so you create a search query you begin the query by identifying the source table which source table do you use when we were learning about log analytics we talked about it thesource table what we use is syslog syslog is an even logging protocol that is common to linux syslog includes information such as error messages you are analyzing the company virtual network and think it would helpful to get avisual representation of networking elements which feature can you use select one there is only one service can give out this solution that is called network watcher topology the network watching topology feature provide a visual representation of your networkingelementslet's explore question number five your company has a website and users are reporting connectivity errors and timeouts you suspect that a security rule may be blocking traffic to or from one of the virtual machines you need to quickly
troubleshoot the problem so you do which of the following so we need to read out the sentence and figure out what would be the solution you would implement is it configuring is logging and review the connection errors definitelynot does turning on virtual machine diagnostic logging and use log analytics is going to resolve the problem no using network watcher vpn diagnostics feature we need to use network watcher but not the vpn diagnostic feature so the correctanswer is use network watcher ipflow verify feature diagnosing connectivity issues is ideal for network watcher ipflow verify feature the ipflow verify capability enables you to specify a source and destination ipv4 address port protocol and traffic direction ipflow verifythen test the communication and informs you if the connection succeed or fails question number six you are interested in finding a single tool to help identify high vmcp utilization dns resolution failures firewall rules that are blocking traffic and
misconfigured routes which tool can you use the correct tool is network watcher connection troubleshoot azure network watcher connection troubleshoot is a more recent addition to network watchers suite of networking tools and capabilities connection troubleshoot enables you to troubleshootnetwork performance and connectivity issues in azure let's look at question number seven you are reviewing the alerts page and notice an alert has been acknowledged what does this mean select one does it mean that the issue has beendetected and has not yet been received definitely not does it mean that an administrator has reviewed the alert and started working on it absolutely correct an alert status of acknowledged means an administrator has received the alert and startedworking on it the alert state is different and independent of monitor condition alert state is set by the user monitor condition is set by the system let's look at the last question you need to determine who deleted a
network security group through resource manager you are viewing the activity log when another azure administrator says you should use this you should use this event category to narrow your search select one which even category is that the correctanswer is administrative administrative category contains the record of all create update delete and action operations performed through resource manager examples of types of events you would observe in this category include create virtual machine and delete virtual network groupthe administrative category also include any changes to the role-based access control in a subscription once again thank you so much for taking your time to learn this azure administrator course i hope you found the information provided in thiscourse super helpful i will see you in the next video until then take care