Azure in Education

Azure Education Governance Series

Eric W. DeBord — Wed, 10 Oct 2018 00:38:52 GMT

One of the challenges education customers face when starting to adopt Azure is understanding how they can effectively use services and still address the need for governance. In our experience, customers that address governance early on in their public cloud journey have a higher probability of success while reducing compliance/security issues that typically arise from business units bypassing enterprise IT for cloud services. In this video blog series we will follow Contoso Education, a fictitious University with a strategic goal of improving student outcome by leveraging cloud technology. Contoso Education was able to accelerate cloud adoption by following the Azure Education Governance Series. The video series is tailored to education customers based on many real world engagements by the presenting team. It follows prescriptive subscription governance as published in the Azure enterprise scaffold article. One of the main goals of this video series is to provide simple steps to adopting Azure governance in hopes of reducing the typical "analysis paralysis" that can slow adoption. As you see below we have broken down governance into a series of topics that are short and easy to consume at your own pace. Hope you enjoy! https://youtu.be/vMwwlXBnY0Q https://youtu.be/yFaRu8C3tdU https://youtu.be/fJ_KW8Ycrn8 https://youtu.be/yl6_kEeRRnA https://youtu.be/6YU5u4KJCI8 https://youtu.be/Xn_pEvVR7vA https://youtu.be/7T8SZQgoHQ8 https://youtu.be/hmwws34Nvsc https://youtu.be/aip7aOl3Gqw https://youtu.be/DT7NoPeNUFg https://youtu.be/q0LAk_L95Mo

Windows and SQL Server 2008 and 2008 R2 End of Support - free security updates in Azure

Manuel Garriga - EDU — Wed, 18 Jul 2018 09:24:48 GMT

OK folks, let's talk about that stage in a Database Server or Windows Server's lifecycle in EDU that I'll call Purgatory for the purpose of this blog post. Mainstream support has ended, the DB/OS vendor is no longer rolling out security updates, but you haven't been able to either kill off, replace or upgrade this particular server because of a host of reasons. This will happen sooner than you might think for some servers in your environment, SQL Server 2008/2008 R2 support ends July 9, 2019 and Windows Server 2008/2008 R2 systems ends on January 14, 2020. That's not too far away when you think about it. But how did we get here? Some reasons that I recall from my time in EDU include:

The Application vendor doesn't support a newer OS so I can't upgrade it.
The Application vendor no longer exists, I can't even find the media to re-install it!
I don't want to touch that thing, it's been nothing but headaches since day one!
I'm going directly to Containers/Service Fabric and don't want to touch these VM's for a couple of years while I build the shiny new stuff.
Why can't I just keep the lights on for another year?

You may have other legitimate reasons why you could find yourself running important services/applications on Windows Server without security updates - It's OK, nobody's judging here! Well maybe your CISO or Compliance folks might . . . but let's not go there. While we still have time to plan to avoid Server Purgatory, let's see if there's an option that won't break the bank - we are in EDU after all. If only there were a way to buy some additional time, maybe using Azure . . . Migrate that Physical Server or VM into Azure with free security updates for three additional years. Here's the place to go for more details including a snackable video outlining the program and a PDF to share with the compliance folks! The key benefits are:

Rehost Windows Server/SQL Server 2008 and 2008 R2 workloads to Azure
Get three years of Extended Security Updates at no additional charge, and upgrade to a current version when ready
Use existing licenses and save up to 80 percent on Azure Virtual Machines with Azure Hybrid Benefit and Reserved Instances

That last one is HUGE because you can bring your own Windows Server and SQL licensing (that you purchase at EDU rates) into Azure and combine that savings with Reserved Instances to bring that OpEx cost way down. OK, sounds good, but how to I get there (Azure) from here (On-premises VMWare/Hyper-V/Physical)? Microsoft offers a free migration tool via Azure Site Recovery and assessment tooling via Azure Migrate. Partner migration solutions are available as well and Microsoft Services or a regional consulting partner can help if needed. So take a deep breath - you have time to plan for this next phase in your 2008/2008 R2 server's lifecycle. Just remember that line from Freewill by Rush: "If you choose not to decide, you still have made a choice." If you're still reading this post hoping to see Windows Server 2003 extended support options, sorry - nothing to report here, that ship has sailed. If you absolutely still have Server 2003 needs, you can run it in Azure if you bring your own VHD as described and caveated here.

How can you test RA-GRS redundancy?

markga — Wed, 30 May 2018 06:52:48 GMT

I had a university in Los Angeles who wanted to walk through how to recover from a secondary RA-GRS storage location in the event of an outage. I put together a quick FAQ and steps to help clarify a few unclear areas:

What is the difference between RA-GRS and GRS?

The main difference between GRS and RA-GRS is RA-GRS has a read only replica in the secondary paired region while GRS has a read/write storage replica in the secondary paired region. Both options have 3 local regional copies and 3 secondary copies in the paired region for a total of 6 storage copies. More on both GRS here and RA-GRS here.

Which one should I leverage?

We recommend going with RA-GRS as your first choice since it provides read access to the secondary regional copy unlike GRS. You will have to weigh functionality vs. price as it does cost more.

The RA-GRS secondary read only replica can be used for many purposes such as application upgrades where you point to the secondary read-only data , pulling from read only source for extraction, querying read only data replica, and additional outage recovery scenarios not available in GRS.

What happens if a regional failover occurs with RA-GRS or GRS?

If a complete regional storage failure occurs, we will first try and resolve the problem and if not resolvable we will determine that a failover is necessary and initiate a failover to the secondary paired region. This will provide full read and write access to this secondary paired region for both GRS and also RA-GRS. The failover is automatic and DNS will be switched automatically to the secondary.

See more on GRS and RA-GRS failover considerations here.

A feature may be coming in the future to allow for customer initiated RA-GRS and GRS failover for DR testing, etc. See here.

What happens if a temporary regional outage exists with RA-GRS (not GRS)?

If a temporary outage occurs with RA-GRS you can either:

Either wait for resolution of the of storage outage in that primary region and use read only data in the interim

or

If read and write is needed, you can manually copy data from the read only secondary storage account to a new storage account to have read and write access

Do I need another key to access the read-only replica data?

No, the access keys for your storage account are the same for both the primary and secondary endpoints with RA-GRS.

How do I access my RA-GRS replicated data in the secondary paired region?

1) Determine the storage account key, region, and secondary storage account URI

Open Azure Portal
Visit the RA-GRS storage account you would like to view
Click ‘Overview'
From the Overview blade, copy the storage account’s secondary region, and secondary storage account URI for use later
Grab the storage account key from the ‘Access keys’ blade

2) Create a new storage account in same region as secondary read only replica along with a new container to copy data into. This can be pre-staged or scripted.

3)Use AzCopy to copy data over from the secondary read only storage account to the newly created read/write storage account – I used Bash Shell in Azure portal since it has AzCopy for Linux already in Azure CLI

I used –recursive switch to copy everything in the read only secondary container to the new read-write container:

azcopy \
     --source https://myaccount1-secondary.blob.core.windows.net/mynewcontainer1 \
     --destination https://myaccount2.blob.core.windows.net/mynewcontainer2 \
     --source-key \
     --dest-key \

-- recursive

4)If needed, change the application over to the newly created read-write storage account URL path/access key in new region. See more on using RA-GRS in HA applications here.

The Sprint 132 Update of Azure Visual Studio Team Services (VSTS) has rolled out

Shimail Gillani — Tue, 15 May 2018 19:34:44 GMT

@Chef Gillani The Sprint 132 Update of Azure Visual Studio Team Services (VSTS) has rolled out to all accounts and includes several features to help you scale your build and release pipeline. Thanks for joining ... Shimail Ahmed Gillani Cloud Solutions Architect Microsost US Education @ChefGillani @ChefGillani

Recent MS Build 2018 - Azure DevOps Related Announcements

Shimail Gillani — Tue, 15 May 2018 19:30:23 GMT

@Chef Gillani

Azure DevOps with VSTS

by Damian Brady, Abel Wang

Container DevOps in Azure

by Steven Murawski, Jessica Deen

Building Windows – how the bits flow from check-in to the fast-ring

by Edward Thomson and Jill Campbell

Git patterns and anti-patterns for successful developers

by Edward Thomson

Analyze and report on your work using the new VSTS analytics service

by Romi Koifman

Migrating your code to the cloud – how to move from TFS to VSTS

by Rogan Ferguson

Continuous, efficient & reliable testing with integrated reporting in CI/CD

by Vinod Joshi Some Other Related News

VSTS Announcement Highlights

Thanks for joining ... Shimail Ahmed Gillani Cloud Solutions Architect Microsost US Education @ChefGillani @ChefGillani

Where can I find the latest Azure training?

markga — Sat, 05 May 2018 02:51:51 GMT

We have many free Azure training offerings available to get started learning Azure. Here are several ones I recommend to customers:

Where can I see a quick overview of Azure’s capabilities?

For getting a quick overview of Azure and its capabilities I recommend you visit this site here as it has all the Azure cloud services listed and you can drill into each one interactively:

Do you have an Azure guided learning path?

Yes, there is a guided learning path for AWS administrators, Azure Administrators, DevOps, Architects, AI, etc. here:

Do you have any good free Azure training?

Yes, we offer some excellent free training from PluralSight and we have Hands On Labs:

Free Pluralsight training here:

Great Hands on labs here and here:

Do you have any Azure Administrator/AI/Data Science certification programs?

Yes, we have a program called the Microsoft Professional Program (MPP) which is geared to ramp people looking to gain new skillsets in Azure Administration, DevOps, Big Data, AI, Data Science, and other areas which are all in demand technical skillsets in today’s workplace:

Our free Microsoft Professional Program for Azure Administrators course here:

Do you have any other training best practices to keep current with Azure?:

I recommend the following to keep current with Azure:

Watch Channel 9 Azure videos here – very useful learning
Watch Ignite Azure videos here – excellent deep dive information
Subscribe to our blog here or Azure blog here
Subscribe to the Azure updates blog for new releases here
Grab training from GitHub here

How to setup Global VNet peering in Azure

markga — Tue, 24 Apr 2018 08:57:43 GMT

Now that Global VNet peering has gone to GA I had a large university in California ask how to set this up.

What is Global VNet peering?

Global VNet peering in Azure is the ability to peer VNets or virtual networks across regions (see regional availability below).

Some benefits of Global VNet peering include:

Private Peering traffic stays on Azure network backbone
Low latency and high bandwidth VNet region to VNet region connectivity
No more VNet to VNet VPN configuration which means no VPN encryption, no gateways, no public internet necessary
No downtime setting up Global VNet peering with portal or ARM templates

What are some limitations of Global VNet peering?

You cannot use Global VNet peering to communicate with VIPs of load balancers in another region. VIP communication requires source IP to be on the same VNet as the LB IP:

Resources in one virtual network cannot communicate with the IP address of an Azure internal load balancer in the peered virtual network. The load balancer and the resources that communicate with it must be in the same virtual network.

This is a big one as it bit us with a customer. You must not check ‘use remote gateways’ or ‘allow gateway transit’ like you select when setting up intra regional VNet peering:

You cannot use remote gateways or allow gateway transit. To use remote gateways or allow gateway transit, both virtual networks in the peering must exist in the same region.

VNet Global peerings are not transitive meaning downstream VNets in one region cannot talk with downstream VNets in another region.

How do I setup Global VNet peering?

It is fairly straightforward to setup Global VNet peering and I documented the steps below:

1) Setup VNets in each region you want to Global VNet peer. There are a few Global VNet restrictions for regions see here for region restrictions. In my case, I created a VNet in US West 2 and West Central US

2) For testing create a VM in each region and associate it to a VNet you are going to use with Global VNet peering to test VM connectivity. The VMs cannot be associated with a downstream VNet as you recall since transitive downstream VNets are not supported with Global VNet peering.

3) Enable Global VNet peering:

3a) On one of the VNets you want to Global peer, go to Peerings and click Add

3b) Fill out the peering and select the VNet in the other region you want to Global Peer with – Important – don’t check any of the checkboxes!

3c) Setup peering in other direction by repeating step 3a and 3b but with the VNet peering in the other region – also don’t click any checkboxes and pick the other VNet in the other region you want to Global peer with:

4) Let it finish provisioning and then validate VNet Global peering is Connected on both VNets:

5) Test Global VNet connectivity with Telnet, PSPing or Ping Note: ensure firewalls allow ports you are telneting to, ICMP, etc.:

Test connectivity from one direction:

Then test connectivity from the other direction:

6) You are done! Congratulations Global VNet peering is complete!

7) Optional – If you need reduced latency between the regional VNets you can optionally enable Virtual Machine Accelerated Networking for Windows or for Linux

Use Azure Policy to help enforce compliance standards for your Azure deployments

Manuel Garriga - EDU — Sat, 24 Feb 2018 01:51:15 GMT

Scenario: You need to allow researchers the flexibility to create storage accounts in Azure but you want to ensure they're using security best practices. Specifically, you would like to require that secure transfer (HTTPS) be required as they transfer data in & out over the network as well as Server Side Encryption (SSE) be enforced to ensure compliance with encryption at rest requirements. Components: Azure Policy is a service in Azure that allows you to create, assign and manage policy definitions against Azure Resource Manager (ARM) resources. Azure Policy can be used to ensure you stay compliant with your standards and service level agreements. Policy Definitions can be assigned to subscription level scopes as well as resource group level scopes. These can be combined together into Policy Initiatives that help meet a compliance standard you would like to enforce. Solution: Use built-in and custom Azure Policy definitions to enforce the required practices for any newly created storage accounts in a resource group. In this scenario, I'm going to create a resource group to ensure that my policy assignments don't have unintended consequences - after all a subscription can be a pretty broad scope and I don't want to impact other admins or resources! Despite my tendency to be verbose (ask my peers!), I prefer Azure CLI because of its compactness, so that's what I'll use here.

az group create --name policydemo --location EastUS

We've got a resource group created, now let's validate that we can create a storage account in that resource group without the options that would meet our security requirements (seed the name with some numbers of your own to ensure uniqueness):

az storage account create --name notcompliant3432 --resource-group policydemo --location EastUS

Not ideal - we've confirmed we can create a storage account without any concern for our institution's best practices. Let's use Azure Policy to fix that! We'll move over to the portal and take a look at the available policy definitions to see if any might be useful for our scenario. Click All services in the upper left corner of the portal and scroll on down to the Monitoring + Management section where you'll find Policy: You'll land at the overview, which will be pretty empty if this is your first foray into Azure Policy. I'll leave it to the documentation to expand on the various options and elements available, but let's focus on the task at hand. Look for the Authoring section and click on Assignments: Let's assign a policy by clicking Assign Policy on the right side of the Policy blade. This opens up a new blade where we have to select which policy we'd like to apply. Click the ellipses next to the policy field to see the options. Scroll down a bit through the available policies and you'll see a built-in policy which looks like it'll address one of our concerns "Require blob encryption for storage accounts": Let's select that policy and change the tier to Free since we don't need to enforce against existing resources, just newly created ones. We are forced to specify a scope and it's important to specify both a subscription and a resource group (though resource group is optional) for this exercise as we're learning and don't want to disrupt other deployments as mentioned earlier: OK, so that takes care of the encryption at rest requirement, but at the time of this blog post, there isn't a built-in policy available to address the secure transport requirement. Luckily, an example with deployment template is in the documentation here. Let's deploy that into our subscription so that it appears as a custom policy in our list. Now we can assign this "require HTTPS traffic only" for blob storage accounts policy: Now, we'll set the scope and pricing tier as we did with the first policy. If everything went as planned, we have a pair of policies assigned and scoped to a resource group within your subscription that requires any new storage account to have both encryption at rest and https traffic only enabled. If not the deployment will fail. Let's test it! First, we'll try the Azure CLI command we used prior to assigning the policies - remember to change the storage account name. Last time it deployed a storage account, this time - Doh!

az storage account create --name notcompliant3433 --resource-group policydemo --location EastUS

Resource 'notcompliant3433' was disallowed by policy. Policy identifiers: '[{"policyDefinitionId":"/subscriptions/########-bff6-4b73-98b3-0e064b38ff54/providers/Microsoft.Authorization/policyDefinitions/deacdafe-4560-40a5-8eb7-1fdcadb2601b","policyAssignmentId":"/subscriptions/########-bff6-4b73-98b3-0e064b38ff54/resourceGroups/PolicyDemo/providers/Microsoft.Authorization/policyAssignments/e176a7e03ff44dedb3bb5202"},{"policyDefinitionId":"/providers/Microsoft.Authorization/policyDefinitions/7c5a74bf-ae94-4a74-8fcf-644d1e0e6e6f","policyAssignmentId":"/subscriptions/########-bff6-4b73-98b3-0e064b38ff54/resourceGroups/PolicyDemo/providers/Microsoft.Authorization/policyAssignments/e5fe344d694c4a589a53a40e"}]'.

Excellent! Even users with fully authorized RBAC roles cannot create non-compliant storage accounts in this resource group. But what about the folks that do care about security and did read the guidance I sent them? Let's try again, this time specifying https-only and encryption-services options and see what happens . . .

az storage account create --name compliant3433 --resource-group policydemo --location EastUS --https-only true --encryption-services blob

Success! Now you can go back and check for other interesting policy templates like "Allowed Locations" because a researcher may accidentally deploy a resource in Brazil South region, but that may not meet the research grant's data location requirements. The documentation does a great job of explaining the differences between RBAC and Azure Policy and offers several examples as well. My hope is that you'll feel more empowered to allow your customers the flexibility to deploy resources in Azure while maintaining your institution's compliance and governance requirements.

How can you change your default Azure AD in your subscription?

markga — Fri, 16 Feb 2018 04:55:33 GMT

There is now a new way to change your default Azure AD in your subscription. I ran into a few gotchas so I documented them below.

Why would you need to change your default Azure AD for your Azure subscription?

You might have setup your Azure subscription with the wrong Azure AD and need to switch. A common scenario I have seen is you unknowingly use your Microsoft account (joe@hotmail.com) rather than an OrgID (joe@contoso.edu) to setup the subscription and it creates a strange default Azure AD with your Hotmail name which you do not want as a default. Another common scenario is merger or divestiture and you need to switch the default Azure AD for the subscription.

Prerequisites to changing your Azure AD in your subscription

Step 1: Very Important: Make sure the ‘Service Administrator’ for the subscription is a user that is associated with the new Azure AD. If you skip this step it will create some challenges when you log into the new subscription with the new Azure AD users as it won’t list the subscription under that new Azure AD context under ‘subscriptions’

To check to go to https://ea.azure.com and check who is the current ‘Service Administrator’ for the subscription.

1a - To view ‘Service Administrator’, in the EA portal – go ‘Manage’ and ‘Subscription’ and view the Account name – if the user is a Microsoft Account or a user from the OLD Azure AD it must be changed first. If this is not changed you will not be able to manage the Azure subscription properly from any account after you change the default Azure AD.

1b – To change the ‘Service Administrator’, in the EA portal, go to ‘Manage’ and ‘Account’ and hover over the account name you need to change from. You will see four icons and you want to select the last icon is called ‘Transfer subscription’. You will want to transfer this subscription to a user that is a valid user in the new Azure AD you want to switch the subscription to (e.g. joe@contoso.edu).

Switching the default Azure AD for the Azure subscription

The new process is fairly straight forward:

Step 1: Log into Azure portal at https://portal.azure.com

Step 2: Click on ‘Subscriptions’

Step 3: Click on the subscription you want to change Azure AD on

Step 4: Click on ‘Change directory’

Step 5: Select the new target Azure AD you want to change to

Step 6a: Click ‘Change’ and wait about 10 minutes for the change to take hold

Step 6b: Important step: Note: changing your default Azure AD will remove any Subscription owners from the subscription so you will have to re-add Subscription owners and you can use the ‘Service administrator’ account you added in the previous steps and add in any Azure AD users from the new Azure AD (e.g. joe@contoso.edu) as Subscription owner

Step 7: Close all browsers to kill sessions and then log into https://portal.azure.com with NEW Azure AD credentials from new Azure AD default you switched to (e.g. joe@contoso.edu)

Step 8: Validate the new Azure AD is default – in the Azure portal go to ‘Azure Active Directory’ and the default Azure AD for that subscription should be the new one you have just switched to:

See official documentation here

Monitoring Azure Resources – Tools and Technology

Eric W. DeBord — Fri, 13 Oct 2017 04:48:53 GMT

As you think about building applications in Azure, or migrating VMs to Azure, one of the common first thoughts you might have is ‘How do my monitoring activities change once I’ve moved to Azure?’. I get this question (or a variation thereof) quite often when meeting with my customers, so I thought it would be a good idea to dig a bit deeper and provide some details around what tools are available to you. Monitoring encompasses several different, but related topics. Have you ever had any of the following questions about your infrastructure?

How is my application performing?
Is my application online and running now?
Will I get alerts when things stop working?
Who made that change to my service?
Has someone been attempting an attack on my infrastructure?
What is causing my application to slow down?
Are those packets arriving or being dropped?
Am I reaching my networking limits in my subscription?
…and many more

As you’ll see, Azure provides tools to answer all of these questions, and depending on what you are deploying in Azure, you can also bring many of your own tools. Let’s take a look at what’s available. Note: this post is rather long, but in this case, that’s a good thing! In the following post, I’ll introduce and provide links for the following monitoring tools:

Azure Monitor
Network Watcher
Application Insights
Log Analytics
Security Center
Azure Log Integration

Azure Monitor

Perhaps the best place to start is with the tool Azure Monitor. This tool can be thought of as a PaaS monitoring tool that is available to use against all services in Azure using the Azure management portal. The graphic below depicts the sources of monitoring data on the left in the purple boxes, and what can be done with this data on the right in the blue boxes. There are different levels of monitoring depending on weather you are monitoring IaaS or PaaS services. Note that data collected can be routed to other Azure services, stored in Azure blob storage, queried, visualized, or be used to kick off some type of automation using webhooks. Activity Logs A fundamental collection source is activity logs, which are logs specific to Azure platform level objects, which come from the control plane. For example, an activity log will capture activities to answers questions such as ‘Who stopped that virtual machine?’, ‘Is there an outage in US West?’, or ‘When did my App Service scale up and scale down automatically?’. The activity log will contain a significant number of log entries over time and is therefore searchable based on subscription, resource group, resource type, operation type, and timespan (among others). Activity logs are turned on and retain data for 90 days by default. Learn more about activity logs here. Diagnostics Logs In addition to activity logs, Azure Monitor provides us with diagnostic logs. Diagnostic logs operate at both a resource-level and guest OS-level. Resource-level diagnostics capture resource specific data from the Azure platform (PaaS), while OS-level diagnostics capture data from the VM, operating system, and applications running within (IaaS). Think of resource-level diagnostics as logs that help you understand what operations occurred within a resource at the platform level. The available options differ based on the resource you have chosen. For example, with a recovery services vault, you can choose to get diagnostics logs for Backup reports, Site Recovery Jobs, or Site Recovery Events, to name a few. With OS-level diagnostics you can be very specific on what you choose to capture per VM. For example, you can choose basic performance counters, or get more specific by perusing the countless counters available in the custom settings. You can also choose which logs you want to capture weather it be application logs, IIS logs, event tracing logs, etc.—you get to choose how much you want to capture. You can also capture crash dumps or send data to application insights (discussed below). Diagnostics logs are not turned on by default, you will choose per PaaS object or IaaS VM what you want to monitor. Of course, you can always use templates or scripts to define these settings for all future deployments. Learn more about diagnostics logs here. Keep in mind that with VMs, you can also continue monitoring the guest level events using tools that you’ve used on-premises. Metrics Metrics are provided by Azure Monitor to get telemetry and visibility into the performance and health of your workloads on Azure. These metrics are available for nearly all Azure resources including both PaaS and IaaS offerings. Metrics are on by default at the resource-level, which includes virtual machines. For virtual machines, this means host level telemetry is available by default. If you want to dig deeper into the metrics of the operating system and applications, then turning on diagnostics for a VM will expose these metrics to Azure Monitor for building dashboards, getting alerts, and taking action on these metrics. In the graphic below, I have used Azure Monitor Metrics to define a metrics chart for a webapp, which I later pinned to my dashboard. Read more about Metrics here. Alerts You can use Azure Monitor Alerts to take trigger-based actions on events that occur in activity logs or through metrics. For example, if I want to be alerted when a VM’s CPU sustains greater than 90% usage (Guest metrics) for 15 minutes, I can easily configure an alert. On the other hand, if I want to know if a VM is turned on (activity log), I can also be alerted to this activity. There are numerous scenarios that you’ll want to investigate. Once an alert is triggered, I can send emails, txt messages, trigger webhooks, or even run Azure Automation runbooks. Learn more about alerts here.

Azure Network Watcher

Azure Network Watcher provides many capabilities that will benefit you as you deploy and manage your Azure infrastructure. As you can see in the graphic below, Network Watcher is another tool, just like Azure Monitor, which is provided without you having to deploy anything, you simply have to enable it. Think of this tool as a network monitoring technology provided as a service. Network Watcher provides several important capabilities including: Topology As you deploy networking components and VMs in Azure, you can have a mental idea of how everything is connected, and you can spend time building out a Visio diagram, but there is a better way. Network Watcher allows you to choose a VNet from any of your subscriptions to have the tool build out a diagram of the topology. The image below shows a diagram (rendered by Network Watcher) of an ADFS infrastructure deployed as part of my ADFS Deployment Series from a while back. Note the details included for NICs, NSGs, Subnets, load balancers, etc. The tool also lets you download a copy for your own documentation and internal sharing needs. IP Flow Verify Various layers of security across VNETs, subnets, and network interface cards can make it very challenging to determine if the packets sent from a source and destination are allowed. IP Flow Verify simplifies this process by allowing you to test the flow of traffic between two sources using the protocol, the source and destination IP, and the source and destination port. If the connection is blocked, you’ll be able to see the NSG that has the rules that block it. Next hop Next hop allows you to choose a virtual machine, a network interface from that virtual machine, and finally a source and destination address. With these items chosen, click the ‘Next Hop’ button to see which route will be chosen for the destination IP address. This can be helpful if you are defining custom routes and need to make sure the routing is working as you expected. Security Group View This tool is very helpful to understand the ‘effective’ results of various Network Security Groups that impact a particular VM. With the tool you simply choose a VM, and let the tool output the effective rules as seen in the graphic below. You can then find the scope of where a particular rule is set by clicking on the tabs for subnet, NIC, and default. Note: If you have started using Security Center Just-in-time security rules, this is an interesting place to see how those are applied (rules 1000 and 1001 below were automated from Security Center JIT) Virtual Network Gateway Troubleshooting Have a VPN or ExpressRoute connection that you would like to troubleshoot? Network Watcher provides us with the capability of troubleshooting both the gateway and connections that may be experiencing issues. You will be able to see error messages and capture log data for review. Packet Capture This powerful feature allows you to capture packets as they enter or leave a virtual machine. This is useful for analysis, intrusion detection, performance monitoring, and more. You can selectively capture packets that meet certain criteria for a limited amount of time. You could also use alerts from Azure monitor to programmatically enable a packet capture scenario. Captured data can be placed in blob storage and downloaded as a standard .cap file. Connectivity Check At the time of this post, Connectivity Check is still in preview, however it is something you can use if you have preview features turned on in your subscription. The essence of this tool is to give you the ability to actually test connectivity between two VMs in Azure, or a VM in Azure and some FQDN, URI, or IPv4 address. The results returned will include a connection status of ‘reachable’ or ‘unreachable’. Network Subscription Limits This tool lets you check in and see how much of each network resource you are using and the related limits in your subscription. This can be very useful for understanding your networking footprint and what changes you may need to make as you grow your Azure footprint. Simply choose your subscription and region, and let the tool calculate the results. NSG Flows Ever wonder what traffic is flowing through a network security group? NSG flows is a logging tool that lets you turn on flow logging per NSG, choose a retention period, and then capture 5-tuple information, in JSON format, about what traffic is passing through. The output will show both allowed and denied logs, which can be helpful for troubleshooting connectivity issues, particularly if you aren’t certain of the requirements of such connections.

Application Insights

To this point, we’ve focused on monitoring Azure control plane events through Activity logs, and Guest OS level events through Azure Diagnostics. How about application level events? Application Insights is a 'monitoring as a service' solution, but specifically for Azure App Service applications. This includes WebApps, Mobile Apps, Logic Apps, etc. With Application Insights you can see page views and unique visitors, as well as failures, latency statistics, and a whole lot more. You can use the same tools as mentioned for Monitor above to export this data for alerting, viewing in PowerBI, building dashboards, triggering events, etc. In the graphic below you can see that I’ve pinned Application Insights to my favorites on the management portal. To the right of that, you’ll see the App Service applications where I’ve enabled Application Insights, and on the far right, all the tools available to me to get deep insights into my applications. You’ll want to make sure that any developers in your organization are aware of these toolsets, as this will provide significant insight into application performance and bottlenecks, while also providing useful dashboards that can output ongoing telemetry. You can learn more about Application Insights at the documentation site, but I would also advise watching the 2 minute video below to get a quick example of how it can be used. https://applicationanalyticsmedia.azureedge.net/home_page_video.mp4?v=1

Log Analytics

Most organizations have a number of tools they use to monitor their environment, some for on-premises, some for cloud, and then additional tools for niche solutions. With Azure Log Analytics, you can collect and correlate data from multiple sources to get a unified dashboard view and gain insights to detect and mitigate IT issues. Think of Azure Monitor as a way to collect and analyze data for your Azure resources, but think of Log Analytics as the tool you can use to correlate that data with data coming from other sources such as an on-premises SCOM environment, or even VMs running in other cloud platforms. In the graphic below you can see that Log Analytics can ingest data from Azure VMs (associate Azure VMs with Log Analytics with just a few clicks), from SCOM agents you already have deployed, and from VMs or physical servers where you install the agents available for download from the Log Analytics portal. All of this data ends up in a central repository that you can manually search with a rich query language. See the query language documentation to see just how powerful these interactive queries can be. The capabilities don’t end there. Log Analytics also provides canned solutions that are configured to look for specific things such as AD Replication Health events, SQL Health, AD Health, and the list goes on. See a clipping from the solutions gallery below. Using these solutions will give you immediate insight into the data you are collecting from all sources. I would recommend checking out the Azure Friday video on Azure Log Analytics, and then heading over to the official documentation to learn more.

Security Center

As organizations move their workloads to the public cloud, security becomes one of the most important areas of interest and concern. Microsoft takes security very seriously, and Azure Security Center is one example of what has resulted. Azure Security Center is a platform that helps organizations do two important tasks. First, we want to prevent attacks on our platforms by deploying secure and resilient architectures. Second, if we happen to experience some type of attack or intrusion, we want to detect it and respond appropriately. Azure Security Center gives you a set of tools to prevent and detect attacks, all centrally managed in the Azure Portal that is familiar to you. Learn how Azure Security Center detects and responds to threats on your behalf. The graphic below shows the landing page of Security Center, which provides an overview of current recommendations and events, displays tiles that depict specific information to help you prevent attacks, and details information that helps you understand security alerts and attacked resources, so you can appropriately respond. This tool also provides the ability to provide Just-In-Time (JIT) access to VMs in the cloud by automatically updating network security groups to allow connections and then closing those connections automatically after a specified period of time. In addition, you can create application white lists to allow the tool to prevent any application not on the list from being executed in your VMs. To get started with Azure Security Center and learn how you can use the tool to protect, detect, and alert you to events, see the landing page. Important Update! - Azure Security Center can now monitor your on-premises and 3rd party cloud applications!

Azure Log Integration

The Azure Log Integration service is a tool you can download and install onto a Windows Server 2008 R2 or later server, which enables you to gather raw logs from Azure resources and share those logs with third party SIEM systems. You can choose to install on a server running in your own datacenter or in Azure. Please check out the overview of the tool and detailed installation instructions to learn more. Once installed, the tool collects Windows events, Azure AD Audit logs, Azure activity logs, Azure Security Center alerts, and Azure Diagnostics logs from Azure. The graphic below depicts how the integration works with third party SIEM systems including Splunk, HP Arcsight, and IBM QRader. You can read about partner integration here.