Common misconception. Existing applications needs to be rewritten to successfully work in Azure, or Azure is really only for new application efforts that are specifically targeted for the Azure cloud computing platform.

Reality. While there’s some traditional application techniques that will need tweaking/resolution before successfully moving to the cloud (i.e. statefull architectures holding session data in server memory), the reality is Azure is quite flexible and can be configured to handle many existing scenarios. Finserv ISV applications come in all shapes and sizes and most applications typically have 3^rd party dependencies. These kinds of applications can be migrated to the Azure public cloud. This blog will explain how in some level of detail.

Windows Azure is broken up into core functional services such as Compute, Storage, and the Fabric Controller. The compute service is the virtual machines that run your business logic. Ultimately Azure compute is a set of specialized Windows Server2008 R2 hyper-v instances that a customer rents for their application processing needs. Azure also provides relational (SQL Azure) and non-relational storage (Azure Storage) services, which are separate from the core compute service. Windows Azure compute is broken into 3 different types of roles, where an application can execute multiple instances of each role. The available roles are: (https://www.microsoft.com/windowsazure/compute/default.aspx)

• Web Role. Virtual machine designed to handle web requests where IIS (Internet Information Services) is used as the web server. Typically a web role is used for HTTP or HTTPS type functionality.
• Worker Role. Virtual machine designed to handle arbitrary tasks or anything where IIS is not used as the web server. Sometimes these are background tasks, and sometimes this role is used for running non-IIS web servers.
• VM Role. This is a customer built Windows Server 2008 R2 virtual image, where the customer preconfigures and loads a ready-to-run virtual image. Note. This is not “infrastructure as a Service” (IaaS) where you rent a virtual machine instance and have full control over it. More on this below.

Microsoft is very clear that Azure is “platform as a service”, not “infrastructure as a service”, which means that although you are renting virtual machine processing power, the Azure platform manages those virtual machines for you and manages the virtual machine lifetime. This is handled by the Azure Fabric Controller. This service is essentially the brains of Windows Azure. A useful metaphor is that if Windows is an operating system for a server, Windows Azure is an operating system for a data center. The fabric controller is the core of Windows Azure. It handles starting up your Azure role instances (each instance is a separate virtual machine), moving your application over to the virtual machine (in the web and worker role cases), upgrading the virtual machine (web and worker role cases), and managing physical hardware failures. Windows Azure load balances requests across two or more instances of your running application (2 or more role instances), and the fabric controller can at any time pull a virtual machine out of the load balanced cluster, and put a new one in (with your software). Because of this, you can never assume that something sitting in memory on a particular virtual machine instance is still in memory, but what you can assume is that Azure will keep multiple instances of each role running, load balancing requests, and safe from hardware failures. It’s an amazing platform designed for scale, automation, and self-service.

So what does this all mean from the application migration perspective? One of the confusing aspects of Azure when it first appeared was how to migrate existing applications that involved lots of configuration and 3^rd party components. Azure was best served for traditional pure .NET applications. This is no longer the case. An Azure web role and worker role are essentially wiped clean each time a role instance is started by the Azure fabric controller. Your software is migrated to the instance during an initialization step that happens went the role instance starts up. So the question is how can 3^rd party components get installed, and what if the application has configuration requirements like registry settings, Windows services, or other types of required scripting? Windows Azure allows for “Startup Tasks” to execute on a particular role before the role actually runs and receives requests.  https://msdn.microsoft.com/en-us/library/gg456327.aspx. Startup tasks provide the ability to run executable code as part of starting up and configuring a role and these tasks can run as the administrator on the machine and have the necessary access to the machine. With startup tasks, your configuration can do things like install other 3^rd party software, access the registry and other requirements to get the software properly configured. In addition to startup tasks, Azure also provides the ability to fully configure IIS on a web role for things like multiple websites, virtual directories, and other IIS required configurations. More on full IIS capabilities here: https://blogs.msdn.com/b/windowsazure/archive/2010/12/02/new-full-iis-capabilities-differences-from-hosted-web-core.aspx.

Recently working with a finserv ISV to migrate existing functionality to Azure, the particular company used a 3^rd party web server, Apache, as part of their software. Clearly Apache is not a standard component used in a .NET application, so what options did this ISV have for migrating this solution? Turns out Azure is quite flexible and agile in how it handles non Microsoft application components, and something like Apache works just fine on Azure. The requirement is that the software must run on Windows Server 2008 R2, which is a 64-bit operating system. Assuming it works under those requirements, chances are good that it will work on Azure (assuming it follows cloud conventions like not holding session state in memory, etc.). As noted above, Azure has a Web role, and Worker role virtual machine instance type. The main difference is that a web role comes configured with IIS and a worker role does not. So to use Apache as a webserver you leverage an Azure Worker role (because you’re not using IIS), create a startup task to install and configure Apache, open up an input TCP endpoint for Apache’s incoming requests, and run your application. More information on this concept here: https://blog.smarx.com/posts/using-other-web-servers-on-windows-azure. Bottom line is that Azure does not require Microsoft application server stack technologies. It can run unmanaged C++, Java, PHP, and most software that will run on Windows Server 2008 R2.

Another great new feature of Azure is the ability to remote desktop connect to the virtual machine instances themselves. Through remote desktop, you can logon to each instance after it is setup and running in Azure. The benefit to verify and make sure everything you installed and configured was setup correctly. It has some testing benefits as well, however, a manual change made to the virtual image through remote desktop will be lost once the fabric controller removes and starts a fresh VM instance. So remote desktop should not be used for manually installing or configuring software, but it is very useful for testing and verifying the migration of a software solution. Any configuration change needs to be properly scripted as part of a startup task to ensure it happens every time the VM instance is started by Azure.

Given Azure is very flexible for moving existing logic to Web and Worker roles, what is the point of the VM Role? The VM allows a customer to setup and configure their software locally by building their own virtual machine VHD image and uploading that image to Azure. The benefit is you can build and setup everything beforehand and have Azure run your own custom instance. That said, a VM Role behaves similar to a Web and Worker role where the Azure fabric controller controls the lifetime of the instance, and anything left in memory could be removed at any moment by the fabric controller (if it restarts a VM instance), so a stateless architecture is still required. This is why a VM Role instance is considered part of the Azure PaaS architecture, and is not true IaaS. The downside of a VM role is that Azure can no longer patch the operating system and update the image. You are now required to do this yourself, and upload the patched images manually (VM Role does support Differencing VHDs).

What is the best practice on when to use a VM Role, and when to use a Web/Worker role? Do to the great new set of application migration features provided by Azure startup tasks and full IIS configurability, the best practice is as follows:

• Attempt to use a Web/Worker role first and leverage startup tasks. Startup tasks can be used for most installation and configuration requirements. Web and Worker roles are advantageous to truly get the most benefit of running in the powerful Azure PaaS environment. Web an Worker roles are properly patched and upgraded as part of the platform.
• Use a VM Role when the installation is very complicated and simply cannot be scripted with startup tasks. Perhaps the 3^rd party software installation does not have an unattended option, or it just takes too long to install the 3^rd party components. This was the scenario the VM Role was designed to solve.

Hopefully you now have a better idea of the powerful and flexible environment provided by Windows Azure. It is not just for new application development as it supports a wide variety of migration options that should help financial services institutions and partners quickly obtain the economic benefits of the public cloud. In the future I’ll blog about security, integration, and storage options as they pertain to financial services.

https://www.microsoft.com/showcase/en/us/details/b0c5bf4c-be16-4d88-938d-2fda9ab406c4

https://academyliv.vo.msecnd.net/CAL/FSI01CAL/20100113-CAL-FSI01CAL-WMV.wmv

https://mediadl.microsoft.com/MediaDL/WWW/I/industry/financialservices/livemeeting.wmv 

<?xml version="1.0" encoding="utf-8"?> 

<access-policy>

  <cross-domain-access>

    <policy>

      <allow-from http-request-headers="*">

                <domain uri="https://*" />

                <domain uri="https://*" />

      </allow-from>

      <grant-to>

        <resource path="/" include-subpaths="true"/>

      </grant-to>

    </policy>

  </cross-domain-access>

</access-policy>

Chris Bertelsen, an architect from Protective Life, delivered a presentation how how Protective is leverage our software factory for ACORD standards (located here: https://www.codeplex.com/IVC) is being leveraged by his organization to enable internal and external interop scenarios. I also presented with Chris and showed a demonstration of the software factory as well as recent improvements. The video of the presentation can be downloaded here: https://www.acordlomaforum.org/2009/presentations/bertelsen.mov. Additionally, If you're interested in ACORD's new framework models, here's a great presentation from ACORD's Frank Neugebauer,  https://www.acordlomaforum.org/2009/presentations/acord_framework.mov .  

If anyone would like to watch a 9 minute overview of the ways Microsoft is working with the insurance industry, here's a great interview between ACORD, Bill Hartnett (Microsoft Insurance Director), and myself. Bill really communicates our message well. Select this link below and then scroll down to ISF 2009-Microsoft.  : https://acord.a.mms.mavenapps.net/mms/rt/1/site/acord-pub01-live/current/launch.html?maven_playerId=videoacordorg1&maven_referralParentPlaylistId=17d30dc4a293d6f6a980d6a829c0595811628636&maven_referralPlaylistId=47e1c8880ecbeb35ace829fe6998d63d67b1630a&maven_referralObject=5460976

The core theme of our showcased technologies this year at ACORD was Cloud Computing. Everything we showed this year from SharePoint to Silverlight can run on premises or in the cloud with Microsoft Azure. Recently I did a webcast on Microsoft Azure to our ISV partners and its publically available here for anyone interested.  https://mediadl.microsoft.com/MediaDL/WWW/I/industry/financialservices/livemeeting.wmv .

·         Generally it's a total mess! 

Thanks to Windows 7 RC0 and Windows Server 2008 R2 RC0 -- it’s beautiful.  Here’s the configuration.  Note: you need a 64-bit machine with a minimum 4GB of RAM for this.

My hardware (this is all I need at any one time – nothing more)

·         Lenovo T61p (dual core)  64-bit

·         4 GB RAM

·         180 GB SATA Hard disk – primary

·         100 GB SATA Hard disk – external drive bay (swappable with a DVD drive)

Here’s what I did. 

1.       Build the base Windows 7 workstation. 

a.       Install Windows 7 64-bit on the 180 GB SATA drive with only 1 partition. One of the beautiful things about this is I never need to partition my main harddrive into a bunch of different bootable partitions.  1 partition (180 GB), formatted the harddrive, installed Windows – that’s it.

b.      Added everything I needed.  Office, Visual Studio, SQL Server, whatever you typically use for your job.  Add the machine to your corporate domain, etc.

2.       Build the demo Windows Server 2008 R2 environment.  Build a bootable VHD.

a.       Goal:  Now that we have Windows 7 installed on our main hard drive, we’re going to build a Windows 2008 R2 bootable VHD with Hyper-V, and eventually this will be a single file sitting on main harddrive (no partition necessary).  So now build the VHD file.

b.      I pulled out the 180 GB harddrive and replaced it with the 100.  You can use a backup harddrive if you have an extra one (I only have 2).  Put in your Server 2008 R2 DVD or ISO image. 

c.       Follow these instructions on building a Windows 2008 R2 bootable VHD.  https://blogs.technet.com/keithcombs/archive/2009/05/22/dual-boot-from-vhd-using-windows-7-and-windows-server-2008-r2.aspx .  Good blog here from Keith Combs.

d.      Install Server 2008 into the VHD, setup that environment (you can configure it now or later).  My VHD is about 10 GB in size, it has Office on it, it’s part of the corporate domain, and I added the Hyper-v role (this is important obviously).

e.      Note: I made my VHD expandable up to 30GB, as I’m not going to store that much in the VHD.

3.       Configure the base Win7 environment for booting to the VHD

a.       When my machine starts, I want to be able to decide whether to boot Windows  7 or Server 2008 Hyper-v environment.  So I put the 180 GB Win7 harddrive back in, and booted that environment back up.

b.      Next – copy the new VHD file over and drop it on your C:\ drive somewhere (so it’s on the 180 GB main drive).  When it’s copied over – I cleaned down and reformatted my 100 GB external drive bay drive.  This will store my Hyper-v images.

c.       Use bcdedit.exe to configure the VHD boot option.  There’s lots of blogs on this, but basically it’s really simple and will take 2 minutes.

bcdedit /copy {current} /d “Server2008_VHD”

Run bcdedit.exe, copy the CSLID for the new entry, and paste it in below

bcdedit /set {CLSID} device vhd=[C:]\Server2008.vhd

bcdedit /set {CLSID} osdevice vhd=[C:]\ Server2008.vhd

bcdedit /set {CLSID} detecthal on 

Replace [C:]\ Server2008.vhd with the path and name of your VHD.

d.      Now reboot, and you should get prompted to either Windows 7 (default), or Windows 2008 (from this VHD).

Why is this so cool?

·         Now I can be in Windows 7 all day working, and when needed, I can switch over to a hyper-v demo environment.

·         When I boot to Server2008 – I get access to ALL OF MY FILES on my Windows7 C:\ drive, so I have everything in either place.  Server 2008 is also part of my corporate domain, so I have email, Office, all my documents, Office Communicator, etc. In fact, I could stay in Server2008 all day if needed.

·         I put all of my important hyper-v demo images on my 100 GB SATA drive.  I can now start them up, even start up more than one once at once – and the performance is unbelievable.  Feels like they are natively running thanks to Hyper-v and the SATA external drive bay (cuts out the harddrive contention – that’s why the hyper-v images are NOT sitting on my main C drive).  I have many large Server 2003 images with SharePoint, BizTalk, CRM, SQL etc….excellent perf.

·         No USB drives needed, everything's contained!

Great news -- figured out a solution for this.  The reason the XBOX extender cannot connect back to the MC is indeed due to it trying to use MACHINE\MCX1 and failing.  This is a special account that all extenders will use -- and you can't change it.  The reason it fails is RDP.  Before joining the domain, I could RDP to the MC with the MCX1 account (or any local machine account), but after joining, I can't.  Turns out the extender uses a derivative of RDP to connect to the MC, so that's the problem.  On the MC box, MCX1 is added to the remote desktop users list in ControlPanel-->System-->Remote, so that wasn't the problem.  The problem is that if you look at the LocalPolicy on the MC box (control panel --> administrative tools --> local security policy -->  local policy --> user rights assignment --> allow logon through terminal services), the "allow logon through terminal services" policy doesn't have "Remote Desktop Users" in the list.  My AD domain is a basic default domain with no special policies set.  However when I joined the MC machine to the domain, it removed "Remote Desktop Users" from this policy, and also disabled the "Add User or Group" button to allow me to re-add it.  Without this group in the permission list, MCX1 cannot RDP to the MC box from the XBOX extender. 

Solution is to edit the domain policy on the domain controller.  I edited the "allow logon through terminal services" policy for both the default domain policy and default domain controller policy.  I added "Remote Desktop Users" group to the list on the domain, then I did a "gpupdate /force" on both the domain controller and the MC box.  After gpupdate, I logged out of the MC box and logged back in.  When back into local policy to see if the "Remote Desktop Users" was in the list -- and it was.  Once that shows up in the list, now any user in that group can RDP.  The extenders now work again!