Before we dig in, the access panel can be accessed from any
browser https://myapps.microsoft.com
this is where the users can sign in to their access panel, where they can see
the applications you gave them access to.  If they to the following link and after signing
in successfully, they will be able to see all the applications and with a
single click, they will be automatically navigated to the application.

Now if you go to the access
panel, and log in with your Azure active directory global administrator,
you will be able to see the following page. 

Now let me show you how to give access to the users for the
different applications.  Azure active
directory now has more than 2400 application pre-integrated, whether it is a
Microsoft Service or application or even non Microsoft application.  If you log in to your azure portal, scroll
down to the active directory services, kindly click on your active directory.

If you navigate to the APPLICATIONS link, you will be able
to see all the applications that are federated with your active directory on
Azure.  For sure in the beginning you won’t
have any applications existing, except if your active directory is being used
with the office 365, than automatically you will find the Office 365 exchange
and SharePoint available as shown in the following snapshot.

At the bottom of the page you will be able to see the button
“Add” where you can add other applications for your users.  Once you click on it, a pop-up window will
open, with 3 options.  The first option
is adding an application that you are currently developing, I will not cover
this in this blog post.  The second option
is to add applications from the pre integrated applications (Gallery). The third
option is to add application that is hosted on premises to give access to your
users without publishing it.

Now if you click to add an
application to your active directory, you will see all the applications
available, just click on the one of your choice and click on the finish button.

For the sake of the demo I will
add two applications, one is the “Dropbox for business” and the second one is “Facebook”.  If you go back the APPLICATIONS page you will
see the applications have been added, however that doesn’t mean that your users
have access to it right now, if they go to their access panel they will see
nothing.

Now let’s configure each
application on its own, starting with Facebook. 
If you click on the Facebook, application, you will be navigated to the
facebook application configuration where you can add users and configure the
single sign on if required.

Clicking on Configure Single
Sign-on, you will see multiple options for the enabling the single sign on, the
first one, is the password-based single sign on, where the administrator has
the privilidge to enter the credentials himself, without letting the user know
it or he can let the user enter the credentials himself.

The second option is by using
an exisiting Single Sign on, the administrator only provides the link for the application
to link it to the access panel and the user use his credentials in this case.  if you choose this option you will be required to enter the link for the application.

For more information about
the configuration of the single sing on please visit the following
link.

Now back to the facebook
configuration, and Clicking on Assign users, you will be navigated to the users
and groups page where you can assign the application to the specified users.

For the
Dropbox application, it is nearly the same however, there are some additional configuration
required.  As you can see from the
following snapshot, you can automatically enable user provisioning to DropBox.

Now after finalizing the
configuration for the applications required, and assigning the users, open the
access panel and from there you will be able to see all the kind of applications
available for the user.

In the next blog post I will cover how to add application that
will be accessible outside of your network without publishing it.  Stay tuned J

Now there is 2 ways to scale your application, whether by
scaling up or down the VM holding your workload or the second option is through
scaling out or in, the number of VMs or the number of instances holding your
workload.  Which one is the best for
you?  Actually the size of the Virtual Machine is more related to what workload is running on the Virtual Machine as for the number of instances is more related to the number of the concurrent users that will be using the workload.

So for the first option, if you want to increase the size of
the Virtual Machine or decrease it at any time you can easily do it manually
whether through the Microsoft Azure portal or using Azure PowerShell
commands.  To do it through the portal,
just go to your virtual machine configuration and there you will find the size
of the virtual machine.  There might be
some limitation on the size of the virtual machine, I mean once you create one
with a specific size, like for example a Virtual machine using the A
series.  The virtual machine will be
created in a cluster that support the A series, so when you scale the virtual
machine later on, you will only find the sizes of the series chosen at the
beginning.  For example if you started
with the A2 virtual machine size, you can scale up to A7 or scale down to A0
Virtual machine.  If you need to scale it
to another virtual machines size series, you will have to turn off the virtual
machine and recreate it again from the beginning but this time you will have
all sizes available at creation for your choice.

For the second option
the scaling out or in the number of existing instances, this can be done
through the Cloud Service of the workload. 
For more information about the Cloud Services you can find it here.  The scalability with the Cloud Service can be
done automatically unlike defining the Virtual Machine size, it is like rules
you put for the Virtual Machine CPU consumption and once it reach this level of
processing power it creates another Virtual Machines with the same workload for
you to maintain the availability of your application with the increasing
incoming users traffic.  Now there is few
things that you must do to obtain this scalability, the first thing is to have
at least 2 Virtual machines with the same workload and the same VM size up and
running, the second thing is that they must be in the same availability set.  The following snapshot is from the Cloud
Service Scale tab, where you can see all the availability sets for your
workload, and you can define the scaling metric and its associated rules.    

After changing the configuration, don’t forget to press the
save button J

What I wanted to clarify is that the Azure Cloud Services however
you work with whether as a developer or as an IT pro, its main target to group the
same instances whatever their number was or the virtual machines with the same
workload for 2 main reasons, which are load balancing and scalability.  For the load balancing, the cloud service helps
distributing the incoming traffic along your number of instances or VMs.  For the scalability, this how Microsoft Azure
is helping you to always meet your demand based on the incoming traffic, so if
the traffic increase you can scale the number of instances or Virtual Machines
to always have your services available.  

If you are moving to Microsoft
Azure, you will certainly be looking for high availability for your
applications.  As we are talking about
Microsoft Azure Virtual Machines, the infrastructure layer, then you should know
that maintaining the high availability of the virtual Machine is a shared
responsibility between the cloud provider, in our case Microsoft Azure and
between the Cloud Consumer.  As Microsoft
Azure will be managing and responsible for the infrastructure layer, in other
words, the physical layer, from servers, and network infrastructure and so on,
and you will be managing the Virtual Machine OS layer, runtime, middleware, application
and the data.  The Virtual Machine you
created might need to be updated from time to time or even might face an error
and need to be rebooted.  Here comes the
availability set.

The availability set can be created while create the Virtual
Machines, or even after.  Also the
Virtual Machine can join an availability set after being created.  To create the Availability set, you have to
go do it while creating a Virtual Machine.

Or through a Virtual Machine configuration:

After having the availability set created and ready, you will
be able to add to it new VMs or previously created ones but only if the VM is built
under the same Cloud Service in the same datacenter location.

The availability set can have multiple VM in it

If you have created a Virtual Machine on top of Azure you
will notice that you will have to create a new Cloud Service or to join
preciously created one.  The Cloud Service
will represent the DNS name for the group of the Virtual Machines or the servers’
farm you have created on Azure.  For your
Microsoft Azure account, you might have to host multiple solutions on top of
it, each one targeting different users or different target customers, with totally
different implementations.  Under the
same Cloud Service you can create Virtual Machines for Active Directory, Domain
Controller, Distributed File System (DFS)… and so on.   Plus
you can integrate your Virtual Machines with your newly developed applications
on the Azure PaaS. 

In other words to describe the how the Virtual Machine is
connected to the Cloud Services and why they are related.  The Cloud Service is mainly designed to
manage roles on Azure, whether Web Roles or Worker Roles, a layer over the
VM.  However for integration purposes and
to help you manage your farms and applications, you have the ability to put
your VMs and your applications in one Cloud Service.

Microsoft Azure Virtual Machine is based on Microsoft Azure Page
BLOB storage, which is at the end represented like an array of byte of 0 and 1,
which is used to upload and download content from Azure.  You have the power to choose the required
processing power and memory for your virtual machines with different options
known as the A instances and the D instances. 
The main differences between the A instances and the D instances are the
Processing power type and the SSD hard disks attached to the created VM, for
sure there will be differences in the prices. 
For more information about the Virtual Machines pricing details, kindly
go to this link. 

Once you create the Virtual Machine you will have the OS
disks with limited storage which is recommended to leave for the OS only and
you will have the capability to attach empty, uploaded or previously created
Disks for the different applications and storage for your use, will go through
all of this in my coming demos.  Kindly
note that the disk maximum capacity is 1 terabyte per disk up to 16 disks per
Virtual Machine which is up to 16 terabytes per Virtual Machine.  However you have to take care that with the
increasing number of Disks you will also have to increase the processing power
and the RAM of the VM.  For more information,
you can find them in the
following link.

Now let start by creating your first Virtual Machine with
Microsoft Windows Server 2012 Datacenter on top of it, there are two way to do
so, the first quick one is the quick create:

And the second one, which give you the full control on the
Virtual Machine step by step, but take some time.  Click on New, Compute, Virtual Machine, From
Gallery:

Under “All”, you can find all the OS supported by Microsoft,
whether based on MS technology or not, to run on Microsoft Azure VMs, at the
end of list, you can find the list “My Images” and “My Disks”.  The “My Images” are the list of the
previously created Azure VM which you captured a snapshot of the whole VM.  You can later on create new ones based on
this image.

For the disks, this is most of the time represents the data
disks attached to previously created VMs or uploaded ones from your infrastructure
to the Cloud.  It also can be an OS disk
uploaded to your Azure account, a specially customized one, a migrated VM.  Where you can initialize a new VM based on
it.

For the Demo purpose, we will choose the first choice which
is the Windows Server 2012 R2 Data center, and click on next.

In this step you will be asked to enter some details and
information like, the username and password, choose the size of the VM.  For the Tier there is for sure differences
between the basic and the standard Tier. 
If you are looking for testing and so on then I recommend you choose the
basic one, however for production and driving pilots the standard one is yours
for sure.  For more information about the
differences between the 2 tiers, I recommend you check the following
link. 

And here comes the third step, which requires you to do the
configuration required for the VM, like if you want a new Cloud Services or if
it is going to join an existing one, the location where you want to host the
Virtual Machine, the Storage account as the Virtual Machines on Azure are based
on the BLOB storage.  For the Endpoints, they
are mainly for configuring the incoming traffic firewall, the thing here is the
endpoint has both public and private port, for security issues, the private
port might not be the best thing to share, except for sure the HTTP and the
HTTPS.  One main additional thing, you
can configure the Endpoint to be load balanced between multiple VM in the same
availability set.

The last step for the VM wizard, is required for those who
will install Security Extensions on top of their VMs or for those who will
configure some extensions using Microsoft and non-Microsoft tools like the
Puppet Enterprise Agent and the Chef.  For
the Microsoft Custom Script, it is PowerShell script you can directly run on a
VM to make the required configuration on the VM, rather than doing it couple of
times on different VMs.

With the integration of the different tools of Microsoft,
now you can create and monitor some of your Azure Services through Microsoft
Visual Studio.  Just open your Server
Explorer in Visual Studio and you will be able to add your Azure account to it,
monitor, develop and create new services like the following snapshot.

Now to create a new Virtual Machine through Visual Studio,
go to the Virtual Machines under the Azure tab, right click on it and click on “Create
Virtual Machine”:

You
will be prompted a new window for Virtual Machine Creation, first of all asking
which Microsoft Azure account you want to create your Virtual Machine in

The next step, like the one you are creating through the portal, which
Image of OS you want to have on your VM:

Next you will be asked to provide the required Virtual
Machine configuration out of the available list:

For the Cloud Service, networks, and storage account, you
will be able to make the VM to join previously created Cloud Service, Network,
Storage account, or even Availability set. 
But you will be able to create only Cloud Service and storage account
through Visual Studio.  For the
availability set and the network, if they were not created you will have to do
this step through the Azure portal.

Last step is the configuration of the Endpoints for your
Virtual Machine, like the steps we have done on the portal, but this time you
will have to do it through Visual Studio:

Once you click on Create the Virtual Machine will start provisioning
on Azure and after couple of minute, you will get the message of the
confirmation of the creation of the VM.

For more information about
the Availability Set and Cloud Service, kindly go to Microsoft Azure
infrastructure as a Service – Part 2.

Let’s first understand what is the Multi-factor
authentication or the MFA.  The MFA is a
way to authenticate the user trying to sign in to an application whether it was
a web application or non-browser application, through different ways defined by
the user.  The first option is through a
call, the user will receive a call where he can get a code to enter to get
authenticated by the application, the second option is through SMS and the
third one is through a mobile application.

If you open your Azure Active Directory, like we
previously did, you will be able to see all the user created under the
users section.

If you click on the global administrator, you will be able
to see two buttons at the end of the page, for adding new user and for the
selected user MFA configuration.  If you
choose the Microsoft Azure AD User previously created in our scenarios “hhaggan”,
you will be able to see 4 buttons at the bottom of the page, the normal ones
and 2 others for resetting user password and the user delete button.  For the demo purpose we will work on the MFA
one.  Once you click on the Multi-factor
authentication, another page in the browser will open up asking for your
account credentials.  After you enter
them, you will be able to see a similar page:

As we are focusing now on the “hhaggan” account, you can now
see the MFA status for this account that is has been enabled.  If you click on the check box at the left
most of the “hhaggan” account you will be able to see the following options:

Simply they will give you the ability to disable the MFA
setting for the user, or whether you want to enforce it, like the following
snapshots

If you click on the Enforce multi-factor auth button, the
operation might take some time and you will be prompted the following window:

Wait couple of seconds, until you get a confirmation message
with the update that has been done on the user:

The last step you can do on the user account is on the “Manage
User Settings”, like the following snapshot:

At the top of the page, let’s go to the Service setting, this
is where you as a Global administrator for your AD Premium and the MFA, this is
where you can allow the user to have App passwords for non-browser applications
or disable this functionalities.  You also
have the capability to allow the user to stop receiving MFA notifications for a
certain period of time defined by the global administrator.

Let’s get a bit in depth, to start working with the
Microsoft Azure AD Premium you don’t need to purchase one, you can start the
trial account, for 90 days, which gives you a limited number of users but to
give you a taste about what is the Microsoft Active Directory premium is all
about.  To create your Active directory
if you don’t have one, just go to New, App Services, Active Directory,
Directory and click on Custom Create, like the following snapshot:

A new small window will prompt, asking for some information
to be entered like if you want to integrate the new created directory with any
previously created ones, the name, URL and the country or the region where most
of the user will log in:

Once you have your active directory created, which nearly
takes couple of seconds you go in, add new users, new groups, new applications,
new domains etc… will go through all those right way, but first you need to
have your AD premium ready, as for now, we only have the free version. So to
activate your trial account, log in to your Azure portal and scroll down to the
AD section, go to your AD and then you find licenses tab at the right most of
the page, if you click on it you will be able to see the licenses you have for
this directory.  You can click on “Try Azure Active Directory Premium
Now”

After it finished the
creation, you can see the number of users created for Azure Active Directory
Premium, the licenses and the active units

Now let’s go to the
users section, you will see the added user to the directory which is actually
the global administrator.  At the bottom
of the page you will see two buttons, one for adding new users and the second
for managing the Multifactor authentication for the selected user.  Let’s start by adding new user, at the bottom
of the page, click on Add User:

A new windows will
pop up asking for some information about the user, whether he is a new user to
the organization or previously added to another Microsoft Azure AD or if he
does have a Microsoft Account.  For the
purpose of the blog, will add new user to the organization, enter his email
address.

The next step will be
the user profile data, first, last and display name, the role and at the end if
you want to enable this user for the MFA.

If you have checked
on the checkbox for the MFA, you will see the following message above the
window that the user will need to create an app password for the non-browser
applications.

Last step, or last
window, which will you have to do as mandatory step to create the user, is to
create him a temporary password which will be sent to him via email later on.

After you press
create, the password will take couple of seconds to be created.  After that he will ask you the emails you
want to send the passwords to.

Congratulations you
have created the first user on your Azure Active Directory.  Now he still is not assigned in the Microsoft
Azure Active Directory Premium.

Click on the Azure
Active Directory Premium, you wont see anyone in the assigned users.  To add new user to the AD Premium, from the
top of the page, select the group you want to see, and choose all

Now you will be able to see the 2 users in our Active
Directory.  To assign new users to the AD
Premium, choose the user you want to assign him then click on the button at the
bottom of the page “Assign”. It will take a couple of seconds and here we, you
have your first user created and assigned in the AD Premium.

Microsoft Azure Active Directory part 2 is about the configuration for the
MFA for users created on Azure Active Directory.

In the following couple of snapshots, I will explain the
importance of the EMS (Enterprise Mobility Suite).  With the increasing number of users, it is
very hard to put a limitation on the devices that they are using or prevent
them to access the work applications from different devices as they might need
to do so on their move.  Especially with
the variety of the different operating systems, and with the integration with
nearly all the applications with the different Operating systems, accessing
data anywhere and from everywhere.  These
applications will enable the user to have the different insights and updates
about its business on his move.

The first thing you have to know about it is the Microsoft
Azure Active Directory Premium, which I believe is one of the strongest and powerful
service for the identity.  If you have an
office 365 or CRM online account then you will be using Active Directory in for
your user authentications. As I believe all these customers as they are already
using the Active directory they should think very well about taking this to the
next level, which is AD premium.  Plus
the basic functionalities that the basic Azure Active Directory gives you, it
can add the following services:

• Multifactor-authentication
• Self-Password reset
• Single Sign on for more
  than 2400 apps
• Company branding
• Advanced Security reports
• SLA and way more, you can
  find all the differences here.

The second thing is the MFA (Multi factor Authentication),
you can have the MFA as part of the AD premium or you can have it as a
standalone service, helping you having a secure way for securing the access to
your environment in one or more method. 
The main difference here between the office 365 MFA and the Azure MFA
that Azure MFA can be integrated with Microsoft Applications or non-Microsoft
Applications and has its own SDK for further integration between the MFA and
newly developed application.

The last service which is the RMS (rights management
Services), like the MFA, you can have the Azure RMS service as a standalone service
or as part of the AD premium.  The thing
here is when you start using the RMS you are only allowed to use it internally,
you can force using the RMS for the employees in your domain.  For the Azure RMS, it gives you the ability
to expand this and to share the files you want to share them with internal
users and even externals.  So even if you
share the documents to external people using Azure RMS, they can only do what
the permissions allow them to do.

For more information about the Enterprise mobility, I
recommend reading the Enabling
Enterprise Mobility Whitepaper.

For more information about the different offering for the
EMS solutions, you can find all the details here.

For more information about the pricing for the EMS services,
you can find them here.

The second big move for Azure was getting more in the market
with the infrastructure as a services targeting the IT pros too to join and be
able to host their different platforms and applications on Azure Virtual
Machines.  Plus Microsoft Azure is
offering the best hybrid Cloud solutions for the enterprises with different
scenarios empowering the customer to take more control on his data and
applications and the same time to cut cost for its IT infrastructure.

Microsoft Azure has mainly 4 main service categories,
starting with the data, compute, Networks and App Services that you can add and
bind to your applications.  If you go to
Microsoft Azure documentation,
you will find that all Microsoft Azure services and mainly categorized under
these 4 service categories.  The compute
services are all the services where the IT pros or the developer can use the
processing power of Azure to run on top of its solution like the virtual
machines for the infrastructure and the cloud services for the Platform.  The compute services guarantee its consumer
to host the solution with high availability.

The data services mainly its users are the developers, they
need to know and understand the different type of data services from technical
and also from a pricing perspective. 
This where you can scale your data as much as you need.  Microsoft Azure provides three data types,
the structured data which is known as the Microsoft Azure Database, unstructured
data which is like an array of zeros and ones known on Azure as BLOB (Binary
Large Object) mainly used for the different type of files and at the end the
semi structured which is a bit like non relation tables with the ability of
scaling up to terabytes.  For sure will
cover each one of them in a blog post later for more clarification and with all
related services.

The Network services most of the time used by the IT pros
where they can build virtual network on top of Microsoft Azure linking multiple
Virtual machines together under one or more subnet, or even more building
Virtual private network between Azure and their IT infrastructure.

The last group of services are the app service, which are a
group of services that you can choose one of them or multiple of them to help
you build better solutions on Azure whether you were an IT pros or a developer.

These are in brief Microsoft Azure services, now talking
about Microsoft Azure data centers. 
Azure nowadays exists around the globe in different datacenters.  Azure has so far 17 datacenters worldwide,
you might not have access to all of them, some of them might be not yet
available for public usage. The developer or IT pros has the power to choose
where to host his solution depending on his target customers locations for the
best performance.  Also Microsoft Azure
has more CDNs
(Content Delivery Network) around the globe which helps sending the required
data or applications to the customer in a faster way.

In this blog, I will show you how to start working with Microsoft Azure different Services.