• Users can provision resources within this Resource Group
• Users are protected from accidentally deleting resources in other Resource Groups (e.g. settings of a Virtual Network, security settings, …)

On the other hand, this approach leads to a few issues:

• With only having Contributor role on one Resource Group, you cannot create additional Resource Groups (which would be nice to structure your Azure resources).
• Some Azure Marketplace solutions require to be installed in empty Resource Groups. So, if a user already provisioned resources in “his” Resource Group, he just can’t provision these solutions.

Solution

Azure Automation lets you – among other features – configure PowerShell skripts (called Runbooks) that can run under elevated privileges allowing Contributors to call these Runbooks and perform actions they normally wouldn’t have sufficient permissions for. Such a Runbook can perform following actions (under Subscription Owner role):

1. Create a new Resource Group (name specified by a parameter)
2. Assign an AD Group (name specified by a parameter) as Contributor to this Resource Group

Necessary steps for implementing the solution

For implementing this, following steps must be taken:

• Step 1: Create an Azure Automation Account
• Step 2: Create a Run As Account with sufficient access permissions
• Step 3: Create and test a new Automation Runbook that creates Resource Groups
• Step 4: Publish the Runbook

Description of the Solution

Step 1: Create an Azure Automation Account

• In Azure Portal click on New / Monitoring + Management / Automation
  
  
  
  
• Fill in the required parameters and make sure you create a Run As account
  
  
  
  
• Confirm with Create.
  
  

For more information about creating Azure Automation Accounts see:
https://docs.microsoft.com/en-us/azure/automation/automation-quickstart-create-account

Step 2: Create a Run As Account with sufficient access permissions

• If you haven’t created the Run As Account during the creation of the Azure Automation Account, create one following this description: https://docs.microsoft.com/en-us/azure/automation/automation-create-runas-account
  
  
• Go to your Azure Automation Account
  
  
• Navigate to Connections / AzureRunAsConnection
  
  
  
  
• Now you see all the information of the service principal that the Runbook is later running under. Copy the Application ID to the clipboard.
  
  
  
  
• Navigate to the Subscription. Type “Subscriptions” into the search field of the portal.
  
  
  
  Click on Subscriptions.
  
  
• Select your Subscription. On the Subscription overview page click Access Control (IAM) / Add.
  
  
  
  
• Choose the “Owner”-Role. Enter the Application ID from the clipboard to the Select field and click on the User that gets displayed. That is the service principal from your Azure AD.
  
  
  
  
• Confirm with Save.
  
  

You have now successfully assigned Subscription Owner rights to the Service Principal created for the Azure Automation RunAs-Account the Runbook will run under.

Step 3: Create and test a new Automation Runbook that creates Resource Groups

Go back to your Automation Account.

• Select Runbooks and click on Add a Runbook.
  
  
  
  
• Select Create a new runbook.
  
  
  
  Fill in the requested fields:
  Name: <a name for your runbook>
  Runbook type: PowerShell
  Description: <some description for the runbook>
  
  
• Confirm with Create

In the editor add the following lines of code

Param(
 [string]$ResourceGroupName,
 [string]$RGGroupID
)

$connectionName = "AzureRunAsConnection"

try
{
    # Get the connection "AzureRunAsConnection "
    $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName  

    $tenantID = $servicePrincipalConnection.TenantId
    $applicationId = $servicePrincipalConnection.ApplicationId
    $certificateThumbprint = $servicePrincipalConnection.CertificateThumbprint

    "Logging in to Azure..."
    Login-AzureRmAccount `
        -ServicePrincipal `
        -TenantId $tenantID `
        -ApplicationId $applicationId `
        -CertificateThumbprint $certificateThumbprint

    New-AzureRmResourceGroup -Name $ResourceGroupName -Location 'West Europe'

    # Set the scope to the Resource Group created above
    $scope = (Get-AzureRmResourceGroup -Name $ResourceGroupName).ResourceId

    # Assign Contributor role to the group
    New-AzureRmRoleAssignment -ObjectId $RGGroupID -Scope $scope -RoleDefinitionName "Contributor"
}
catch {
   if (!$servicePrincipalConnection)
   {
      $ErrorMessage = "Connection $connectionName not found."
      throw $ErrorMessage
  } else{
      Write-Error -Message $_.Exception
      throw $_.Exception
  }
}

• Save the Runbook and click on Test Pane.
  
  
  
  
• Fill in the two parameter fields (Resource Group Name and Group ID) and click on Start.
  
  
  

This creates the Resource Group and assigns Contributor role to the Azure AD group specified. You might get an error message “Authentication_Unauthorized” because of a bug that occurs when working with a service principal. Ignore this message as the script (according to my tests) does the job.

Step 4: Publish the Runbook

• Close the test pane and click on Publish.
  
  
  
  Confirm with Yes.
  
  
• That’s it. Users can now go to the Automation Account, select the Runbook and click on Start.
  
  
  
  
• This opens the form for entering the parameters. After clicking OK, the Resource Group will be created and the group assignment will be done.
  
  
  
  

Final Words

One extension to this (runbook) could be to allow the user to enter a group name instead of the group id. This would require one additional step: an AD lookup. See the code here:

$groupID = (Get-AzureRmADGroup -SearchString $RGGroup).Id
New-AzureRmRoleAssignment -ObjectId $groupID -Scope $scope -RoleDefinitionName "Contributor"

This, however, would require giving the service principal (Run As account) access permissions to the Azure AD. That’s something I wanted to avoid here.

1. Log in to the Azure portal at https://portal.azure.com
    
2. Navigate to the App Service you would like to autoscale.
    
3. Select Scale out (App Service plan) from the menu
    
   
    
4. Click on Enable autoscale. This activates the editor for scaling rules.
    
   
    
5. Click on Add a rule. This shows a form where you can create a rule and specify details of the scaling.
    
   
    
   For the sake of simplicity, leave all values as they are, i.e.
   Metric source: <the App Service plan> (this is the Azure resource, the metric is measured from)
   Time aggregation: Average
   Metric name: CPU Percentage
   Time grain statistic: Average
   Operator: Greater than
   Threshold: 70
   Duration (in minutes): 10
   Operation: Increase count by
   Instance count: 1
   Cool down (minutes): 5
    
   This means: Constantly the average of the CPU load of the last minute is calculated. If the average of this value calculated over 10 minutes is greater than 70% one App Service instance is added to the pool. The system waits at least 5 minutes before the next scaling action takes place.
    
6. Confirm with Add. This adds the scale up rule, i.e. without any further action the App Service plan would only scale up, but never scale down.
    
7. Add another rule. Keep default values for all parameters except the following:
   Operator: Less than
   Threshold: 40
   Operation: Decrease count by
    
   This means: When CPU load average over 10 minutes goes below 40% decrease number of instances by 1.
    
8. Confirm with Add. Notice that the Instance limits are still set to their default values of 1. I.e. without further action the App Service plan wouldn’t scale because these limits set the number of instances are set to the fixed value of 1.
    
9. Change the Instance limits to the following values:
   Minimum: 1
   Maximum: 5
   Default: 2
    
   This means: Always leave at least one instance (even though CPU load might be below 40%), never scale above 5 instances (even though CPU load might be above 70%). If there is a problem with the metrics system (metrics cannot be evaluated) and the number of instances is below 2 then scale up to 2 instances.
    
   The dialog should now look like this:
    
   
    
10. Confirm everything with Save.

That’s it. Your autoscale configuration is set now, i.e. the App Service plan autoscales according to the settings you specified above.

Further information

• Application design considerations
• Related patterns and guidance
• Azure App Service Best Practices for Large Scale Applications, Video, 0:28:30
• Further information (videos, online-trainings, tools etc.) about Azure App Service on Azure InfoHub.

• Microsoft Azure Datacenter IP Ranges
  https://www.microsoft.com/en-gb/download/details.aspx?id=41653
• Azure Datacenter IP Ranges in Germany
  https://www.microsoft.com/en-us/download/details.aspx?id=54770
• Azure Datacenter IP Ranges in China
  https://www.microsoft.com/en-us/download/details.aspx?id=42064

• Microsoft Azure Datacenter IP Ranges
  https://www.microsoft.com/en-gb/download/details.aspx?id=41653
• Azure Datacenter IP Ranges in Germany
  https://www.microsoft.com/en-us/download/details.aspx?id=54770
• Azure Datacenter IP Ranges in China
  https://www.microsoft.com/en-us/download/details.aspx?id=42064

Azure News on Monday
auf der Microsoft TechWiese und dem IT Pro Hub

Meine Kollegen rund um Markus Zeischke listen dort jeden Montag die aktuellen News zu Azure und der Microsoft Cloud auf.

Zwei Folgen sind bereits online:

• Azure News on Monday (KW5)
• Azure News on Monday (KW4)

Für Azure-Interessierte gibt es allerdings eine sehr gute Alternative, um sich mit Neuigkeiten, Infos zu Videos, Whitepapers und Tools rund um Azure zu versorgen: den

Azure InfoHub

Dieser listet in deutlich höherer Frequenz alles Neue und Wissenswerte zu Azure, zudem Links zu Videos usw. auf. Letztlich war dieser auch Basis für meine wöchentlichen News-Posts.

Über konstruktives Feedback, Ideen und Wünsche zu weiteren Inhalten freue ich mich natürlich.

Hier sind nähere Infos dazu…

Aktuelle Neuigkeiten

Neue Kurse in der MVA

Neue Videos

Aktuelle Neuigkeiten

Neue Kurse in der MVA

Neue Videos

Aktuelle Neuigkeiten

Neue Kurse in der MVA

Neue Videos

Hier weitere aktuelle News Infos…

Aktuelle Neuigkeiten

Neue Videos