1. About Azure identity management. This is a super high-level fundamentals article meant to help decision makers and architects understand what Azure AD is and what’s it’s good for.
2. Understand Azure identity solutions. This next step is a drill-down into more technical terminology and concepts that implementers need to understand along with the different ways Azure AD does identity to help you make the right choice.
3. Choose a hybrid identity solution. Because I know a lot of you are going to choose hybrid identity, I figured this last article should focus on that path and guide you through the different hybrid identity options and when to use them.

start-sleep

Bonus tip: if you do all that and your custom artifact never shows up in DevTest Labs, it’s most likely your JSON file’s fault and not your shiny new script’s. Go check your syntax and try sync’ing again.

Note: When you tell a VM to pause (sleep), it’s helpful to tell it how long you’d like that pause to be. So, I’ve added a prompted parameter value in my JSON file to ask the user how long they’d like to pause the computer in seconds ($Seconds). When you have prompted values like that, you need to let the script know the value is coming and I do that in a top section (param) that you’ll see in the example. If you don’t have prompted values, then you don’t need that param section, just delete it.

param(
     [Parameter(Mandatory = $true,valueFromPipeline=$true)]
            [String] $Seconds
)
###################################################################################################
# PowerShell configurations
# NOTE: Because the $ErrorActionPreference is "Stop", this script will stop on first failure.
#      This is necessary to ensure we capture errors inside the try-catch-finally block.
$ErrorActionPreference = "Stop"

# Ensure we set the working directory to that of the script.
pushd $PSScriptRoot
###################################################################################################
# Functions used in this script.
function Handle-LastError
{
   [CmdletBinding()]
   param(
   )

   $message = $error[0].Exception.Message
   if ($message)
   {
       Write-Host -Object "ERROR: $message" -ForegroundColor Red
   }

   # IMPORTANT NOTE: Throwing a terminating error (using $ErrorActionPreference = "Stop") still
   # returns exit code zero from the PowerShell script when using -File. The workaround is to
   # NOT use -File when calling this script and leverage the try-catch-finally block and return
   # a non-zero exit code from the catch block.

   exit -1
}
###################################################################################################
# Handle all errors in this script.
trap
{
   # NOTE: This trap will handle all errors. There should be no need to use a catch below in this
   #       script, unless you want to ignore a specific error.
   Handle-LastError
}
###################################################################################################
# Main execution block.

try
{
     Start-Sleep -s "$Seconds"
}
finally
{
   popd
}

try
{
     $currentTime = Get-Date
     Write-Host "Started pause at $currentTime."
     Start-Sleep -s "$Seconds"
     $currentTime = Get-Date
     Write-Host "Pause completed at $currentTime."
}

Note: I’m using one of my own custom artifacts for this example. If you’re really curious about what it does, check out my GitHub repo docs on the subject. How I made that documentation page for my repo might be the subject of a later blog post if anyone is interested.

"$schema": "https://raw.githubusercontent.com/Azure/azure-devtestlab/master/schemas/2015-01-01/dtlArtifacts.json",

"title": "Enable directory integration in Azure AD",

"publisher": "JeffGilb",

"description": "Uses global admin credentials to enable directory sync integration in Azure AD in preparation for running Azure AD Connect.",

"iconUri": "https://raw.githubusercontent.com/jeffgilb/devtestlabs/master/artifacts/azure-enable-directory-sync/azure.png",

Tip: If you don’t include this line, a standard DevTest Labs icon will be used for your artifact.

"targetOsType": "Windows",

"tags": [
  "Azure"
],

"parameters": {
  "User": {
    "type": "string",
    "displayName": "Global admin name.",
    "description": "Azure AD tenant global administrator name."
  },
  "Password": {
    "type": "securestring",
    "displayName": "Global admin password.",
    "description": "Azure AD tenant global administrator password."
  }
},

TIP: Because we’re saying this artifact requires user input (parameters) to run, all the fields that you define here will be * Required. To make a prompted value optional for whatever reason (maybe an If/Else statement in PowerShell doesn’t need all values or something) just provide an empty default value for the item on the next line like “default”: “” or you can add an allow empty line like "allowEmpty": true if you want to display a default value, but also allow someone to blank it out when the artifact is run.

"runCommand": {
  "commandToExecute": "[concat('powershell.exe -ExecutionPolicy bypass \"& ./enableSync.ps1 -User ''', parameters('User'), ''' -Password ''', parameters('Password'), '''')]"
 }

"commandToExecute": "[concat('powershell.exe -ExecutionPolicy bypass \"& ./enableSync.ps1')]"

Using GitHub from the command line

git clone <url to your repo including the .git part>

cd <repo-name>

git remote remove origin

git remote add origin http://<your GitHub username>:<your GitHub access token>@github.com/<your full repo name>

git remote -v

Tip: This is also what Azure DevTest Labs is talking about when it asks what branch in your repo to grab artifacts from (see last post). I generally make a branch called dev to use in my development environment and just use the master (default) branch for my production DevTest labs artifact location.

git pull origin master:<branch name>

Important: here me now, believe me later: if you forget to do this before modifying your local files and then sync with the master branch you will lose everything you’ve done since creating the local branch. Make sure you checkout the working branch!

git checkout <branch name you made earlier>

git add -A

git commit -m "<comment>"

git push origin <branchname>

GitHub Desktop for the GUI lovers out there

Tip: If you don’t have GitHub Desktop installed before you hit that option, nothing is going to happen so don’t let that confuse you if you start clicking around ahead of time.

Tip: You can get up to speed on GitHub even faster if you review the full bootcamp help documentation.

Disclaimer: if you stumble upon my public GitHub repo, and clone the artifacts that I use while playing around in my personal lab, you’ll be using them at your own risk. They might not work or could disappear or change tomorrow. So, YMMV, no warranties, etc…

Tip: if you’d rather use a VSTS Git repository or are looking for more information about how to add a repo to DevTest Labs, check out the official content on docs.microsoft.com.

Tip: to create VMs running the client OS’s you’ll need an Azure subscription that include MSDN or Enterprise Dev/Test for EA.

1. Choose a base. This is where you pick an operating system. Self-explanatory.
2. Use a saved secret. The first pieces of information in this blade that you need to provide for the VM are hopefully obvious to you: the name for the VM and the user name that will be used to access it. You can manually type in a password for that user, but what is this “Use a saved secret”checkbox stuff all about? C’mon, you know, we already talked about this. Select the option to use a saved secret and then select the secret (password) that you want to use. Now you won’t have to risk entering the password incorrectly every time you create a VM—and you can use those secrets in other interesting ways with artifacts later on too.
3. Artifacts. You’re going to love these. Artifacts are basically configuration commands/scripts that you can use to customize your VM and do…well, just about anything. I’m not going to go through each of these public artifacts, check them out and select the ones you think are interesting. Don’t worry about trying to get it 100% right the first time, you can always apply artifacts to running VMs later. Also, the list of artifacts is constantly growing as people add them to the DevTest Labs GitHub repo (more on that later) and you can also use your own personal artifacts that you create—which leads us to #4.
4. Artifact Repo. Notice in the picture above that some of the available artifacts are from “My Repo” and others are from “Public Repo”. That’s because I’ve added my very own personal GitHub repo to this DevTest Labs instance so that I can use custom artifacts. For now, we’ll just focus on using the default public repo artifacts and I’ll show you how add your own GitHub repo and make custom artifacts in subsequent blog posts.

Tip: there are also some advanced options available that are out of scope for this blog post unless you have nothing else to do today, but check them out when you get comfortable with the basics. These allow you to do things like create more than one VM at a time and other cool stuff.

Tip: Using Azure VMs without DevTest Labs? That’s OK, you can auto-shutdown those now too.

Note: Of course, you’ll need an Azure subscription to use Azure DevTest Labs on a regular basis, but even if you don’t have a paid Azure subscription you can still take DevTest Labs on a test drive using a free, 30 day trial Azure account.

• Overview of subscriptions that give you Azure credits: https://www.visualstudio.com/vs/pricing/
• Azure credits by subscription type: https://azure.microsoft.com/en-us/pricing/member-offers/msdn-benefits-details/

• A new Visual Studio Professional subscription is $1,199 ($50 Azure credits per month), but only $799 for renewals. $50 monthly Azure credit means it’s basically only $200 a year (from the 2nd year on if you use all the credits each month anyway...and you will).
• A new Visual Studio Enterprise subscription ($150 Azure credits per month) is $5,999, renew at $2,569.00.
• New Visual Studio Test Professional Ssbscription ($50 Azure credits per month) is $2,169, renew at $899.
• MSDN Platforms subscription ($100 Azure credits) *

* MSDN Platforms is available exclusively through Microsoft Volume Licensing. For pricing and purchase details, contact your Microsoft account representative, Microsoft Partner, or an authorized volume licensing reseller.

• Creating your first VMs using formulas (templates) and publicly available artifacts (scripts)
• Connect your personal GitHub repo to your lab so you can use your own artifacts
• How to modify and interact with GitHub repo files to create artifacts
• How to create and modify artifact JSON files to control artifact behavior
• How to create and catch errors in artifact PowerShell files that interact with your VMs.

…and more on the way!

$User="<admin account for the AAD you want to delete>"
$Password="<Password>"
$SecurePassword = $Password | ConvertTo-SecureString -AsPlainText -Force
$msolcred = New-Object –TypeName System.Management.Automation.PSCredential ($User,$SecurePassword)
connect-msolservice -credential $msolcred

$msolcred = get-credential
connect-msolservice -credential $msolcred

Get-MsolUser –All | Export-CSV C:\temp\users.csv

Bonus Tip: you can get groups like this too, but technically you don’t have to delete them to delete your Azure AD: Get-MsolGroup –All | Export-CSV C:\temp\groups.csv.

Import-CSV C:\temp\users.csv | Remove-MsOlUser –Force

Bonus Tip #2: You can whack Azure AD groups like this too, but again, it’s not necessary to delete your AAD instance: Import-CSV C:\groups.csv | Remove-MsOlGroup –Force.

Get-MsolServicePrincipal | Select Displayname

Get-MsolServicePrincipal | Remove-MsolServicePrincipal

• Windows 10 .ISO file to create a VM. I can’t help you much with this, but I can tell you that I got mine through an MSDN subscription.
• Hyper-V to create the virtual machine image file to upload. I’m using the Hyper-V features installed on a Windows 10 laptop. No need for a server here.
• Azure AD subscription. Self-explanatory. If you’re trying to upload a VM to Azure then I’m guessing you already have one of these. If not, grab a trial. Save yourself some time and just get the entire Enterprise Mobility + Security trial. Then you’ll have other toys to play with and be able to really put your Win10 image through its paces when we're done here.
• Azure AD cmdlets and connect PowerShell to your Azure AD service. You can see how to do all that here: https://msdn.microsoft.com/library/azure/jj151815(v=azure.98).aspx#bkmk_installmodule. If you just want to grab the Azure AD cmdlets, you can do that from here: http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185. Make sure you can access your Azure AD subscription using Azure PowerShell CmdLets (its Management certificate must be installed on your local machine and azure subscription should be set using set-azuresubscription).
• Azure blob storage container configured to receive the VM image you're trying to upload. Sounds scary, but it's pretty easy to do. Just do this to create a storage account and blob container (ignore the SQL parts and pieces, you don’t need those for this): https://msdn.microsoft.com/library/dn466439(v=sql.120).aspx. Make sure your Azure storage account is in the same subscription and region as the future VM(s).

• Do not connect it to the internet while customizing the VM. Windows 10 connects to the internet and starts running system updates and app installs when setup starts up. You don’t want that to happen while prepping the image.
• Make the hard drive file a .VHD and not a .VHDX. VHDX files are not supported in Azure.
• Try to keep the VM small, but not too small. You’ll be uploading this VM to Azure so unless you just like to watch the upload script run for a very long time, try to keep the .VHD as small as possible. Pro tip: Office 365 requires at least 3GB of free disk space to install. And it also turns out that 9GB is too small for both Windows 10 and Office 365...says the guy who uploaded a 9GB VHD. Argh. I'd recommend going for a minimum of at least 10GB for a standard Win10 machine and at least 15GB if you’ll use Office 365 too. You don't need to upload a 120GB+ VHD file, but you also don't want be this guy at the end of all this (*&$*#&!):

• By default the .VHD will probably be somewhere like C:\Users\Public\Documents\Hyper-V\Virtual hard disks\<name of your VHD>. I usually copy that file to somewhere easier to find and also to be sure that I maintain a backup of the sysprepped image.
• The url to your storage container…you did create one earlier while addressing the prereqs right?...is easy to figure out. Just log into Azure and navigate to the storage account and blob container that you want the VM to eventually end up in. Now, just copy the URL: