Business Applications

	SEO Panel is open source SEO management software, with an automated dashboard that makes tracking SEO metrics on multiple websites simple.
	CiviCRM is an open source constituent relationship management solution designed specifically to meet the needs of advocacy, non-profit and non-governmental groups. Bitnami has integrated CiviCRM with the Drupal content management system.
	SugarCRM is a flexible customer relationship management solution that can easily be customized and integrated with other software. It includes sales force automation, marketing campaigns, support cases, and more.
	ERPNext is an open source, web based application that helps small and medium sized business manage their accounting, inventory, sales, purchase, administration, project, customer support and website.
	JasperReports Server is a stand-alone and embeddable reporting server. It provides reporting and analytics that can be embedded into a web or mobile application as well as operate as a central information hub for the enterprise.
	Moodle is a Course Management System that is designed using sound pedagogical principles to help educators create effective online learning communities. It can scale from one computer to a 50,000-student university and is used in over 175 countries.

Web Content Management and eCommerce Solutions

	Magento is a feature-rich flexible e-commerce solution. It includes transaction options, multi-store functionality, loyalty programs, product categorization and shopper filtering, promotion rules, and more.
	Drupal is a content management platform that allows users to easily publish, manage and organize content. It is used for community web portals, discussion sites, corporate web sites and more. It is easy to extend by plugging in modules.
	Alfresco Community is an Enterprise Content Management (ECM) system featuring document management, web content management, collaboration management, records management and image management.
	Joomla! is an award-winning content management system that can be used to build personal/corporate websites or portals, small business websites, non-profit and organizational websites.
	WordPress is a popular blogging software and powers more than 10% of all websites globally. Thousands of free and commercial themes and plugins are available to extend and personalize WordPress for just about every situation

Developer Tools

	Apache ActiveMQ is an open source message broker written in Java together with a full Java Message Service (JMS) client.
	DreamFactory is a popular open source REST API platform for mobile enterprise application developers. DreamFactory enables developers to quickly connect any SQL or NoSQL database or File Storage system to any tablet, phone, or other device with a comprehensive palette of RESTful services.
	Bitnami Elasticsearch Stack is a pre-configured, ready to run image for running Elasticsearch on Microsoft Azure. Flexible and powerful open source, distributed real-time search and analytics engine.
	GitLab is self-hosted Git management software that is fast, secure, and based on Ruby on Rails. GitLab CI (also included) is an open-source Continuous Integration (CI) server closely integrated with Git and GitLab.
	Jenkins CI is an open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based projects as well as arbitrary scripts. This version of Jenkins includes a preconfigured Windows Azure Storage plugin that allows you to manage artefact storage in Windows Azure Blob objects.

Always Start with a Virtual Network

Understand Availability Sets

Creating the Infrastructure

Create a Resource Group and Virtual Network

1. Start by creating a new Resource Group. On the left menu click Browse->Resource Groups-> New.  We will place all of our resources into this resource group. Doing this allows us to control everything within our app, like apply access rights, tear down the entire application or export the template for future deployments.
2. Next create a new Virtual Network (VNet). Browse-> Virtual Networks-> New. Change the subnet to appsubnet and select the resource group created earlier. I always change the address range to 10.1.1.0/24 so that my web servers have an IP address of 10.1.1.x making it easy to identify them. In the next step we will create a subnet for the database tier with the range 10.1.2.x.
3. Browse to the VNet just created and then click settings and then subnets. Create a subnet called dbsubnet with the address range 10.1.2.0/24.

Creating the WordPress Virtual Machines

1. On the left menu click 'New' and type BitNami Wordpress into the search bar and press return. This is a free pre-packaged image with WordPress installed and configured. On the screen that follows click the WordPress image and then click create.
2. Enter a name and access details for the VM. Make sure to select the resource group you created earlier and the data centre region you would like to place the VM in.
3. Click OK and select an appropriate instance size. Make sure to choose a standard type rather than Basic so that you can take advantage of load balancing. For example, A1.
4. On the settings page, choose standard storage and select the VNet and appsubnet created earlier. The VM will be assigned an internal IP based on the subnet range defined. It will also be assigned a public IP address which we don't want, so click on public IP address and select none.
5. Click on the Network Security Group settings and notice the rules that have been setup. For now accept the defaults.
6. Finally click on the Availability Set settings and enter a new availability set and enter 2 for both fault and update domains. You can of course choose more if required.
7. Click OK twice and then purchase. You are presented with this screen as you selected a third party VM image, however, there is no cost to this.
8. Repeat the above procedure for a second WordPress VM accept select the availability set just created.
9. Now click Browse -> Load Balancers -> Add and create a new load balancer with a public IP address. Here you have the option to name the IP address but you must use a Microsoft owned IP rather than bring your own. Select static if you would like to keep this IP reserved even if this load balancer is deleted. You may want to do this if you want to use an A record to point your domain name to this site. Make note of this IP address as this will be used to access your WordPress site.
10. Now browse to the load balancer just created and click on Backend Pools and click add.
11. Enter a name for the WordPress VM pool that this load balancer will manage. Then click add virtual machine and use the availability set method to add both VMs created earlier to the pool.
12. Once the pool has been created browse to the load balancer and select probes. The probe is used by the load balancer to determine if a VM is healthy and should receive requests. Add a probe called http for port 80.
13. Now create a load balancer rule for the load balancer, again called http, for port 80 and select the probe just created.
14. You now should be able to navigate to your WordPress site by entering the public IP address from step 9 above. Navigate to /admin and login with user and bitnami to mange the site.

Next Steps

1. Deploy a Bitnami MySQL VMs into the DBSubnet in a similar fashion to above. You can deploy two or three and create a replication cluster but this will require knowledge of setting up a MySQL cluster.
2. You will need to reset the WordPress configuration to point to your new database in step 1 above.

The reality is, however, that securing your customers' data is a joint responsibility between you and Microsoft. We secure the platform and you use the platform in a secure and responsible way. One way of doing this is to secure your Azure virtual networks as well as the applications within them.

Securing Your Azure Network and Applications

Unfortunately there are people out there that like to exploit websites and steal your data, or worse, your customers' data. If your website is an eCommerce site and processes credit card details this is especially problematic but any personally identifiable data you process should be protected. Notice also that I use the word process and not store. Some people think they only need to worry about security if they are storing sensitive data and an SSL certificate is all that is needed to protect data in transit or being processed. This is not the case, in fact, the first place hackers will look to compromise your data is the public endpoints to the data and that means your website. So it is crucial that your site is protected. The following tutorial will show you how to setup your networking in Azure and make sure it is secure. We will use the Azure Security Centre to ensure we have no risks and we will deploy a Barracuda web application firewall to act as a reverse proxy and monitor all traffic coming from the web. Barracuda WAF will allow us to detect, contain and respond to web application threats, such as SQL injection, distributed denial of service, cross-site scripting and more,

The steps we will follow are as follows:

1. Create a virtual network (VNet) in Azure. This VNet will host all of the virtual machines (VM) we need. We will create the VNet using the new Azure Resource Manager model and create everything within a single resource group so we can manage all resources as one collection. If you do decide to architect for HA or DR then you can place resources from different data centers in a single resource group too, but that is beyond the scope of this post.
2. Create subnets within our VNet to seperate the tiers of our application. We will create a subnet for a DMZ or Perimiter Network and a subnet for our application tier. We will just create two subnets for simplicity but you may want to create another for the Data tier. You may also decide to use Hybrid Connections or a VPN to keep your data tier in a different data centre. These are all options but for simplicity we will just create two tiers, one for our website and one for our application protection where we will deploy our Barracuda WEB Application firewall (WAF).
3. Deploy two VMs into the relevant subnets. As part of this we will create a single network interface for each VM and the appropriate security configurations and IP addresses.
4. We will configure our Barracuda WAF to allow public access to the eCommerce site. Traffic from the internet will not be allowed hit the eCommerce site directly but only through the WAF giving us application protection from DDOS, SQL injection, cross-site scripting and other application level attacks.

The following steps can be carried out using the new portal or Powershell. For this post I will focus on the new Portal only.

Create a Resource Group

Start by creating a new Resource Group which will logically group all of your resources. The benefit of using a resource group I have found is that I can quickly tear down all of my demo resources. From an operational perspective the major benefit is that you can assign role based access rights to everything within the resource group. For example, you may allow developers access to configure VMs but not the virtual network and an IT admin to configure the network but not access the VMs within it. This is a very powerful capability when it comes to governing the use of your cloud resources. From the left menu click resource groups and then click add. Give the resource group a name, e.g. DemoRG, select a region and click create. Resources from different regions can be added to a resource group but the region you select here will be used as the default.

Create a Virtual Network

• On your left menu click Browse->Virtual networks and then Add.
• Give the Vnet a name, e.g. Demo-vnet and then give the subnet a name, e.g. App-Subnet.
• You can leave the Address Space and default subnet IP address range with their default values but I always like to change the subnet to 10.1.1.0/24 so that I can easily distinguish between VMs created in the app subnet and others. Also, make sure to select the resource group created in the first step.

Create the DMZ Subnet

• On the left menu click Browse->Virtual Networks and select the Vnet just created.
• In the settings blade click on subnets and the click Add.
• Enter DMZ-subnet for the name and 10.1.2.0/24 for the IP range.

Create the Wordpress Virtual Machine

• In the portal click New and in the search box type WordPress and press return. Or click Compute -> See All and then search for Wordpress

• You will notice a number of results for Wordpress, from a scalable web app option to offerings from Bitnami and Docker. For this demo select the Wordpress + MySQL with Docker option and on the blade that follows click create, making sure the deployment model is set to resource manager.
• On the next blade enter the relevant information and make sure to select our demo resource group. I typically at this point name my VMs with vm at the end of the name, e.g. demo-wp-vm. This becomes very handy later on when trying to identify the type of any particular resource. Click OK.
• On the next blade select the instance size. The options showing are the recommended instance sizes for WordPress, but if you want to see a full list just click the 'view all' link beside recommended.
• The next blade allows you to select the networking options and is very important.
1. Make sure to select the VNet created earlier.
2. Select the app-subnet. This will ensure the VM is placed in the app subnet.
3. For this website we do not want a public IP address. This is important as we will never expose this VM to the internet. So select the public IP address and on the blade that follows click none. Leave availability set blank as we will not deal with high availability in this post. 

Create the Barracuda Virtual Machine

Creating the Barracuda VM is very similar to creating the Wordpress VM except we will choose the Barracuda WAF marketplace appliance and we will define an IP address.

• In the portal click New and in the search box type Barracuda WAF and press return. Or click Compute -> See All and then search for Barracuda WAF.

• You will notice two results for Barracuda. These results define the licensing model that Barracuda use to sell their solution. For the purposes of this demo select the BYOL option and we will use a trial license to get up and running. This trial will last for 30 days and give you plenty of time to monitor traffic to the Wordpress site. The hourly option is a great option if you decide to use the Barracuda appliance in production and would like to rent the license. In this scenario you will be charged for the Barracuda license on a monthly basis as overage on your Azure bill. More details here.
• On the next blade change the deployment model to Resource Manager, the default will be classic.
• On the next blade enter the relevant information and make sure to select our demo resource group. I typically at this point name my VMs with vm at the end of the name, e.g. demo-waf-vm. This becomes very handy later on when trying to identify the type of any particular resource. Click OK.
• On the next blade select the instance size. The options showing are the recommended instance sizes for Barracuda, but if you want to see a full list just click the 'view all' link beside recommended.
• The next blade allows you to select the networking options and is very important.
• Make sure to select the VNet created earlier.
• Select the dmz-subnet. This will ensure the VM is placed in the dmz subnet.
• For this website we do want a public IP address. This is important as we will expose this VM to the internet. So select the public IP address and on the blade that follows add IP to the end of the name, e.g. demo-waf-vm-ip and click OK. Again this makes it very simple to identify the type of your resources later on.
• A network security group is defined at this point for the VM. The NSG is used to define inbound and outbound rules to the default network interface on this VM. Click the NSG and change the name by adding NSG to the end, e.g. demo-waf-vm-nsg. In this blade you will notice the rules that have been setup.
• The first rule allows access to anybody on port 8000. This is the port used for the admin interface for Barrcuda. It is a good idea to restrict this access to specific IP addresses, so I would suggest clicking CIDR block in the source and change the source IP to the public IP that your computer goes out to the internet on. You can find this by accessing the site https://whatsmyip.net/ and then enter your IP address xxx.xxx.xxx.xxx/32 which indicates just your address.
• The second rule allows HTTPS access. We will not get into deploying an SSL cert on the Barrcuda WAF but in a production site this would be vital. Click here for more details on how to do this if it is important to you.
• The third rule defines SSH access to the VM. We don't need this so change the action to deny and click OK.
• Add a new Inbound rule and define the following settings. This will allow anybody to access the VM on port 80. Later we will configure the Barracuda device to forward this traffic to the Wordpress VM having analysed the traffic for threats.

• Leave availability set blank as we will not deal with high availability in this post. 
• Click OK twice.
• The next blade will show you terms and conditions for your purchase as well as any costs. Assuming you selected BYOL earlier the value of Barracuda license should be zero. Click purchase.

 Configure the Barracuda Web Application Firewall

Now that we have created our Virtual Machines it's now time to tell the Barracuda appliance to inspect traffic destined for the Wordpress VM. Remember we didn't give the Wordpress VM a public IP address and hence there is no way to directly access it from the internet. Instead we will setup the Barracuda VM as a reverse proxy to handle port 80 traffic, inspect it and forward the request on to the Wordpress VM.

• Establish the IP address of the Barracuda VM by browsing your list of Virtual Machines. Use the left menu and you will find your new VMs under Virtual Machines and not Virtual Machines (classic) which is only available to see VMs created using the old model and not the Resource Manager model.
• Click the Barracuda VM which will be named something like demo-waf-vm.
• In the general blade notice the Public IP address in the Essentials panel, copy this IP address.
• In a separate browser tab type the URL as follows https://xxx.xxx.xxx.xxx:8000 using the public IP just copied.
• You should now see the Barracuda WAF startup screen as shown below. If you do not then please check that the VM is running and browse for the Network Security group and ensure that port 8000 is accessible to your outgoing IP address. You could change this rule to allow all traffic just to identify the problem as it is usually down to an incorrect or changing IP address entered. 

• In the Add New Service panel enter a name like 'Wordpress' and enter a real service IP address which is the private IP of the WordPress VM that you recorded earlier.
• Now click Add
• If this is successful you should see a service list with green ticks for status. You will now be able to navigate to port 80 on the Barracuda VM and traffic will be inspected and then forwarded to the WordPress VM

What I have shown is a very simple example of how you should protect your data or customer data when deploying an application to Azure. The main idea is that we separate our application tiers and create a DMZ that is exposed to the internet. This Tier then monitors all public requests for any sort of intrusion and only forwards the request on to the WordPress site if no issue is found.

Some organisations will separate their tiers using Virtual Networks and will then deploy network intrusion detection into the networks to monitor cross VNet traffic. This is a good pattern if you are connecting your Azure VNet to a network outside of Azure or in another Azure region via a VPN or if you just want extra protection.

The solution we use in this tutorial is Barracuda but the Azure marketplace contains many more that you can review to see which is more appropriate.

https://azure.microsoft.com/en-us/marketplace/virtual-machines/all/?publisherType=acom-partners&term=security

As always, please ask questions or provide feedback in the comments below and follow me on Twitter for more information @niallermoran

• Create a Sandbox VM using this marketplace link. Clicking the 'Create Virtual Machine' button will open the Azure management portal and allow you to create the virtual machine in your subscription. You can use 'Resource Manager' or Classic as the deployment model and then fill out the rest of the details including networking, instance size and resource group. I would recommend you create a new resource group just for this sandbox as a number of resources will be created as well as the VM and this is a good way of logically grouping them together, either to tear down later or apply role based access to everything associated with this sandbox. Note: There is no license charge for the Sandbox but you will be charged for the VM instance size that you choose.

• Once you have filled out the details click to create the VM and then click on the VM to open its properties blade. When you create a VM it will have a tile on the home screen, clicking this will open the properties blade, otherwise you can simply browse for the VM using the left menu or search box in the top right of the portal.

• Once the status of the VM is 'running' take note of the public IP address from the properties blade.
• Now using your favourite browser navigate to the URL: https://publicip:8888. Using the public IP noted above. This will bring you to the Hortonworks welcome page. Simply fill out the form to activate the Sandbox.

• Next you will be brought to the getting started screen and you are now setup to learn Hadoop as well as a tonne of technologies that can be used with it. The first screen offers a very simple Hello World tutorial which is a good place to start.

• Once you have that done why not try some of the more advanced tutorials or use the second tab to select a path best suited to your role.

This is a great way to learn and get started. If you decide to use Hadoop in production you could look at HDinsight a fully managed Hadoop service.

NOTES: A couple of issues I had during my tutorials and how I fixed them. You may not have similar issues but if you do hopefully these tips will help:

1. If you get out of memory errors when running your Hive queries then increase the Tez container size to 1024 or 2048 in the config settings for Hive.
2. If you find that your queries stay at 0% for a long time, this is not normal. They should execute quite quickly. In my case the only way I could get them to run (the ones that did grouping) was to change the execution engine to MapReduce from Tez. So in the Hive query editor I used the gear icon to the right of the editor to add hive.execution.engine as MR and then clicked 'save default setting' option to remember this for all of my queries.
3. Based on comment below from Daragh try azure/azure for the Ambari UI if admin/admin doesn't work for username and password

• How do we connect a plethora of different devices that run different operating systems.
• How do we ingest all of this data? As the number of devices grow and we find more and more uses for IoT we need the bandwidth and technology that can stream this data easily and efficiently and not clog up our devices.
• How do we analyse data on the way in, to look for anomalies or triggers for alerts or other business processes. Think tsunami, fire or flood alerts systems.
• How do we decide what data to store and then store it in an efficient way so that it can be analysed easily.
• With so much data can we analyse it efficiently and gain insight quickly.
• Can we use the data to define predictive models and then integrate those models into our business processes.

Getting Started with Azure IoT

Training

• Check out this Microsoft Virtual Academy course. This is a free online training course that covers all aspects of our IoT platform.
• Check out the IoT Suite. This is a site that will allow you create a demo solution very quickly. Behind the scenes the suite creates all of the Azure components that the solution needs and will provide a web based dashboard to manage your solution. It even provides all of the code in a GitHub repository so you can customise it for your own solution. NOTE: word of caution, the suite creates quite a few resources that could burn your Azure credit quickly if you are only on a trial, e.g. the Azure IoT Hub it creates is the most scalable and expensive, so feel free to down scale some of the resources with the Azure portal.

Devices on the Edge

• If you want to build and connect devices check out the starter kits here https://azure.com/iotstarterkits. Also if you have your own devices running a RTOS, Linux or Windows or even iOS and Android check out our opensource sdks on GitHub here: https://github.com/Azure/azure-iot-sdks.
• For device level security consider devices that support TPM (Trusted Platform Module). See this link for Windows 10 IoT Core support for TPM devices.

Device Registration and Management

• At the centre of an IoT solution is the IoT hub which controls device registration, device security, management (via LWM2M) and ingestion of data. To dive deeper into connecting your own devices, check out the IoT Hub developer site.
• If you need to deploy gateways or are working with legacy gateways the IoT Gateway SDK can help with edge analytics, minimising latency, conserving network bandwidth and aggregating and securing data from multiple edge devices.
• If you plan to use MQTT then check out the protocol gateway developer page.

Business Intelligence, Analytics and Machine Learning

1. The above steps will show you how to use Azure Stream Analytics to analyse data as it is being ingested. Check out this tutorial to see how Power BI can be used to visualise this real-time data.
2. Check out the machine learning portal. Here you can import data and create predictive models from it. The portal has a graphical interface for developing models but you can also import your existing R code. Once your model has been trained and tested it can simply be exposed as an API for integration with other systems or business processes.
3. The Cortana Intelligence Suite has a bunch of tools from Data Lake storage and analytics to Hadoop.

Demos and Opensource Code

• Check out the Clapometer demo based on the Sound Monitoring solution developed with Croke Park
• Check out my Smart HVAC demo that demonstrates an end to end solution from data ingestion to machine learning and real time analysis of data using the prediction algorithm developed in machine learning portal.

Cloud technologies like Microsoft Azure offer a very quick and simple way for software companies to run their business and access a global customer base. These companies who traditionally delivered their solution via CD or some other distribution medium are looking to the cloud as a way to expand their reach into new markets, or simply to centralise their intellectual property into a multi-tenanted environment or SaaS solution. I personally work with quite a few technology startups, via our BizSpark programme, that are considered "born in the cloud", these companies have no option but to use cloud, it allows them to start small and grow at their own pace, a key requirement for a startup.

One of the talks I do for startups is the 'Tech a CEO needs to Know'. This is targeted at CEOs and having worked myself as a CTO of a startup and angel investor fund, I know that CEOs build great business plans but sometimes don't think about the really important technical aspects of their business. I don't mean a CEO needs to know how to develop or even architect the next Uber, but there are a few simple concepts that a CEO should know about, or at least have their CTO develop a plan for. Too often I see software company CEOs defer these challenges to their CTO or Developer and assume they are being handled, but in my opinion it is critical that the business leaders within the organisation understand that there is a plan around these fundamental concepts:

• Availability - How do I make sure my site and business stays up so I don't lose customers?
• Scalability - How can I scale my infrastructure up or down to meet demand or gain new customers?
• Security - Is my data secure and what do I need to do to keep it that way?
• Disaster Recovery - What do I do if there is some sort of disaster or issue with my data?

The Tech a CTO Needs to Know

As a CTO YOU need to take control of these requirements and develop a plan that reassures your CEO that the technology platform is sound. For example, in the event you experience a major spike in traffic, which should be a positive thing for your business, will the infrastructure stay up? How many times have you gone to a website that you've seen advertised for it to be down or just slow. You will give up! If this is your website you have lost a customer. Now, you might say that your hosting company offer an SLA, a service level agreement, which will dictate that the infrastructure will be kept up for an agreed time, e.g. 99.9% of the time. In the case of a spike in traffic, if this infrastructure is simply not adequate then your website will slow down or just stop handling requests. You will lose customers but your hosting provider will say the infrastructure stayed up, and it probably did, but it just wasn't adequate. In this scenario, what you really need is an infrastructure that you can scale up or out easily and then scale back in when it's no longer needed.

This is where Microsoft Azure comes in if used correctly. You could just think of Azure as another hosting provider, but actually it's way more. Azure consists of a number of services that can help you build out your site. These services include compute services like Virtual Machines, applications services, like caching and mobile services, as well as data services to support your relational or big data and analytics requirements. The great thing about Azure is that you can turn these services on and off yourself, or scale them in and out yourself. No need to wait for new infrastructure, simply click a button or slide a slider and get what you need, and of course only pay for what you use. That said, it's important to understand how to deploy your site to Azure. If you do what you have always done with your traditional hosting provider you may be no better off, and I for one have seen this happen many times.

For this blog post I am going to focus on infrastructure services, but there is probably another set of posts I could do for data and application services, although the main points apply across the board. In terms of infrastructure you can build out your web servers using standard Linux or Windows VMs or you can use the gallery to spin up a pre-built environment, for example the Magento solution.

Availability

If your site goes down it can be because of many things, a bug in your code or inadequate infrastructure for example. Another problem, could be planned or unplanned maintenance. The fact is, no matter who manages your infrastructure, servers will go down and this can be due to planned or unplanned issues. For example, within Azure, Virtual Machines come with an SLA of 99.95% as long as you deploy two VMs within an availability set. This then allows us to shift VMs to different update and fault domains within the data centre, meaning during either planned or unplanned maintenance you will never lose your site. It's worth noting that you don't have to use availability sets, you can just deploy a VM on its own, which is perfectly acceptable for DEV & Test or non-critical workloads. In this scenario Microsoft will even send you an email (when possible) alerting you that your VM may need to be rebooted. In this scenario you leave your VM outside of any availability sets but you will not have an SLA.

TIP: Avoid leaving a single instance virtual machine in an Availability Set by itself. Virtual machines in this configuration do not qualify for SLA guarantee and will face downtime during Azure planned maintenance events. Furthermore, if you deploy a single VM instance within an availability set, you will receive no advanced warning or notification of platform maintenance. In this configuration, your single virtual machine instance can and will be rebooted with no advanced warning when platform maintenance occurs. 

So this first scenario is not wrong, but understand the risks associated.

Source: https://azure.microsoft.com/en-in/documentation/articles/virtual-machines-manage-availability

Another configuration I quite commonly see is where the front-end web VM and the back-end database VM appear in the same availability set. This configuration is wrong and should never be used, as Microsoft have no idea what is running in these VMs either VM could be rebooted as part of a maintenance activity. In this situation your site is down and Microsoft will have honoured their SLA, i.e. at least one VM will be running within the availability set.

TIP: In the scenario where you use availability sets you will not receive email notifications about VM reboots due to planned or unplanned maintenance. This is because Microsoft assume that if you use availability sets that you have at least two VMs in them and it is safe to reboot any of them, but not all at the same time.

The correct scenario is to use an availability set for each tier within your application, one for the web tier and one for the data tier. In this scenario, at least one VM in each tier is guaranteed to be kept up in the case where VMs need to be rebooted for maintenance.

More Reading: For more detail on ensuring availability when using virtual machines check out the below article which talks through the availability options as well as how to then load balance traffic across your VMs. https://azure.microsoft.com/en-in/documentation/articles/virtual-machines-manage-availability/

Scalability

One of the really cool features of Microsoft Azure is the fact that you can scale your resources in and out. This means you only ever have the infrastructure you need and no more. If you think about this in terms of building your own infrastructure where, due to inconsistent demand on resources, the percentage utilisation of hardware is typically quite low, Azure can drive the efficiency of infrastructure required to run websites way up. Think about this in terms of an online eCommerce site that really gets hit around Christmas time but for the rest of the year returns to normal demand. Even during a normal week, the site may be hit more during business hours. If we had to provision the infrastructure for this upfront then we would probably build out to support the peak demand plus some to account for unexpected spikes. This, of course, results in a lot of waste. Azure allows us to spin up this infrastructure but then shut it down with a click of a button or a PowerShell command or even based on rules and schedules you define. This gives you much better control of the infrastructure and allows you to scale to meet any demand and because you don't pay for the VM compute time when a VM is stopped this gives you much better control over your infrastructure costs.

More Reading: Take a look at this article which shows you how to setup auto-scaling and manual scaling for Virtual Machines. https://azure.microsoft.com/en-us/documentation/articles/cloud-services-how-to-scale/

Another challenge in scaling applications is that they may be global applications, where you have users from all over the world. In this scenario it may not be feasible to host your site in a single data centre, instead, you may want to deploy multiple versions of your application in different data centres and then direct people depending on their geographical location. Azure offers data centres in 19 regions so you can choose where you want to run your site as well as store your data. If you deploy multiple sites you can use Azure Traffic Manager to load balance across those sites. You should also consider using the Azure CDN to create local caches of resources like images, videos or application scripts.

TIP: If you want to improve the availability of your site even more beyond the discussion earlier, you can deploy a second copy of the application to another data centre and use Traffic Manager to redirect users to it if there is a problem with the primary site. Of course you will need to consider how your data is shared between data centres but it is possible to stretch a virtual network across Azure data centres and leverage our dedciated and encrypted pipe between them

Security

Securing your online site and making sure nobody gets at your data is vital and it's important that you understand that this is not always done for you. Most hosting providers will of course have comprehensive security processes in place to ensure their networks are secure and cannot be hacked, but this doesn’t mean your data or applications are safe. Maybe you have left bugs in your software that allow an attacker to retrieve data they shouldn't, or maybe you have left some ports open on a VM which allow attackers to get into your servers. The fact is combating cyber-crime is an ongoing initiative you will need to invest in, especially if you are transacting payments or sensitive data.

Here are just a few things you should consider:

Software development Life-cycle.

If you are developing software then you should have security built in to your processes. In general your website is the easiest place for an attacker to start. If a hacker can figure out how to retrieve data from your website or application then he/she can use this to attack another part of the system and may end up getting access to even more data. Your code should be written in such a way that it looks for typical attacks like cross-site scripting or sql injection. The best thing to do is follow the guidelines at OWASP.org

Operational controls to prevent, detect, contain and respond.

Although Microsoft have extensive measures in place to prevent attacks, it is also prudent to have measures in place to detect, contain and respond in the case where an attack is successful. If an attack were to go undetected then it's impact could be massive, whereas an attack that is detected immediately may have little or even no impact. In terms of how you can protect your application within Azure, here are some of the things you can do:

• Understand how networks work in Azure. Know how to allow and deny access to VMs, subnets and Vnets within Azure. Starting with a virtual network is always a good idea, when deploying virtual machines. After that you need to understand concepts like security groups and acls. Check out this article for a detailed explanation.
• Consider running a WAF (web application firewall) in front of your web servers. This will add an extra layer of protection and will monitor traffic for specific threats. Take a look at the WAF appliances available within the Azure marketplace. https://azure.microsoft.com/en-in/marketplace/?term=waf
• Run regular vulnerability scans on your application to check for open ports or other vulnerabilities that could expose your data. There are a number of services out there to do that, for example www.mcafeesecure.com. If you are using the Azure App Service to host your site, rather than Infrastructure Serviuces, you can implement built in vulnerability scanning using Tinfoil, see here.
• If you are storing sensitive information on Virtual Machines within Azure you can consider encrypting the VMs at rest. Take a look at the CloudLink Secure VM solution.

Further Reading: Checkout the detailed information available on the Microsoft website to see the security measures taken within the Azure network to ensure your applications are protected: https://azure.microsoft.com/en-us/support/trust-center/security/. Also check out the web application security consortium website here.

Independent Certification

By providing customers with compliant, independently verified cloud services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run in Azure. Microsoft provides Azure customers with detailed information about our security and compliance programs, including audit reports and compliance packages, to help customers assess our services against their own legal and regulatory requirements.

Checkout this link for more details: https://azure.microsoft.com/en-us/support/trust-center/compliance

Summary

So, now that we have looked at some of the areas to think about here is a simple list of the steps you should consider. Again, I am assuming you are using infrastructure services and are comfortable with Linux VMs and you have access to the Azure Portal (https://portal.azure.com/) via an Azure subscription.

1. Start by setting up a virtual network and configure subnets for each tier in your application, e.g. data, application and web. Create a subnet specifically for a DMZ which will contain internet facing VMs.
2. Setup your security groups to restrict access between the tiers of your architecture.
3. Create your VMs and configure them to be placed within the appropriate subnet. You could use the Magento image for the application tier and the NGINX image or Barracuda Image for your DMZ tier.
4. Setup the appropriate availability sets and load balanced sets to achieve your high availability targets.
5. Setup a CDN to host your website assets like scripts, CSS files and images

With Windows 10 due to release this summer, I would encourage developers to start looking at the sdk and tooling now and become familiar with concepts like Adaptive UX which will allow controls to adapt depending on the form factor and API contracts so that developers can tell if a certain API is available based on the device the app is running on.

To help you get started I have pulled together some useful resources from the web:

1. Get Windows 10 via the Insider Program
2. Download the SDK and Tools to start developing:
3. Take a look at this video to help you get started
4. A more detailed Microsoft Virtual Academy training course
5. Code samples so you can see how things are done
6. What's new in the Windows 10 SDK

For help and support use the following links:

1. MSDN Forums
2. Give us your feedback and tell us what you need to build great apps

Terms and Conditions

1. ELIGIBILITY: This draw is open to any person who is 18 years of age or older who is resident in the Republic of Ireland.  Employees of Microsoft Ireland Operations Limited (“Microsoft”), or its affiliates or advertising or promotion agencies are not eligible.
2. TO ENTER: Simply watch one of the recommended courses: 

• C# Fundamentals for Absolute Beginners. 
• Developing in HTML5 with JavaScript and CSS3 Jump Start.
• Introduction to ASP.NET MVC. 
• Developing Windows Azure and Web Services Jump Start. 
• Developing Universal Windows Apps with C# and XAML. 
• HTML5 & CSS3 Fundamentals: Development for Absolute Beginners. 
• Creating Games with Project Spark. 
• Cross-Platform Development with Xamarin & Visual Studio.  

Promoter: Microsoft Ireland Operations Limited, Building 3, Carmanhall Road, Sandyford Industrial Estate, Dublin 18, Ireland.

This is where Azure RemoteApp comes in. As long as these desktop applications will run on Windows Server 2012 R2 the apps can be run from the Cloud and can then be accessed over the web on any device running MacOS, iOS, Android or Windows. It is even possible to connect the RemoteApp service on Azure to your corporate network so that you can access internal services like database back ends, for example. You can also use Azure Active Directory to manage authentication and even add multi-factor authentication.

The following is a simple guide to help you get started. I have created a custom Windows desktop application using Visual Studio to represent my business application but you could use any application you have as long as it has been tested to run on Windows Server 2012 R2 and you have the appropriate licenses. For more information on how licensing works in RemoteApp please click this link.

Step 1 - Create a VM Image with your Business App

In order to use RemoteApp you must have a template. A template is essentially a Windows Server 2012 R2 Virtual Machine Image that is used to create the RemoteApp service. Any application installed on this image/template can then be accessed via the RemoteApp service. There are a number of templates that come with the service, but to create a service based on our custom business app I must create my own template as follows:

• Start by creating a Windows Server 2012 R2 virtual machine on Azure. You can do this using a local server, desktop or laptop as long as you have the Hyper-V role running. For this example I simply created a VM on Azure using the appropriate gallery image.

• Once you have the VM created remote desktop to the VM and enable Remote App services. Go to Server Manager -> Add Roles and Features and add the "Remote Desktop Services" role as well as the "Desktop Experience" feature under "User Interfaces and Infrastructure.
• Disable encryption by running the following command in an elevated privileges command prompt. Fsutil behavior set disableencryption 1
• If you are building your image inside an Azure virtual machine, rename the \%windir%\Panther\Unattend.xml file, as this will block the upload script used later from working. Change the name of this file to Unattend.old so that you will still have the file in case you need to revert your deployment.
• Install KB 2977219 on your image. This KB is required for all Azure RemoteApp template images. Uploading your image will fail if you do not install this KB is not installed.
• Install your business application and create a tile on the Start Screen for the application. You can do this by simply finding the application, right clicking it and clicking pin to start. In my case I created a simple desktop app in Visual Studio but you can use any app as long as you have appropriate licenses. At this point take note of the full path to the executable for the app, you will need it later.
• Now you can sysprep the image using the following command:

  C:\Windows\System32\sysprep\sysprep.exe /generalize /oobe /shutdown

  Note: Do not use the /mode:vm switch of the SYSPREP command even though this is a virtual machine.

• In the next step we will upload this VM disk into the RemoteApp service, which means you will need to download the VHD now. This is a step that is a bit painful but it will go away at some stage as you will be able to link a RemoteApp template to an existing VM disk. For now, find out where the VHD file is in Azure and download it to disk. Obviously if you are using Hyper-V locally you will not need to do this.

•  For more information on this step click here.

Step 2 - Upload the RemoteApp Template

This step involves uploading the VHD file created in the previous step to RemoteApp as a template.

• Within the Azure portal click on the Remote App section and then click the "Template Images" tab.
• Then click the "Upload" button.
• Enter a name for your template, e.g. "CustomLOBApp", select a location and click next.

• In the next screen you will be prompted to download a powershell script. Simply download it and run it. When the script runs it will ask for the location of the VHD file and will begin the process of uploading it to the RenmoteApp templates.
• Note: You will need to install Azure Powershell
• Let this process continue, it may take some time, but it is a once off process.

Step 3 - Create a RemoteApp Collection

There are two types of RemoteApp collection that can be created, one with a VPN (hybrid collection) or one without (cloud collection). For the purposes of this guide I am creating a collection without a VPN. For more information on the hybrid collection please click here.

• In the portal create a new service using the "Quick Create" option. Here you will select the data centre as well as the plan, basic or standard, and then template you created in the previous step.

The term collection is used as the service represents a collection of programs/applications that can be made available.

Step 4 - Publish Apps

Now that the service has been provisioned we need to publish some apps.

• Click on the Publish tab within the RemoteApp collection and choose to publish an app from the start menu or one you know the path too.

• Assuming you took note of the path to the app simply publish it using the path, or if it is listed as a start menu program you can do it that way.

• Finally you can click the User Access tab to make this app available to specific users. This can be done using Microsoft Accounts or Azure AD accounts allowing you to integrate with your corporate identity solution.

Step 5 - Access the App

So now that your app has been published simply direct people to download the RemoteApp client for their device. The url for the download is https://www.remoteapp.windowsazure.com/ and once your users download and install the client on their iOS, MacOS, Android or Windows device they will have access to your apps. For Windows phone the above URL won't work, instead look for the Microsoft Remote Desktop app in store.

That's it! Really Simple to set up, takes a bit of time but now your users can access your apps on any device without the headache of deploying the app to those devices.

Pricing

Azure RemoteApp is priced per user based on how much they use the applications delivered via the collection. Each user has 40 hours per month included in the starting price and will pay for additional hours at a defined rate up to a certain maximum. This means there is a minimum investment and after that you pay for what you use up to a maximum amount per user per month.

There are two pricing tiers based on whether or not you are delivering light weight applications or more productivity based applications.

Notes:

1. There is a minimum charge of 20 users for this service. If you only have one or two users you would still need to pay for 20 users.
2. In any one subscription you can only create 2 collections. The service is designed such that you deliver multiple apps within a single collection rather than create collections for each app. If you want to create more collections you can contact support and ask to have this limit increased.
3. Currently, there is a user limit up to 400 users per App Collection for Azure RemoteApp Basic and up to 250 users for Azure RemoteApp Standard. Please contact Azure support if you need to exceed these limits.

We have even seen a rebranding to Microsoft Azure from Windows Azure: a step I think was crucial in dispelling the myth that Azure was good for Windows only workloads. We are now seeing over 20% Linux workloads on VMs and the developer support for languages like PHP, Java, Node.JS and more is second to none.

So here is a summary of the major enhancements this year:

January 2014

• PCI Compliance and GA of Hyper-V recovery manager
• Reduced pricing on storage

March 2014

• GA of Oracle support
• Windows Azure changes name to Microsoft Azure
• Azure available in China

April 2014

• Preview Portal
• Chef and Puppet support
• Website updates including new Tier and improved SSL support
• Autoscale GA
• Web Hosting Plans
• New Pricing Tiers for Websites
• Hadoop 2.2 support in HDinsight
• New Region for Websites - Southeast Asia
• Avro library for HDinsight released
• EU Data Privacy Rubber Stamp

May 2014

•  Acquisition of GreenButton for HPC
• GA of ExpressRoute
• GA of Azure Import/Export
• Preview of Hybrid Connections
• API Management Preview
• Anti-malware for VMs
• Azure Store Opens to Direct Customers
• Predictable Performance Levels in SQL Database
• Acquisition of Capptain for Mobile Analytics
• SAP Certifications for Azure

June 2014

• Phone Support for SLES 11 SP3
• Azure HDInsight supports Hadoop 2.4 for 100x faster queries on Azure Blobs
• Microsoft Continues Global Expansion of Cloud Services
• Azure HDInsight previewing HBase clusters as a NoSQL database on Azure Blobs
• Announcing the 0.3.0-beta preview of Microsoft Azure WebJobs SDK
• New and improved Azure Status
• Azure Traffic Manager External Endpoints and Weighted Round Robin via PowerShell
• Docker on Azure

July 2014

• SQL Database Updates
• Collaboration with Google and Docker to Support New Open Source Projects on Microsoft Azure
• New ExpressRoute locations and partners
• Announcing: Reverse DNS for Azure Cloud Services

August 2014

• Azure Resource Manager Tools Preview
• RavenHQ Now Available in the Azure Store
• Migrate On-Premises Virtualized Workloads to Azure using Azure Site Recovery
• MyGet Now Available in the Azure Store
• Azure Virtual Machine Disk Encryption using CloudLink
• DocumentDB in Preview
• Azure HDInsight support for Apache HBase™ generally available
• VM Depot in Azure Gallery
• Azure Search in preview
• Azure HDInsight makes HBase (NoSQL database) a GA Feature

September 2014

• Azure Media Services Launches Proven Live Streaming Platform
• VPN support for Websites
• Greater price performance and business continuity with SQL Database 
• GA of API Management
• Role Based Access Control
• The apiphany epiphany: GA’ing Azure API Management
• Announcing public availability of Azure Media Services Content Protection Services
• High Speed Encoding with Azure Media Services
• Introducing: Azure Media Indexer
• DASH Live Streaming with Azure Media Service
• Azure Websites Virtual Network Integration
• Microsoft Azure Announced as Cloud Computing Winner at 2014 Tech Impact Awards
• Monitoring, Diagnosing and Troubleshooting Azure Storage
• ModSecurity Web Application Firewall on Azure Websites

October

• Introducing Elastic Scale preview for Azure SQL Database
• Disaster Recovery to Azure using Azure Site Recovery is now GA
• Announcing Support for Backup of Windows Server 2008 with Azure Backup
• Azure Traffic Manager available within Azure in China
• Managing Media Workflows with the new Azure Media Services Explorer Tool
• Support Site Extension for Azure Websites (Preview Release)
• Azure DocumentDB: Profile of MSN Health and Fitness
• New Windows Server containers and Azure support for Docker
• Real-time analytics to Hadoop with Storm preview
• SAN Replication based Enterprise Grade Disaster Recovery with ASR and System Center
• Announcing the Azure Marketplace
• Introducing Azure Websites Migration Assistant
• Announcing Azure Stream Analytics for real-time event processing
• New: Azure Traffic Manager Nested Profiles
• New Networking features and partnerships for Enterprise scenarios
• Azure Site Recovery – Announcing Windows Azure Pack integration and PowerShell Support
• Microsoft Antimalware for Azure Cloud Services and Virtual Machines

November

• Azure Search Updates: Multilanguage, Azure Portal Index Management & More!
• Deploying Your Own Private Docker Registry on Azure
• Azure Websites Authentication / Authorization
• Azure HDInsight clusters can now be customized to run a variety of Hadoop projects including Spark and R Modules
• Docker CLI for Windows Clients
• Announcing Azure Media Services Live streaming with AES encryption
• Azure HDInsight now Generally Available in China, Australia, and Japan East

December

• DockerCon Europe 2014 announcements opens up new opportunities for Azure customers
• Announcing General Availability of Microsoft Azure Government
• Azure Security SSL 3.0 Update
• Continued Innovation: Microsoft announces updates across Storage, Azure SQL Database, Identity and Access Management and Media Services
• Azure Media Services Announces General Availability of Live Channels
• Introducing Premium Storage: High-Performance Storage for Azure Virtual Machine Workloads
• Azure HDInsight Makes Cluster Customization Generally Available And Provide more Templates for Hadoop projects including Spark, R, Giraph, and Solr
• Announcing General Availability of Mobile Offline Sync Managed SDK
• Microsoft Azure Government Meets Criminal Justice Information Services (CJIS) Requirements