• You will be able to add the first output value, but the minute you add that – the ability to add more output variables from the Azure Cognitive Services Face API is disabled.

• GenderText --> @{items('For_each_2')?['faceAttributes']?['gender']}
• Glasses --> @{items('For_each_2')?['faceAttributes']?[glasses]}
• Smile --> @{items('For_each_2')?['faceAttributes']?[smile]}

If you have been following closely, you would have realized Azure Automation is now available for Azure GOV. There are a couple of things you need to keep in mind when you are trying to run your first automation script with Azure GOV. I’m going to be outlining the steps below:

Step 1 -  Create a certificate with makecert (or you could use IIS too)

Step 2 – Install the certificate in the CurrentUser’s Personal Certificate Store

Step 3 – Upload this certificate in the management certificate section of the Azure Subscription (the .CER file )

Step 4 – Now export the certificate from the personal store using a password and save it to a .PFX file

Step 5 – Now add the .PFX file as an asset onto Azure Automation

Step 6 – Create variables for ‘SubscriptionName’ and ‘SubscriptionID’

Step 7 – Create a Runbook under Automation and enter the following to establish a connection and get started. The ones that we need to explicitly add for the Azure Government are highlighted below

workflow AnandTestRunbook

{

Add-AzureEnvironment -name “AzureGovernment” -serviceendpoint https://management.core.usgovcloudapi.net

$subscriptionID = Get-AutomationVariable -Name 'SubscriptionID'

$subscriptionname = Get-AutomationVariable -Name 'SubscriptionName'

$certificate = Get-AutomationCertificate -Name 'AnandAzureAutomationCertificate'

Set-AzureSubscription -SubscriptionName $subscriptionName -SubscriptionId $subscriptionID -Certificate $certificate -Environment "AzureGovernment" 

Select-AzureSubscription -name $subscriptionname

}

Step 8 – From here on you are good to go, you should be able to use it how you would normally use an Azure Automation script

Good luck and Happy Automating!!

There are tons of good documentation out there for SQL Always on AGs on Azure, here are some of the most comprehensive ones:

·        SQL ALWAYS ON GUI - https://msdn.microsoft.com/en-us/library/azure/dn249504.aspx

·        SQL ALWAYS ON POWERSHELL - https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-sql-server-alwayson-availability-groups-powershell/?rnd=1

I would highly recommend you go through both of these articles in both the articles above, as good as they are, there are still some things which you might oversee ( at least I did J ), especially in a secured environment.

Network Security Groups

How has NSGs got to do anything with configuring SQL Always on, you ask? Well, some organizations block out all WAN (INTERNET) traffic through a NSG rule (both inbound and outbound). So why should this affect your ILB configuration? The key word – “AZURE_LOADBALANCER” represents a datacenter IP in Azure which is used to monitor probes from the load balancer to determine the health state of virtual machines in a load balanced set.  Therefore, blocking this out would prevent the ILB from working and hence affect the working of the SQL Always on AG. If you have to deny “INTERNET” traffic through a NSG rule, please ensure you add another rule to the Network Security Group which has an allow from the “AZURE_LOADBALANCER” with a higher priority. Will write another detailed blog on this – on the working of NSGs and ILBs

Cluster Object

Ensure that the user performing the configuration on the SQL servers for Always on has permissions to create the Cluster Object on the domain (or) have an object pre-created.

Cluster Probe Script

If you are running Windows Server 2012 – ensure you run this below script :

$ClusterNetworkName = "<MyClusterNetworkName>" # the cluster network name (Use Get-ClusterNetwork on Windows Server 2012 of higher to find the name)

$IPResourceName = "<IPResourceName>" # the IP Address resource name

$ILBIP = “<X.X.X.X>” # the IP Address of the Internal Load Balancer (ILB)

Import-Module FailoverClusters

Get-ClusterResource $IPResourceName | Set-ClusterParameter -Multiple @{"Address"="$ILBIP";"ProbePort"="59999";"SubnetMask"="255.255.255.255";"Network"="$ClusterNetworkName";"OverrideAddressMatch"=1;"EnableDhcp"=0}

If you are running Windows Server 2008 – run this :

$ClusterNetworkName = "<MyClusterNetworkName>" # the cluster network name (Use Get-ClusterNetwork on Windows Server 2012 of higher to find the name)

$IPResourceName = "<IPResourceName>" # the IP Address resource name

$ILBIP = “<X.X.X.X>” # the IP Address of the Internal Load Balancer (ILB)

Import-Module FailoverClusters

cluster res $IPResourceName /priv enabledhcp=0 overrideaddressmatch=1 address=$ILBIP probeport=59999  subnetmask=255.255.255.255

IMPORTANT : BRING THE IP ADDRESS – offline and then bring it back online once you run this script. The probe port configuration is only complete if you bring it offline and then back online.

Once again, this might not be the best post for Azure SQL AG configuration and there could be tons of other things to look at, but these are my learnings :) 

Listing all Subnets in an Azure Virtual Network

So you want to list ALL the subnets within an Azure Virtual Network and you try to look for an available PowerShell command (get-azuresubnet only works at a VM level) and you realize there isn’t any. Fret not, there is a simple way to get this done.

The Virtual Network configuration file is your friend.

$VNetConfig = Get-AzureVNetConfig

[xml]$VNetConfigXML = $VNetConfig.XMLConfiguration

$subnets = $VNetConfigXML.DocumentElement.VirtualNetworkConfiguration.VirtualNetworkSites.VirtualNetworkSite.Subnets

Your $subnets parameter now has all the Subnet information, you can filter it by an IF statement if you just need the subnets from one of the Virtual Network Sites.

If you then run a loop, you will be able to fetch all the subnet names and the IP address prefix within an Azure VNet

foreach ($subnet in $subnets)

{

$subnet.Subnet

}

Where would this be helpful? When you want to set up an NSG rule or forced tunneling for all the subnets, this comes in handy. I will do a separate post on NSGs and forced tunneling later on to explain in detail

Happy PowerShelling

Anand Kumar R

Azure Government PowerShell

• Add-AzureEnvironment -name “AzureGovernment” -PublishSettingsFileUrl “https://manage.windowsazure.us/publishsettings/index?client=xplat” -ServiceEndpoint “https://management.core.usgovcloudapi.net” -ManagementPortalUrl “https://manage.windowsazure.us” -StorageEndpoint “core.usgovcloudapi.net” -ActiveDirectoryEndpoint “https://login.windows.net/” -ActiveDirectoryServiceEndpointResourceId “https://management.core.usgovcloudapi.net/” -ResourceManagerEndpoint “https://management.usgovcloudapi.net” -GalleryEndpoint “https://gallery.usgovcloudapi.net” 

• Set-AzureEnvironment “AzureGovernment”

• In order to download the publishing settings file, you would need to access the following URL - https://manage.windowsazure.us/publishsettings/index?client=xplat
• Once you have run the first two commands and downloaded the publishing settings file, you should be good to run the Import-AzurePublishingSettings command

Endpoint Mapping

$endpointsuffix = "core.usgovcloudapi.net"

Azure Media Services in Azure Government

• _cachedCredentials = new MediaServicesCredentials(
   _mediaServicesAccountName,
   _mediaServicesAccountKey,
   _mediaContextScope,
   _acsBaseAddress);

  • MediaContextScope --> "urn:WindowsAzureMediaServices"
  • _acsBaseAddress --> https://ams-usge-0-acs-global-1-1.accesscontrol.usgovcloudapi.net

• _context = new CloudMediaContext(new Uri(_apiServerAddress), _cachedCredentials);

  • _apiServerAddress (for Virginia ) --> https://ams-usge-1-hos-rest-1-1.usgovcloudapp.net/API/
  • _apiServerAddress (for Iowa) -->  https://ams-usgc-1-hos-rest-1-1.usgovcloudapp.net/API/