Srikantan

Implementing Service auto scaling in Azure Service Fabric

Srikantan Sankaran — Mon, 25 Jun 2018 07:33:46 GMT

Azure Service Fabric provides orchestration services for Applications deployed as Docker containers, along with Service level auto scaling. In this example, a Web API is built using ASP.NET Core 2.0, packaged using Docker containers for Linux and deployed to an Azure Service Cluster. A Load Test is run on the REST API to generate CPU load on the Container hosting it, thereby triggering a Service level auto scale rule. This causes additional container instances to be spun up on the other Nodes in the Custer to handle the load, and once the load dies down, these container instances are removed. To deploy this sample in your own subscription, use the ARM template and the Service Fabric Application Packages in the GitHub Repository - here

Creating the Service Fabric Cluster

This feature requires version 6.2.194.1 + of Azure Service Fabric, and enabling the 'Resource Monitor Service' on the Cluster. Since the Azure Portal does not provide an option enable this Service at this time, an ARM Template is used that deploys a cluster with this feature enabled. The VM Size of D1_v2 is used in this ARM Template to easily simulate the CPU load leading to an auto scale rule trigger The ARM Template provisions an OMS Repository for Log analytics and monitoring, and to keep the Template simple, the Region used for it is the same as that of the Service Fabric Cluster itself. Ensure that OMS Service is available in the Azure region selected for the Service Fabric Cluster. Run the ARM Template to create the Cluster. After the Service Fabric Cluster is provisioned, launch the Explorer to check the Cluster Manifest. The Resource Monitor Service would be enabled. See below The REST API used in the sample is packaged as a Docker Container and uploaded to Docker Hub, and is referenced in the Service Manifest of the Service Fabric Application available with this article.

Deploying the sample Application to the Service Fabric Cluster

Navigate to the folder where this GitHub Repository is cloned to. The 'app-packages' folder contains the Application packages in the sample. Use Git Bash or other tools to deploy the Service Fabric Application. Key configurations implemented in the package for auto scaling - For auto scaling to work, the ServicePackageActivationMode needs to be set to 'ExclusiveProcess' (the default mode is 'shared') - The auto scale trigger rule and metric name and threshold values need to be specified. Refer to this link for details. - The instance count for the Service type is set to 1. When the auto scale kicks in, more instances of the container would be activated in the Service Fabric Cluster. The section from Application Manifest file relevant to this configuration is shown below. The relevant config from the Service Manifest for the Application is a shown below, that refers to the Container image uploaded to Docker Hub. srikantan67/sfwebapi2:Version06

Connect to the Cluster and install the application

sfctl cluster select --endpoint https://..cloudapp.azure.com:19080 --pem opennetclcert.pem --no-verify ./install.sh Ensure the Application is running: url in this sample - http://auscsfcl0.southeastasia.cloudapp.azure.com:5002/api/Operations In the Service Fabric Explorer, you will observe that only one container instance of this application would be running in one of the Nodes in the Service Fabric Cluster.

Enable the OMS Agent for Linux in the VM Scale set running Service Fabric

(optional step. Required only to view the metrics in the OMS Repository) This agent is required in the Nodes running the containerized Application, to capture the container logs and push them to the OMS Repository. These are to be activated after the application is deployed to the Cluster, since Docker has to be installed on the Nodes prior to activating this Extension. Refer to this for more details. For the OMS Solution for Service Fabric, refer to this link. From the Azure Portal, obtain the Workspace ID and Secret of the OMS Repository and execute the CLI command below: az vmss extension set --name OmsAgentForLinux --publisher Microsoft.EnterpriseCloud.Monitoring --resource-group --vmss-name --settings "{'workspaceId':''}" --protected-settings "{'workspaceKey':''}" This actions takes a few minutes to complete.

Run a Load Test and test the service type level auto scaling

I have used Application Insights to configure a manual load test that hits the REST API url with 1500 concurrent users, and a test duration of 15 minutes.

View the Service Fabric Explorer

Observe the Service Fabric Explorer as the test progresses. After some time, you will notice additional container instances running in the other Nodes in the cluster. After the test completes, the additional container instances would get removed from the Explorer view.

View the Container logs and Node metrics of Service Fabric as captured in OMS

Launch the OMS Workspace and launch the Container Logs and Service Fabric Solutions (these were deployed in the OMS Workspace when the ARM Template was run). The screen shot below shows how over the course of the Load Test, additional container instances were deployed in the other Nodes in the Cluster, on trigger of the auto scaling rules. Once the Load came down on completion of the Test, the additional container instances were removed by the auto scaling rule. Below is a screen shot from the Container log Solution in OMS, for the duration when the Load test was run.

Accessing Applications protected using Azure AD

Srikantan Sankaran — Fri, 15 Jun 2018 13:38:33 GMT

When Applications that are secured by Azure AD are to be accessed from different calling Applications, like Daemon Applications, Web Applications or Single Page Applications, different choices are to be made, given the nature of integration in each of them (e.g. from Open ID Connect, oAuth 2.0). Covered in this Repository is how the Postman Tool could be used to try out some of these options without having to resort to code.

Deploy and perform Rolling upgrade of containerised Applications in Azure Service Fabric

Srikantan Sankaran — Thu, 07 Jun 2018 02:38:59 GMT

Azure Service Fabric offers a reliable and flexible platform that enables you to write and run many types of business applications and services. In this post published here, a two tier ASP. Net Core 2.0 Application is packaged using Docker container for Linux, and deployed to an Azure Service Fabric Cluster. This sample demonstrates the following features of Azure Service Fabric

Support for deploying containerized Applications with Service Fabric as the orchestrator.
Surface Docker Health status in the overall health report of the Service Fabric Cluster
Service discovery using the inbuilt Service Fabric DNS
Perform Application Rolling upgrades

Refer to the post above in GitHub that walks through the process of accomplishing the above steps.

Use Azure policy Service to manage Azure Resources and stay compliant with corporate standards

Srikantan Sankaran — Wed, 06 Jun 2018 16:50:17 GMT

Azure policy Service can be used to implement rules that helps organizations stay compliant when deploying and configuring resources in Azure. This sample implements a rule that ensures that no Compute resources in Azure, like Virtual Machines are deployed without having mandatory tags included in the Provisioning request. The tag names used are 'Cost Center Name' to be able to attribute the charge to, and the 'Service Name' of the Application that would be hosted in the Virtual Machine. Using an Azure Policy Service Policy ensures that these rules are honored irrespective of how the resource is provisioned, be it using ARM Template, Azure Portal, CLI, or using the REST API. Policy Definition The Json document (VMTagsPolicy.json) representing the Policy definition is available in the GitHub repository accompanying this post. The screen shot below shows the Policy definition. Refer to the Azure documentation for the steps to define a Policy and assign it - here and here . In the Policy rule defined above, if either of the Tags are not specified in the request, the Provisioning request gets denied. The tag values are also validated to ensure that they are in the list of allowed Cost Center and Service Name values that were specified in the Policy assignment. The tag values are parameterized, and allowed values for Cost Center and Service Names bound to a predetermined set of values in the JSON definition. Policy Assignment In this example, the Policy is assigned to a specific Resource group in the current Azure Subscription, so that the Policy gets applied only to this scope. The allowed values for the Cost Center codes in this assignment are "Cost Center 1" and "Cost Center 2". (See screenshot below) Validating this Policy by provisioning a VM using different options 1) Using CLI az vm create --resource-group azpolicyrg --name azpolicyvm1 --image UbuntuLTS --admin-username onevmadmin --admin-password Pass@word123 --debug The request above fails since the tags were missing in the request. The next request below fails since the values set for the tags did not conform to the allowed values specified in the Policy assignment defined in the previous steps. az vm create --resource-group azpolicyrg --name azpolicyvm1 --image UbuntuLTS --admin-username onevmadmin --admin-password Pass@word123 --tags CostCenter="Cost Center 4" ServiceName="Service 1" --debug The request below includes all the mandatory tags and the allowed values as set in the Policy definition, hence it succeeds and the VM gets provisioned. az vm create --resource-group azpolicyrg --name azpolicyvm1 --image UbuntuLTS --admin-username onevmadmin --admin-password Pass@word123 --tags CostCenter="Cost Center 2" ServiceName="Service 1" --debug 2) Using an ARM Template The ARM template (SimpleVmJson.json) used here is uploaded to the GitHub Repository referred to in this article Selecting a wrong value for the Cost Center Code ('Cost Center 3' selected in the ARM Template is not from among the list of allowed values in the Policy Assignment created in the previous steps), fails the resource provisioning request. See screenshot below 3) Using the Azure portal to create a VM will not succeed, since the wizard does not provide an option to specify tags. However, when a user edits the tags in a VM that already exists, the Policy validation kicks in and ensures that any changes that violate the policy are disallowed. In the screen shot below, setting a value different from that in the policy definition or deleting the 'Cost' Center' tag, and selecting 'save' errors out citing the Policy violation. While in the Policy definition the rule action is set to 'Deny' when the validation fails, and the VM provisioning fails, setting the rule action to 'audit' could be used instead to ensure that the provisioning requests succeeds, but the violations are written to audit and surfaces in the compliance dashboard. An organization could take corrective action manually, and at their convenience. Scenario 2: Azure Storage now provides the option to associate a Vnet Service endpoint to it, that ensures that only services deployed in the Subnet would have access to the Storage account. The Policy definition below implements this rule, whereby only requests to provision a Storage account that have a VNET Service endpoint configured would be permitted, else the action is set to 'deny' the request. See screenshot below for the Policy Definition. The Policy definition file, StorageSecurityCompliance.json is available in the GitHub Location accompanying this article

Deploying containerised Asp.net Core Applications to Azure

Srikantan Sankaran — Tue, 03 Apr 2018 01:23:39 GMT

In the March 2018 issue of MSDN Magazine (msdn.com/magazine/mt845653), was covered a scenario in which insurance policies for vehicles generated by an agency could be stored securely in Azure Key Vault as secrets, and how additional features like asymmetric encryption with keys and built-in versioning could be used to maintain an audit trail of access to insurance policies. The applications that used Azure Key Vault were deployed to Azure App Service as Web apps. In msdn.com/magazine/mt846465 article, the same applications would be containerized and deployed to Azure Container Services for Kubernetes (AKS).

Secure Your Sensitive Business Information with Azure Key Vault

Srikantan Sankaran — Fri, 02 Mar 2018 01:48:47 GMT

Azure Key Vault is a cloud-based service that lets organizations securely store sensitive business information. It lets you perform cryptographic operations on the data, and provides a framework for implementing policies to regulate access to applications, as well as an API model for applications to work with the keys, secrets and certificates stored in it. The SDKs that Azure Key Vault provides support a variety of device platforms and programming languages, allowing you to choose your preferred language and to deploy these applications to Azure App Service as managed Web applications. To expose these business applications securely to users both within an organization and outside, Azure Active Directory (Azure AD) and Azure Active Directory B2C (Azure AD B2C) provide turnkey implementations to enable authentication and authorization to the applications with minimal or no custom code. In this article in the MSDN Magazine, presented is a solution that demonstrates how Azure Key Vault can bring enhanced security to your organization. The Source code accompanying the article can be accessed here

No code, Business process automation to generate Documents based on Templates

Srikantan Sankaran — Fri, 05 Jan 2018 05:50:54 GMT

Abstract

Organizations have this need to implement a Business process to automate the approval and generation of Documents. While a generic process to implement this is extremely simple, with Office 365 SharePoint and Microsoft Flow, it is not uncommon to have requirements where the documents ought to be based on certain Templates, which is chosen by the requestor of the document. Also, while the approval workflow process would be bound to the Document Library, organizations would want to segregate the request capture process itself from the document generation and download. They may, for e.g. want the requestor to have read-only access to the document generated, while they could have read-write permissions in the Approval Request capture process. Microsoft Flow, Powerapps and Office 365 SharePoint could be used to meet these requirements using an approach that entails zero code. Organizations could use these technologies to implement such automation without having to depend on internal IT to code such solutions, and at a fraction of the time that it would otherwise take. Solution approach Office 365 SharePoint Team Site is created that would contain several artefacts that are referred to in the sections below. A custom List PolicydocsIssuanceRequests is where the Requests are captured. The Document requestor enters information like the Customer Name, the Document Type to be generated (whether it is a 'Statement of Work' format or whether it is a 'Warranty Details' format that needs to be created for the Customer), select a signatory (person who would approve this document generation request & the signatory). Selecting the Customer Name sets additional attributes like the Customer Address and their contact information automatically, using Look up fields that refer to a CustomersList Custom list. Requestors would have read-write access to the PolicydocsIssuanceRequests List, since they ought to be able to submit information. PolicyDocsRepo is the Document Library where the Documents that are generated on approval get stored. Requestors would have read-only access to this Library. The same columns that exist in the PolicydocsIssuanceRequests List are created here too(see the screenshot below). A Microsoft Flow process bound to the PolicydocsIssuanceRequests List copies these attributes to the PolicyDocsRepo Document Library. The PolicyDocsRepo Document Library should be configured to support Documents based on multiple Word 2016 Document templates. Authors of the Template ought to be able to access the field values in the Document Library and insert them as placeholders inside the document templates. Use the guidance in this article to define the different Word 2016 document templates. From the Library Settings>Advanced Setting>, open templates.dotx. Edit the default template and make changes to it to suit each of the formats in this article (Statement of Work and Warranty templates), and save these as StatementOfWork.dotx & Warranty.dotx respectively to the PolicyDocsRepo Document Library. The attributes from the Document Library are visible inside Word 2016 - (screen shot below). Place these fields in the relevant sections of the Document template. To use these templates in a Microsoft Flow process, a Word 2016 document is created from each of the templates above and saved in the .docx format. To do that, simply open the .dotx templates from the Document Library and do a 'save as' to your local computer. Then upload these documents (e.g. in this article, the document names are as shown in the screenshot below) to the BlankPolicyDocuments Library. Next, a Microsoft Flow process is configured on the PolicydocsIssuanceRequests List. Select the 'Start Approval when a new item is added' Template. Post approval of the Request, based on the Template Type selected in the Request, the Switch/case branches out into a separate path. The 'Get File Content' action under the path for 'Warranty', gets the WarrantyBlankFormat.docx from the BlankPolicyDocuments Library, and in the action Create File', inserts that into the PolicyDocsRepo Library. At this point it does not contain the column values from the Request submitted earlier. The 'Update File properties' action, gets the link to the Document inserted in the 'Create File' action, and updates the column values in the Library with those captured with the initial Request. (screen shot below) The 'RequestTrail' column value is set to the URL of the Request in the PolicydocsIssuanceRequests List, for trace back and reference. To test the process, Create a new Item in the PolicydocsIssuanceRequests List, and use the default Edit Form the Custom list provides. However, to make the process simpler for the end users, from the list menu options, choose to create a Powerapps App for this List. The UI generation Engine builds the App automatically. Only minimal changes are required to be done. It uses certain attributes in the UI which you might not need. Just select those fields and replace them with the required fields from the Library. (See screens hot below) Run the App and submit the request. Choose a Document template type (PolicyDocumentType in the screenshot below) to be used for the Document generation. An approval email is sent to the user selected in the 'Signatories' field in the App. Once approved, a document is generated and uploaded to the PolicyDocsRepo Document Library, using the Template chosen in the request. Once the Powerapps App is tested, it would be published to Powerapps Service and then shared with other users in the Organization. Users would install Powerapps on their Android or iOS devices, and when they login with their Corporate credentials in Azure or Office 365 Active Directory, the published App would be visible to them. Now users could submit this Document generation request even while on the move, using the Powerapps App on their Mobile phones or Tablet devices.

Using Azure Key Vault to secure data exchange (Java)

Srikantan Sankaran — Thu, 07 Sep 2017 06:21:40 GMT

In this post, .NET Code was used to encrypt data using a X509 Certificate on the local Computer, and to invoke Azure Key Vault APIs to decrypt this data. In the sample code available in the GitHub repository here, shown is how an equivalent could be implemented in Java, using the Azure SDK for Java. (The Source file from Eclipse and the pom.xml used are provided) Some useful links:

Azure SDK for Java
Other links that would be useful - Using the Java SDK for Azure Key Vault
Documentation on the Client side Library for Java - here

Working with Azure Key Vault Certificates for secure exchange of data

Srikantan Sankaran — Sat, 19 Aug 2017 16:12:11 GMT

Abstract Azure Key Vault (AKV) provides REST APIs that Applications could invoke to perform cryptographic operations like Encryption, Decryption signing and verifying signatures. For scenarios where integrated applications are deployed across Data Centers or geographies, it would be optimal to perform operations like encryption, locally, instead of making a REST API Call on Azure Key Vault. Covered here is a sample Application that uses a X509 Certificate on a local machine to encrypt the data, which is then decrypted using the AKV APIs. The Certificates feature in AKV is used here. Creating a Certificate in AKV also creates a Private/public key pair in it. A Certificate Signing Request(CSR) is generated for this Certificate which is sent to a CA for signing. The resulting X509 Certificate issued by the CA can then be used in an Application to encrypt data locally. While this is the approach that could be used in Production scenarios, for simplicity here, a X509 Certificate is retrieved, using the AKV APIs instead. This contains the Public key information for the Certificate created in AKV earlier. This is saved to the local computer and then used in the Application to perform encryption locally. The sample Visual Studio 2017 Solution file and the PowerShell scripts can be downloaded from the github repository here To run the sample, the following steps need to be performed 1. Provision and configure Resources in Azure Key Vault Run the GetAppConfigSettings.ps1 PowerShell script. It is located within the scripts subfolder in the Visual Studio Solution (AKVEncryptDecryptSample.Sln). Edit the variable names used in the script before execution. The following actions are performed by this script: • Azure Key Vault created using the Premium Tier ( a pre-requisite if HSM enabled keys are a requirement) • The sample application (the Visual Studio Solution in this article) gets registered with Azure AD and permissions provided to it to execute the Key Vault operations. A certificate is generated to authenticate the Application with Azure AD and is stored locally on the computer. • Creation of a Certificate in AKV having its key in a HSM. Since this is for dev/testing, a self-signed certificate is created (-IssuerName Self). See the comments inline in the script below [Note: In practice, a Certificate Signing Request(CSR) is generated for this Certificate from AKV, (steps documented here), which is signed by a trusted CA, and a X509 Certificate issued. This X509 Certificate, contains the Public key information for the Certificate created in AKV, and used in the Application to encrypt the payload with, locally. For simplicity here, instead, a Self-signed certificate generated in Key Vault is downloaded to the local machine using the AKV API. ] Explained below are some of the snippets from the PowerShell script #************************************************************************************************ # Create a Certificate in AKV, having a private key in HSM & non-exportable #************************************************************************************************ $hsmcertificateName = "prohsmcert" # Set the flag for Keytype as RSA-HSM; it should be non-exportable. Set the IssuerName as 'Self' since this would be # used only for dev testing. (It would be set to 'Unknown' if it is to be sent to a CA for signing and issuance) # set the Keyusage flags as shown. Data encipherment is not enabled by default, unless specified - it is required for decryption operation $manualPolicy = New-AzureKeyVaultCertificatePolicy -SubjectName "CN=demohsm.corpmobile.in, St=Karnataka, OU=IT, O=Demo Bank, STREET=Technology Links Park, L = Bangalore, C=IN" -ValidityInMonths 24 -IssuerName Self -KeyType "RSA-HSM" -KeyNotExportable -KeyUsage keyEncipherment,digitalSignature,dataEncipherment Add-AzureKeyVaultCertificate -VaultName $vaultName -Name $hsmcertificateName -CertificatePolicy $manualPolicy # By default the key status is disabled. Need to enable it with this command Set-AzureKeyVaultCertificateAttribute -VaultName $vaultName -Name $hsmcertificateName -Enable $true $certificateOperation = Get-AzureKeyVaultCertificateOperation -VaultName $vaultName -Name $hsmcertificateName $certificateOperation.Status $certificate = Get-AzureKeyVaultCertificate -VaultName $vaultName -Name $hsmcertificateName $certificate.KeyId #KeyId contains the URI of the private Key generated for this Certificate • Next, copy the xml settings with the resource names from the PowerShell script execution window (see below) and paste them into the app.config of the Visual Studio Solution - Name AKVEncryptDecryptSample.Sln. # ********************************************************************************************** # Print the XML settings that should be copied into the app.config file # **********************************************************************************************

Write-Host "Paste the following settings into the app.config file for the HelloKeyVault project:"

Write-Host

2. Running the Visual Studio Solution - AKVEncryptDecryptSample

a) Download the Public key content for the Certificate from Azure Key Vault Service and save to local Computer In Program.cs, run only the DownloadCertificate() Method. This calls the GetCertificate API of AKV to get the CER content of the Certificate bundle. An X509 Certificate file gets saved to the bin\debug\Programcert.crt. b) Install this Certificate into the Certificate Store of the Current user c) In the Sender.cs file, change the search criteria for the Subject in the Certificate downloaded above. if (c.Subject.Contains("demohsm.corpmobile.in")) d) In Program.cs, comment the DownloadCertificate() method and run the EncryptDecrypt() Method. The Sender.cs program reads the text in the file in the Solution, encrypts it using the X509Certificate (Programcert.crt)from the local machine. The Receiver.cs program decrypts this content inside the HSM in AKV using the Private key in it.

The sample code referred in this article reuses most of what is available in the Azure Key Vault, Code Sample download Link here, including the PowerShell scripts. Incremental changes have been made to implement the scenario covered here

Using Azure Functions, Cosmos DB and Powerapps to build, deploy and consume Serverless Apps

Srikantan Sankaran — Sat, 22 Jul 2017 16:46:11 GMT

Azure Functions can be used to quickly build Application as Micro Services, complete with turnkey integration with other Azure Services like Cosmos DB, Queues, Blobs, etc , through the use of Input and output Bindings. Inbuilt tools can be used to generate Swagger definitions for these Services, publish them and consume them in Client side Applications running across device platforms. In this article , an Azure Function App comprising of 2 different Functions that perform CRUD operations on data residing in Azure Cosmos DB, will be created. The Function App would be exposed as a REST callable endpoint that would be consumed by a Microsoft Powerapps Application. This use case does not require an IDE for development. It can be built entirely from the Azure Portal and the browser. [The Powerapps App file, C# Script files, Yaml file for the Open API Specs created for this article can be downloaded from this Gtihub location here]

Creation of a DocumentDB database in Azure Cosmos DB

Use the Azure portal to create a DocumentDB database. For the use case described in this article, created is a Collection (expensescol) that stores Project Expense details, comprising the attributes shown below. 2. Creation of a Function App that implements the Business Logic in Service Two Functions are created in this Function App using C# Scripts.

GetAllProjectExpenses that returns all the Project Expenses Data from the collection in Cosmos DB
CreateProjectExpense that creates a Project Expense Record in Cosmos DB

a) Function GetAllProjectExpenses -> The Input and output Binding configured for this Function: Apart from the HTTPTrigger input binding for the incoming request, an additional input binding for Cosmos DB is configured that retrieves all the Expense records from the database. Due to this binding, all the Expense records are available to the Run Method through the 'documents' input parameter - see screenshot of the C# Script used in this Function, below. [Note: The scripts provided here are only meant to illustrate the point, and do not handle best practices, Exceptions, etc] Refer to the Azure Documentation for detailed guidance on configuring Bindings in Azure Functions, for HTTPTriggers and Azure CosmosDB b) Function CreateProjectExpense -> The binding configuration used for this Function is: Notice that there are 2 output bindings here, one for the HttpResponse and the other is the binding to Cosmos DB to insert the expense record into it. [Note: When the Run method in a Function is invoked asynchronously, we cannot use an 'out' parameter to the Cosmos DB Binding and an 'out' for the HttpResponse in it. In such cases, we need to add the document meant for insertion into an IAsyncCollector Object reference, 'collector' in this case. Note that the parameter 'collector' is used in the output binding to Cosmos DB, shown above . Refer to the documentation here for more info pertaining to scenarios with multiple output parameters] 3. Test the Functions created Use Postman to ensure both the Functions work without errors. The HttpTrigger Url can be obtained from the C# Script Editor View of the Function 4. Generating an OpenAPI (Swagger) Definition for the Function App A Function App could contain different Functions, each of which could potentially be written in different programming languages. All of these Functions or individual 'Micro Services' could be exposed through a single base end point that represents the Function App. From the Application Settings, navigate to the 'API Endpoint' Tab. Click on the button 'Generate API definition template' to generate a base definition of the Swagger. But it lacks all the elements required to fully describe the Functions. The definition, described in Yaml format, has to be manually edited in the editor pane. The Yaml file created for this Function is available along with the other artefacts in this blog Post. Refer to this , this and this links that provides guidance on working with Yaml to create the Swagger definitions, or using other options to create it. [Note: The samples considered in the links above use simple primitive types as parameters in the Method calls. The scenario in this article however deals with Collections, and needs more work to get the Yaml right. Refer to the artefacts download link in this article to view the Yaml that was created for the scenario in this blog post] [Note: For simplicity in this article, I have considered the option provided by Functions to add the API key in the Request URL, under the key 'code'. For more secure ways to deal with it, use Azure AD integration or other options] After the Yaml is created and the definition is complete, test the requests from the Test console on the Web Page, and ensure that the Functions work without errors. Once tested, click on the button 'Export to Power Apps and Flow' to export the Swagger definition and create a Custom connector in the latter. 5. Create a new custom Connection in powerapps.microsoft.com from the connector registered in the previous step. Embed the Security code for the Function App. This gets stored with the connection and automatically included in the request by Powerapps to the REST Services deployed on Azure Functions. 6. Create a new Powerapps App that would consume the REST Services exposed by Azure Functions in the earlier steps While you could start with a blank Template, it involves some work to create the different Forms required in the App for 'Display All', 'Edit' and 'Browse All' use cases. Powerapps supports the ability to automatically generate all these Forms and provide a complete App, when selecting a Data Source like OneDrive, SharePoint Office 365 Lists, and many others. Since the 'ProjExpensesAPI' Connector we have created is a custom one, this Wizard is not available to create the App automatically. To work around this, I have created a Custom List in Office 365, that has the same fields as in the Expense data returned by the Function App. I used the wizard to generate a complete App based on the Custom List in Office 365, and then changed all the Data Source references from it to the 'ProjExpensesAPI' Connection. Note in the screenshot above, how the Logged in User context can be passed through 'Excel like' functions to the Search Box. The data is filtered after it is received from the REST APIs. Notice how our custom API is invoked below, and the data returned is filtered using the expression shown The screen shots of the App with each of the Forms is shown below. This App can be run on any of Windows, Android or iOS Mobile Devices. Test the App to ensure that all the REST API operations like GetAllExpenses and CreateProjectExpense requests work from the App. It can then be published by the user and shared with others in the Organization. The powerapps App file is also provided along with the other artefacts in this article.