Allergic To Code https://docs.microsoft.com/archive/blogs/tangent_thoughts/feed.xml A Prescription for the Infrastructure Minds of the world Wed, 18 Jul 2018 20:01:14 GMT en-US hourly 1 Azure IaaS Operations Guidance aka.ms/Azure/IaaSOpsGuide https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-iaas-operations-guidance Wed, 04 Apr 2018 05:37:00 GMT https://blogs.technet.microsoft.com/tangent_thoughts/2015/10/06/azure-iaas-operations-guidance/ BOOKMARK THIS!  aka.ms/Azure/IaaSOpsGuide This is a collection of Azure Infrastructure installation and operational guidance resources I provide to my customers.  By keeping these links up to date with each engagement, all of my customers may benefit.  Hopefully you can too!  The latest Azure updates will always be at Azure service updates.  Make it part of your operational procedure to review that monthly, if not weekly!  In 2015, there were over 500 updates. Wow! The goal of this guide to highlight core installation and operational procedures for an Azure IaaS deployment which predominantly will consist of Compute, Network and Storage resources.  This article Azure Infrastructure Services Implementation Guidelines, gives a pretty good run down of what needs to be created and in what order. The resources I will keep updated below pretty much follow most of those resources in the last link. But for now, there is a very important piece of that puzzle missing.  For the newer Azure Resource Manager (ARM) model of deployment, we need to plan, design and create Azure Resource Groups. Once we have Resource Groups, we can delegate administration with Role Based Access Control (RBAC). Besides all this, if you just need to ramp up and learn more on Azure, go to the Azure Learning Paths page.  Check it out and learn something new! I also have my Azure Certification resources (Slides and Videos) from MS Ignite, to get you certified and ready to go!

Azure Active Directory

Overviews

AzureAD a leader in the 2016 Gartner IDaaS MQ!

Cloud Architecture

There is quite a bit of guidance out there to help architect your cloud identity strategy.  Azure Active Directory provides the core Identity Management as a Service platform for all of the possbile hybrid and cloud scenarios. Here are some great resources to read up on.

Authentication & Authorization

Azure AD Operational Guidance

Azure AD Tenant

In the original Azure Portal, http://manage.windowsazure.com, the primary control of overall administration was at the subscription level. Now, in the new Azure Resource Manager (ARM) mode, there are fewer justifications for multiple subscriptions as there were before in the Azure Service Management (ASM) model e.g. administration only at the top level.  Now in ARM, you can control administration at the subscription level, Resource Groups, and at the Azure Resources contained within. For more on those differences, see Understanding Resource Manager deployment and classic deployment. You can only create Azure Resources to leverage ARM deployments and RBAC by using http://portal.azure.com.  So stop using that old portal; unless you just have to.  For more on that, read Azure portal availability chart.

Subscription

Before you can do anything, you not only need an Azure subscription, but you also need to know how many, if more than one, and what the limits are. Simpler is always the best. In the ARM deployment model now, things like separation of billing and delegation of administration no longer require separate subscriptions.  Billing can be even more with tagging and RBAC gives even more flexibility to control administration across your portal.

Azure Resource Manager (ARM) and Role Based Access Control (RBAC)

This content can now be found at http://aka.ms/Azure/ARM.

Network

Creating your virtual networks and subnets is very high on the priority list of things to do after the subscription and resource groups are created. One quick tip to note is that in traditional networking addressing, we take away 2 addresses (n-2) for all 1's and all 0's, when calculating hosts from networks.  In Azure, it gets a little hungry, using 3 additional addresses.  So remember this safety tip....figure (n-5) when you do your host calculations.  For an example, if you needed 30 hosts, on-premises, you would figure a /27 network would work, right? Don't believe me, just ask Cisco :) But in Azure, you would fall short as a /27 network would actually result in only 27 hosts per network. So I warned you! Also, if you make you VNet networks too small, if will haunt you, as it currently is not so easy to remove the VMs and recreate VNets, so plan them very, very carefully.  Been there, done that.  You don't want to go there.

Overviews

  1. Azure Networking Series - a collection of topics
  2. Azure Network Security - nice list of all the Azure resources for Networking
  3. Azure Reference Architectures - Networking DMZ
  4. Microsoft Cloud Networking for Enterprise Architects - This is a great soup to nuts overview!
  5. Microsoft Cloud Services and Network Security - Read these top two docs, and you will see all the components to consider 
  6. Microsoft Azure Network Security Whitepaper version 3 is now available This explains what Microsoft does to protect Azure
  7. Virtual Network Overview
  8. Network Resource Provider
  9. IP Addresses in Azure Virtual Network
  10. About secure cross-premises connectivity for virtual networks
  11. User Defined Routes and IP Forwarding
  12. What is Azure load balancer?
  13. What is a Network Security Group (NSG)?
    1. See more Details on Network Security in the Networking section of aka.ms/Azure/Security

Operational Guidance

Storage

Find ALL Storage Documentation e.g. Get Started, Designing, etc..

Managing Storage

Operational Guidance

Compute

Overviews

Operational Guidance

  Below are some additional topics related to various deployments.  These also provide other examples of deploying things like Windows Server Active Directory and SQL Always on clusters in an Azure Subscription.  What will you put in your subscription?

Windows Active Directory Servers in IaaS

Many organizations now are moving their Domain Controllers into Azure as VMs in IaaS.  Here are some links to help out! If you want to have replica Domain Controllers in the cloud for on-premises domain controllers...
]]> Got Power BI? aka.ms/Azure/PowerBI https://docs.microsoft.com/archive/blogs/tangent_thoughts/got-power-bi-aka-msazurepowerbi Thu, 22 Mar 2018 13:32:32 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1785 The Power of Power BI! Moving forward into 2018, I am undertaking some special projects to create custom dashboards for Azure and Azure Stack.  While there are some cool tricks you can do alone with Azure dashboards, you can take it a step further and go much farther with the data analytics and visualization capabilities of Power BI. To get a taste of some of the possibilities, just check out the OMS dashboards at the bottom of this link. My Focus will be seeing what we can explore in Azure Stack, as I've spent a bit of time working with customers and Cloud Solutions Partners (CSP) in the past year or so. While I will not be able to share with you all of the outputs of what we create at Microsoft Consulting Services (MCS), I am happy while wearing my trainer hat, to share the resources that I collect to figure this all out to solve our customers' unique reporting needs in the cloud.

Read

Watch

Learn

Download

Useful Power BI Content Packs & Apps

]]> Azure and Flow, better together! aka.ms/Azure/Flow https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-and-flow-better-together-aka-msazureflow Fri, 22 Dec 2017 22:08:00 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1716 do there, I started poking around with the Microsoft Flow app on my iPhone.  Yes I said iPhone, and Satya Nadella told us it was OK :) ...as long as we install tons of Microsoft Apps on it! Here's proof to the right :) I quickly found many cool pre-made Flow templates to install easily, and then said..."hey, let's just dive in and see what else I can do!" So now I have something else to tinker with over the holiday season. The first template that caught my eye was the "Save Office 365 email attachments to a OneDrive for Business".  Very nice indeed. And no, unfortunately it does not parse through your past emails to pull them out. That will have to be a custom flow for you to share. This template only works on new incoming emails. As I was searching through the templates, a few caught my eye for things around Azure.  And in particular Azure Spend. Many customers ask about ways to get this information.  There are many ways in the Azure Portals to get some Azure cost information, but with a flow perhaps (still exploring), maybe we can get a little more sophisticated?  You can see the Azure Spend connector below in the snapshot picture of the current Azure connectors in Flow. With multiple actions, it give many possibilities into how the information will be presented and or stored!  I did a simple example below of just getting an email, but it could be a mobile notification, an FTP post, or saved into a variety of storage options through the various supported connectors in Flow. And the best part about all of this?  Once you create special custom Flows, you can export them.  And you know what happens once you export something? Then someone can import it!  You know there is a Seinfeld moment there. Remember Art Vandelay?  I digressed. The point is you can Export and import your flows across environments with packaging. So you make 'em.  You save 'em.  And then someone else an use 'em.

More Microsoft Flow Resources

]]> Azure Government Resources aka.ms/Azure/Gov https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-government-resources-aka-msazuregov Thu, 02 Nov 2017 23:41:22 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1695 Microsoft Azure Government

Security and Compliance

 

Identity Considerations

  • Planning Identity for Azure Government This is a very important consideration in your planning!  In Azure Commercial (public), which is entirely separate from Azure Government, it has its own Azure Active Directory (AD).  In Azure Government, likewise it has an entirely separate instance of Azure AD from the Commercial space.  This becomes very important in considering authentication to applications like Office 365, which also can be in the Commercial or government space, which we'll highlight in the section below.
  • Channel 9: Identity on Azure Government - get a great overview of all of the options for Identity in Azure Government.

Choosing your identity authority

Azure Government applications can use Azure AD Government identities, but can you use Azure AD Public identities to authenticate to an application hosted in Azure Government? Yes! Since you can use either identity authority, you need to choose which to use:
  • Azure AD Public – Commonly used if your organization already has an Azure AD Public tenant to support Office 365 (Public or GCC) or another application.
  • Azure AD Government - Commonly used if your organization already has an Azure AD Government tenant to support Office 365 (GCC High or DoD) or are creating a new tenant in Azure AD Government.
Once decided, the special consideration is where you perform your app registration. If you choose Azure AD Public identities for your Azure Government application, you must register the application in your Azure AD Public tenant. Otherwise, if you perform the app registration in the directory the subscription trusts (Azure Government) the intended set of users cannot authenticate. The other consideration is the identity authority URL. You need the correct URL based on your chosen authority:
  • Azure AD Public = login.microsoftonline.com Azure AD Government = login.microsoftonline.us

Azure Government Videos

External Related Documentation

Office 365 Government Community Cloud (GCC)

This is where your Identity information is important to know.  Did you read that section above?  Remember the mention about two different instances of Azure AD? The public or commercial cloud has a distinct and separate instance of Azure AD from  Microsoft Government. The part that gets tricky is that although we have two different flavors of O365 GCC i.e. government, the two versions do not use the same Azure AD as Azure Government uses. Below are the two versions as documented  here.
  • The Office 365 GCC environment provides compliance with Federal requirements for cloud services, including FedRAMP Moderate, and requirements for criminal justice and federal tax information systems (CJI and FTI data types).
  • The Office 365 GCC High and DoD environments deliver compliance with Department of Defense Security Requirements Guidelines, Defense Federal Acquisition Regulations Supplement (DFARS), and International Traffic in Arms Regulations (ITAR).
The point above is the Office 365 GCC uses the same Azure AD as the Commercial or public space of Azure, while Office 365 GCC High, uses the same Azure AD as Microsoft Azure Government.

More O365 GCC Resources

]]> How Many Azure Subscriptions is enough? aka.ms/Azure/Subscriptions https://docs.microsoft.com/archive/blogs/tangent_thoughts/how-many-azure-subscriptions-is-enough-aka-msazuresubscriptions Tue, 17 Oct 2017 01:47:11 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1645 How many Subscriptions is enough?

Comparative Anatomy of Forests to Subscriptions

This question come up too often and so it's time to share findings from my experiences and  many of my colleagues' at Microsoft.  While one key point to make is that "there is no magic silver bullet", the discussions here are similar to our first talks about how many Active Directory Forests should you have? In BOTH cases, simpler and fewer of either forests or subscriptions is easier to manage.  While conversely, the more you have of either, the more complexity and difficulty you will have in managing them. However, one important distinction to make with this analogy is with regards to Security:
  • With Active Directory, the security boundary IS the forest
  • With Azure, the security boundary is NOT the subscription, but the Azure Active Directory Tenant.
I tell my customer, let's learn the lessons of many organizations in the past that went crazy with multiple domains and forests ...only ending up later after much pain and administrative suffering, to undo it all and reduce/consolidate domains and forests to a few, if not only 1.  This should be the end-state goal you should start with for determining the number of subscriptions.  Ask your organization, can we start with 1?  And if so, what would be the justifications for adding additional subscriptions?

Criteria for adding subscriptions

The graphic below is like the "Project Management Body of Knowledge" in that this is simply a framework, and not carved in stone.  Feel free to disagree and challenge it, but please just don't tell me you need dozens of subscriptions, unless you can really justify them all.  Let's keep this simple.  CAVEAT EMPTOR: The following decision criteria assume a single organization and does not take into account mergers, acquisitions and divestitures.  That could be a entire separate blog on those possibilities.

Subscription Decision Criteria

Subscription Limits

This is the MOST likely and common clear cut justification for needing another subscription.  If any of the subscription limits will be hit now or in the near future, plan for another subscription now, and ward off the future troubles  having to move resources from one subscription to another.  While it is much easier to do this now, than in those dark days of ASM, prior planning is your friend here. As a result, the place we don't want to be impacted in, is production. So many companies will just figure the wild west of development and testing could eat up valuable limits needed for production resources. The beginning state for many companies is to start with one subscription for production and then a second subscription for all non-production e.g. Dev, Test, and QA. An augmented version of this safety net is that we hear many customers that have a third "sandbox" environment where any thing goes.

Subscription Security

With Role Based Access Controls (RBAC) we can scope administrative access at
  • any subscription
  • any resource group
  • any Azure resource
However, when we go back to our comparative anatomy analogy above with Active directory, subscriptions have an all powerful equivalent to the old Enterprise Admin of Active Directory.  This is the subscription owner which inherits rights over every azure resource within your subscription.  How much do you trust that person(s)?  That is a lot of power holding the keys of the subscription kingdom! But, there are methods to protect that top level right, such as breaking up the password parts or other factors to be accessible only by different people. Azure Resource Manager (ARM) was designed for this delegated administration barrier that existing only a few years ago, when our only scope of administration over Azure resources was just the subscription.  We built this new ARM model.  You just have to use it...  AND enforce it. It is a new way to administer and control resources versus traditional on-premises systems, but embrace it and leverage RBAC. And now that we have Azure PIM for RBAC in preview, this will make many security officers very happy.

Limit Resource Providers

Registration of Resource Providers enable features to be available to users in the portal. To register a resource provider, you must have permission to perform the /register/action operation for the resource provider. This operation is included in the Contributor and Owner roles. In many cases on our projects, we provide a script to simply enable all resource providers so it is done.  This scenario of a different subscription with different resource providers lit up is not a common one. But we'll call it a possibility.  It could be possible to have a subscription with limited services, like production, and then another non-production or sandbox environment with everything turned on.  Not something we see or do often at all, but just wanted to put it on the table.

Delegation of Administration

As I described above, RBAC can really break down and control access to resources to manage least privileges.  Stuart Kwan at Ignite 2017 had a great talk on Identity (Locking Down access to the Azure Cloud...) and made this simple graphic to show how RBAC should be applied. With all of Stuart Kwan's ultimate words of wisdom, there will be some who want further delegation like we did with nested organizational units in AD.  But I ask you "was that really easier and simpler than a more simple flat hierarchy"?  I've seen that model go more crazy than the numbers of forests gone mad, so I am not a fan of making additional subscriptions just for another administrative container to fake nesting of administration. The best possible argument I think goes back up to the subscription owner and who do you trust. Remember our other security tenant above is that the Azure AD tenant and NOT the subscription, is the security boundary.

Conclusion

Again, there is no magic bullet.  But now you have some criteria to review and decide. And these criteria can be used also to reduce or condense the number of subscriptions you have.  So what if you do have a half a dozen or more subscriptions...what do you do?  I would say review the criteria above.  If possible without a lot of pain, consolidate and eliminate those subscriptions that are not necessary.  Apart from the first few criteria above, we typically see or recommend 1 subscription for production and 1 for non-production and or a sandbox environment.  There are exceptions, but these are guidelines and not cast in stone.

Recommended Reading

]]> Azure Stack @ Ignite! https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-stack-ignite Sun, 08 Oct 2017 14:16:46 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1625
  • Get ALL the Ignite 2017 Azure Stack sessions - now posted on Channel 9
  • Get the Azure Stack Ignite 2017 sessions on the Azure Channel on YouTube at aka.ms/AzureStack/YouTube
  • ALL of the Ignite Sessions are also linked on YouTube -  aka.ms/Ignite/YouTube
  • You can also watch the  Ignite 2016 sessions
    • While many of the 2016 sessions are still relevant, I would always check the latest conference sessions first :) Two other relevant posts I have    ]]>         Learn Azure - Resources plus Certification aka.ms/Azure/Learn https://docs.microsoft.com/archive/blogs/tangent_thoughts/learn-azure-resources-plus-certification Wed, 27 Sep 2017 14:52:52 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1606 Azure Learning Resources

    Azure Resource Manager (ARM) Templates - skills

    Azure ARM Templates are how resources are deployed. Get them at aka.ms/AzureStack/Templates. Read Template Deployment, to understand about what JSON templates are and how they are used in Azure and Azure Stack. To take your learning to the next level with some free training, I'd recommend these resources below to eventually become an ARM Template Ninja!

    PowerShell Skills

    In Addition to knowing how to craft ARM Templates, from the resources above, PowerShell Skills also come in handy for either Azure or Azure Stack.  And who better to teach you than the inventor himself in these two online courses....most excellent Mr. Snover!

    Certification Preparation

    To learn about all of the latest Azure related certifications go to 

    Azure Architecture 70-535

    NOTE: per aka.ms/70-534 is now retired.  The newer exam, reflecting much of this content will be 70-535.  Nonetheless, although 70-534 is retired, my content and decks for that are still included and useful to study for the 70-535.
    • You MUST know the exam objectives first! aka.ms/70-535
    • A 70-535-Exam-Cert-Prep - lots of links to study with.
      • I just presented the deck above internally.  When Ignite comes around again, I'll update it to include more topics that I couldn't fit into 60 minutes.
      • In THIS deck above, I also try to outline what are the new topics in the first couple of slides, in case you had been studying for the 70-534, but just want to know what's new.
    • There is a whole site for Azure Reference Architecture!
    • MS Ignite 2017 Orlando most of the 734 content is still valid
    • Watch the Microsoft Virtual Academy (MVA) recordings delivered earlier in 2017 at http://aka.ms/MVA/70-534
    • Also use MS Ignite 2016, but ignore anything that says "ASM" or "Cloud Services"

    Azure Infrastructure 70-533

    New Exams!!...This is currently no indication that 70-533 is expiring.  However, there will be a trend towards more "Role" based exams, and this is the beginning of that trend.
    • Exam AZ 100-  Microsoft Azure Infrastructure and Deployment (beta)
      • Candidates for this exam are Azure Administrators who manage cloud services that span storage, security, networking, and compute cloud capabilities. Candidates have a deep understanding of each service across the full IT lifecycle, and take requests for infrastructure services, applications, and environments. They make recommendations on services to use for optimal performance and scale, as well as provision, size, monitor, and adjust resources as appropriate.
      • Candidates for this exam should have proficiency in using PowerShell and the Command Line Interface. Candidates should have a basic familiarity or knowledge of Azure Portal, ARM templates, operating systems, virtualization, cloud infrastructure, storage structures, and networking.
    • Exam AZ 101 - Microsoft Azure Integration and Security (beta)
      • Candidates for this exam are Azure Administrators who manage cloud services that span storage, security, networking, and compute cloud capabilities. Candidates have a deep understanding of each service across the full IT lifecycle, and take requests for infrastructure services, applications, and environments. They make recommendations on services to use for optimal performance and scale, as well as provision, size, monitor, and adjust resources as appropriate.
      • Candidates for this exam should have proficiency in using PowerShell and the Command Line Interface. Candidates should have a basic familiarity or knowledge of Azure Portal, ARM templates, operating systems, virtualization, cloud infrastructure, storage structures, and networking.
    • Exam AZ 102 - Microsoft Azure Administrator Certification Transition (beta)
      • THIS EXAM IS INTENDED ONLY FOR THOSE CANDIDATES WHO HAVE TAKEN EXAM 533: IMPLEMENTING MICROSOFT AZURE INFRASTRUCTURE SOLUTIONS. IF YOU HAVE NOT TAKEN EXAM 533, YOU WILL NOT EARN A CERTIFICATION BY TAKING THIS EXAM
    • You MUST know the exam objectives first! aka.ms/70-533
    • MS Ignite 2017 Orlando
      • PDF of Slides will be posted by Nov 6
      • The Ignite session is now on Channel 9 aka.ms/Ignite/70-533
      • The video is also posted at aka.ms/YouTube/70-533
      • Once the recordings are moved to Channel 9, I'll post the links here.
    • Watch the Microsoft Virtual Academy (MVA) recordings delivered earlier in 2017 at http://aka.ms/MVA/70-533
    • Also use MS Ignite 2016, but ignore anything that says "ASM" or "Cloud Services"

    Azure Development 70-532

    • You MUST know the exam objectives first! aka.ms/70-532
    • MS Ignite 2017 Orlando
      • PDF of Slides will be posted by Nov 6
      • The Ignite session is now on Channel 9 aka.ms/Ignite/70-532
      • The video is also posted at aka.ms/YouTube/70-532
      • Once the recordings are moved to Channel 9, I'll post the links here.
    • Watch the Microsoft Virtual Academy (MVA) recordings delivered earlier in 2017 at http://aka.ms/MVA/70-532
    • Also use MS Ignite 2016, but ignore anything that says "ASM" or "Cloud Services"

    Azure Stack Operator 70-537

    ]]>         AzureStack Security aka.ms/AzureStack/Security https://docs.microsoft.com/archive/blogs/tangent_thoughts/azurestack-security-aka-msazurestacksecurity Wed, 13 Sep 2017 20:56:25 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1595  PCI-DSS and the CSA Cloud Control Matrix. The former addresses the payment card industry while the latter gives comprehensive mapping across multiple standards. Concurrently, we have also started the process to certify Azure Stack for Common Criteria. Given the length of the process, this certification will be completed sometime early next year. It is important to clarify that Microsoft will not certify Azure Stack for those standards, except for Common Criteria, because several controls within those standards are the customer’s responsibility, that is, people- and process-related controls. Microsoft is formally validating that Azure Stack meets the applicable controls. As a result of this validation, Microsoft, via the 3PAO, will produce pre-compiled documentation that explains how Azure Stack meets the applicable controls." Only VALIDATED for the technology component is carried out for Azure Stack, the people and process components of certification are still the customers responsibility. Read the rest of the blog ... Security and Compliance in Azure Stack. Or better yet, just WATCH IT :) Security and Compliance in Azure Stack on YouTube. Per the blog, make your voice heard below! In the coming months, Azure Stack will continue to expand the portfolio of standards to validate against. The decision about which standard to prioritize will be based on customer demand. To express your preference about which standard Azure Stack should prioritize, please fill out this survey. Otherwise, the current documentation on Docs under the Security header include the following topics: ]]> Azure Resource Manager aka.ms/Azure/ARM https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-resource-manager-aka-msazurearm Wed, 13 Sep 2017 19:37:28 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1575 http://aka.ms/Azure/IaaSOpsGuide.  I've pulled it out to use a simple and easy to remember URL.... aka.ms/Azure/ARM Once you have your Azure Subscription, I think the planning and implementing Resource Groups should be first on your list.  Because if this is not done, then when you go to deploy anything in the new Azure portal in ARM mode, then a default Resource Group will be created for you.  If you pre-make a few to start with, then once you create storage, network and compute resources, then you can assign those resources to Azure Resource groups, per Azure Region, as you see fit.  There are many ways to do this e.g. by dev/test environments or by resource types such as domain controllers or web servers. At a high level, most Azure pages will say to create these according to managed lifecycles of Azure Resources. By default the subscription administrators will have access to all of these, so if you make a bunch, then later, you can create groups to assign RBAC to delegate administration.

    Overview

    ARM Templates

    Operational Guidance

    Task Name     Task Link ]]>         Azure Security Resources | aka.ms/Azure/Security https://docs.microsoft.com/archive/blogs/tangent_thoughts/azure-security-resources-aka-msazuresecurity Tue, 08 Aug 2017 02:01:10 GMT https://blogs.technet.microsoft.com/tangent_thoughts/?p=1545 Azure Security

    Privileged Access Workstation

    This is a collection of resources from security experts at Microsoft.  When going into Azure Government, customers go there for enhanced security provided by FedRAMP High standards that are supported.  When accessing such a secure environment, you don't want to add a weak link, so a secure (or privileged) access workstation should be considered to access Azure Government.

    Security Videos

    Penetration Testing

    I thought I'd give this a section by itself, as many customers ask me about what is done or what can they do.

    Tools & Scripts

    Networking Security

    I get this request often "How do we keep networks secure in Azure?  Here are a couple of huge resources Just a quick start...more to come!]]>