My Azure RFP Toolbox

During the last years as an architect for Azure services, there is a set of questions and areas that always come-up, you will find here the reference materials I use to answer RFP or customer enquiries. This post assumes you already have some Azure expertise in the subjects covered, but are in search of good reference materials for documentation purposes.

 

Networking and connectivity

When you design a solution running in Azure, it will most of the time run on Virtual Networks, you can connect those to:

  • Your datacenter via IPsec VPN: you use the internet to transport IPsec-encrypted packets. Since it’s the internet, there’s no SLA on the link availability, but the IPsec gateway is backed by a 99.95% SLA and the speed can go up to 1 Gbps.
  • Your datacenter via ExpressRoute: it’s a private connection, SLA-backed by your service provider up to 99.95%. The speed can go up to 10 Gbps if necessary.
  • Internet via a Public IP: that public IP endpoint is highly available, load balanced if needed, protected by our DoS protection service. Those operations are done by Azure but you can leverage Network Virtual Appliances from the marketplace in order to add additional features like layer-7 inspection. If you want to use WAF-as-a-Service, you can also leverage Azure Application Gateway.

ExpressRoute Locations – https://docs.microsoft.com/en-us/azure/expressroute/expressroute-locations

Microsoft cloud services and network security – https://docs.microsoft.com/en-us/azure/best-practices-network-security

Azure Network Security Best Practices – https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices

Reference architecture – Hybrid Networking – https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/ 

 

High availability, Disaster Recovery and SLA

When you build solutions on Azure, your choose the physical location of your data, which is replicated on 3 hard disk drives (based on Locally Redundant Storage), it can be replicated to another region in order to offer additional redundancy in a location with hundreds miles from the previous (3 additional copies of your data).

High availability for virtual machines is achieved:

SLA for the main Azure elements:

VM For all Virtual Machines that have two or more instances deployed in the same Availability Set, we guarantee you will have Virtual Machine Connectivity
to at least one instance at least 99.95% of the time.For any Single Instance Virtual Machine using premium storage for all Operating System Disks and Data Disks, we guarantee you will have Virtual
Machine Connectivity of at least 99.9%.
Storage We guarantee that at least 99.9% (99% for Cool Access Tier) of the time, we will successfully process requests to read data from Locally Redundant Storage (LRS), Zone Redundant Storage (ZRS), and Geo Redundant Storage (GRS) Accounts.
ExpressRoute We guarantee a minimum of 99.95% ExpressRoute Dedicated Circuit availability.
IPsec Gateway We guarantee 99.9% availability for each Basic Gateway for VPN or Basic Gateway for ExpressRoute.

We guarantee 99.95% availability for each Standard, High Performance, VpnGw1, VpnGw2, VpnGw3 Gateway for VPN.

We guarantee 99.95% availability for each Standard, High Performance, Ultra Performance Gateway for ExpressRoute.

Application Gateway We guarantee that each Application Gateway Cloud Service having two or more medium or larger instances will be available at least 99.95% of the time.
Azure Site Recovery For each Protected Instance configured for On-Premises-to-On-Premises Failover, we guarantee at least 99.9% availability of the Site Recovery service.

For each Protected Instance configured for On-Premises-to-Azure planned and unplanned Failover, we guarantee a two-hour Recovery Time Objective

Datacenter and Service Recovery: How Microsoft services recovers from a DC loss – https://gallery.technet.microsoft.com/Datacenter-and-Service-d64cf003

Availability checklist – https://docs.microsoft.com/en-us/azure/architecture/checklist/availability?toc=%2Fazure%2Fsecurity%2Ftoc.json

Data security, isolation and confidentiality

In a context of datacenter migration, usual questions are: how is my data secured, how is it isolated from other tenants and how can I protect my data in-transit, at-rest, and even in-processing.

A good reference is the getting started with Azure security paper: https://docs.microsoft.com/en-us/azure/security/azure-security-getting-started

Encryption at rest:

Isolation in the Azure Public Cloud – https://docs.microsoft.com/en-us/azure/security/azure-isolation

Azure Data Encryption-at-Rest – https://docs.microsoft.com/en-us/azure/security/azure-security-encryption-atrest

Encryption in transit:

Azure encryption technologies: Protect personal data in transit with encryption – https://docs.microsoft.com/en-us/azure/security/protect-personal-data-in-transit-encryption

Encryption in processing:

Azure confidential computing : https://azure.microsoft.com/en-us/blog/introducing-azure-confidential-computing/

Data security is also about backup, wo you can use:

 

Datacenter operations & compliance

Azure will very likely exceed any possible best practices and compliance regulation level that you see in a customer-run datacenter. Azure does not usually allow customers to directly audit against best practices, however we are working to certify Azure against the most relevant certifications, in the world, regionally, and locally as well as the most strict industry standards.

All certifications information can be found in the Azure Trust Center – https://azure.microsoft.com/en-us/support/trust-center/

Overview of Microsoft Azure compliance – https://gallery.technet.microsoft.com/Overview-of-Azure-c1be3942

How Microsoft Azure can help organizations become compliant with the EU GDPR – https://gallery.technet.microsoft.com/How-Azure-Can-Help-788a4979

Azure Solutions Blueprint for PCI DSS-compliant environments – https://docs.microsoft.com/en-us/azure/architecture/compliance/pci-dss/

Microsoft Azure HIPAA/HITECH Act Implementation Guidance – https://gallery.technet.microsoft.com/Azure-HIPAAHITECH-Act-1d27efb0

 

Threat protection, detection and incident response

How does Microsoft protect instances, how does Microsoft and I do incident response? Is there a DoS protection service include and IDS/IPS? Can I or a partner conduct penetration testing to a solution in Azure?

Azure Advanced Threat Detection – https://docs.microsoft.com/en-us/azure/security/azure-threat-detection

Azure Logging and auditing – https://docs.microsoft.com/en-us/azure/security/azure-log-audit

Security Incent Response in Azure – http://aka.ms/SecurityResponsepaper

Penetration testing of your solution – https://docs.microsoft.com/en-us/azure/security/azure-security-pen-testing 

Integration of SIEM with Azure – https://docs.microsoft.com/en-us/azure/security/security-azure-log-integration-overview 

Azure Security Center is a great complement to all the security mechanisms present in Azure, and the good news is, there’s a free tier, so use it everywhere.

Azure Security Center Detection Capabilities – https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities

Using Azure Security Center for an incident response – https://docs.microsoft.com/en-us/azure/security-center/security-center-incident-response

 

Operations Excellence

How do I operate, manage, an environment in Azure, how do I manage separation of roles and duties, how is done RBAC?

Customers can integrate their on-premises Active Directory with Azure Active Directory and then manage, delegate access using RBAC. When customer use Azure Active Directory, they can use all feature of Azure Active Directory Premium and also enable Just in time admin, which will elevat

Introduction to operational security in Azure – https://docs.microsoft.com/en-us/azure/security/azure-operational-security

Azure Security Management and Monitoring Overview – https://docs.microsoft.com/en-us/azure/security/security-management-and-monitoring-overview

Governance in Azure – https://docs.microsoft.com/en-us/azure/security/governance-in-azure

Identity management – https://docs.microsoft.com/en-us/azure/security/security-identity-management-overview

 

Let’s conclude with the Azure Security best practices and patterns collection: https://docs.microsoft.com/en-us/azure/security/security-best-practices-and-patterns

Our VM sizes reference: https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-sizes/

You might also need the Visio template in order to produce the architecture diagrams: http://download.microsoft.com/download/1/5/6/1569703C-0A82-4A9C-8334-F13D0DF2F472/RAs.vsdx 

 

Have fun answering RFP, don’t hesitate to suggest your additional items in the comments section!

Stay updated on Twitter: https://twitter.com/arnaudlheureux

Getting started with – Azure Backup

gstarted-backup

We continue our series of “Getting Started” articles, with most up-to-date information I use with Microsoft Partners and customers when enabling them with Azure infrastructure services. I follows the same structure which is: getting started, training videos if available, then reference architectures, capacity planning and pricing information.

Backup is generally not creating a lot of excitement in IT teams, that’s the very least we can say. The fundamentally difficult parts of it are:

  1. defining data retention and archival policies.
  2. defining the appropriate sizing for the solution.
  3. executing the offsite data copy policy.

I’m not even talking about testing the restore of the backup, because people usually don’t do it Winking smile

Here’s really why Azure can help:

  1. You only have to size for the local backup storage system, archival is done is the cloud.
  2. With all hidden costs of tape systems included like offsite processing, storage on cloud is very likely to be always cheaper than any on-premises storage.
  3. You can easily test restoring data in a separate and isolated environment.
  4. You can easily backup files on servers and client with a small backup agent
  5. You can easily backup your applications running on Hyper-V on Vmware with Azure Backup Server.

Here’s what you need to get started building solutions on Azure:

Overview video

https://azure.microsoft.com/en-us/resources/videos/what-is-azure-backup/

Overview article

https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup

Training Videos:

https://mva.microsoft.com/en-us/training-courses/hybrid-cloud-workloads-storage-and-backup-8335?l=QeQ9Uyay_6204984382

Pricing reference:

http://azure.microsoft.com/en-us/pricing/details/backup/

Technical References:

Azure Virtual Machine Backup: https://azure.microsoft.com/en-us/documentation/articles/backup-azure-vms/

Microsoft Azure Backup: https://azure.microsoft.com/en-us/documentation/articles/backup-azure-backup-windows-server/

Microsoft Azure Backup Server: https://azure.microsoft.com/en-us/documentation/articles/backup-azure-dpm-introduction/

Architecture references:

Azure Backup Limitations – http://social.technet.microsoft.com/wiki/contents/articles/28395.azure-backup-limits.aspx

Security features for protecting hybrid backups using Azure Backup – https://docs.microsoft.com/en-us/azure/backup/backup-azure-security-feature

Third parties’ backup solutions supporting Azure

Commvault – https://www.commvault.com/solutions/by-technology/virtual-machine-and-cloud/microsoft-azure

Veaam – https://www.veeam.com/cloud-connect.html

Veritas – https://www.veritas.com/solution/azure

Service updates information

https://azure.microsoft.com/en-us/updates/?product=backup

When you have deployed the solution and want to go further with Automation, there’s a pretty nice course on Microsoft OpenEDX: https://openedx.microsoft.com/courses/course-v1:Microsoft+AZURE210x+2016_T4/about 

If you want to get started on Azure the good way, you can register to IT Pro Cloud Essentials, it includes online trainings, MCP vouchers and  monthly free credits to use Azure: https://www.microsoft.com/itprocloudessentials/en-US 

Feel free to connect with me and provide feedbacks!

Arnaud

Getting started with – Azure Site Recovery

<updated 14th march 2017>

gettingstarted-asr

In this series of “Getting Started” articles, I will post the most up-to-date information I use with Microsoft Partners and customers when enabling them with Azure infrastructure services. I follows the same structure which is: getting started, training videos if available, then reference architectures, capacity planning and pricing information.

Disaster Recovery Plans aka DRP is one the most ungrateful work in IT. Because basically you are going to prepare for some situations that will be painful and difficult. However, this is a good exercise to protect against one of the most prevalent laws in IT: “Anything (Everything) will fail at some point, and very likely at the worst time”.

It puts you in a state of mind that most of people don’t like.and you will ask your boss money for something that you hope will never be used.

That’s where the cloud can help, for both virtualized and non virtualized workloads. Here’s how in 4 easy steps:

  1. First step consists of replicating your production workloads as they are running.
  2. Second step is to automating the disaster recovery plan execution.
  3. Run the workloads in Azure.
  4. Replicate your virtual machines back to your datacenter.

Overview video

https://www.youtube.com/watch?v=eOOwMQPBKfM

Overview article

https://azure.microsoft.com/en-us/documentation/articles/site-recovery-overview/

Training Videos

https://channel9.msdn.com/Series/Azure-Site-Recovery

Technical References

Azure Site Recovery support matrix – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-support-matrix

Prepare for Azure Site Recovery deployment – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-best-practices

Migrate AWS workloads to Azure – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-migrate-aws-to-azure

Architecture references

VMware and Physical Servers to Azure – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-vmware-to-azure

Hyper-V to Azure – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-hyper-v-site-to-azure

VMM to Azure – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-vmm-to-azure

Network planning for disaster recovery: https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-network-design

Workload guidance

What workloads can you protect with Azure Site Recovery? – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-workload

Active directory and DNS

SQL Server

Sharepoint

Dynamics AX

Exchange

SAP

Running automation in ASR – https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-runbook-automation 

Sizing & capacity planning

Capacity planning: https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-capacity-planner

Azure Site Recovery Deployment Planner: https://aka.ms/asr-deployment-planner-doc 

Pricing reference

https://azure.microsoft.com/en-us/pricing/details/site-recovery/

Service updates information

https://azure.microsoft.com/en-us/updates/?product=site-recovery

When you have put the infrastructure in place and are in the process of fully automating the disaster recovery plan, you need skills on Azure Automation. There’s a pretty nice course on Microsoft OpenEDX: https://openedx.microsoft.com/courses/course-v1:Microsoft+AZURE210x+2016_T4/about 

Feel free to connect with me and provide feedbacks!

Arnaud

My Azure IaaS Toolbox

iaastoolbox

<last update 31/01/2017>

As I help customers and partners to build VM and various infrastructure services on Azure, I started to accumulate a lot of tools to make life easier. Here is my list, feel free to comment and share yours, I’d be happy to learn about new ones!

 

Storage

Tool Platforms Notes
Azure Storage Explorer (Microsoft) Linux, Windows, Mac Nice UI to manipulate storage in Azure.
AzCopy (Microsoft) Windows Command line context to upload/download storage content.
Cloud Explorer (Red Gate) Windows GUI free tool from Red-Gate to explore Azure storage.
CloudXplorer (Clumsyleaf) Windows Classical tool from Clumsyleaf.
Trucks   Because sometimes it’s just too big, send your disks to Azure and we import it for you.

 

Networking

Tool Platforms Notes
http://www.azurespeed.com/ Tests the speed of Azure Services from your IP location to the rest of the world.
Message Analyzer Windows Network traces and so much more.
Network Monitor (netmon) or WireShark Windows, Mac Netmon 3.4 still works on Windows 10, as an alternative to WireShark.
Fiddler (Telerik) Mac, Windows, Linux, etc. Web debbuging proxy for fun and profit.
tnc (PowerShell) Windows 8.1 Tnc is a tool built-in Windows 8.1 and later, allows you to test network connectivity and latency on various ports.
PortQryUI Windows TCP and UDP Port Query fairly old tool, preset with common Windows Ports and services.

 

Compute

Tool Platforms Notes
Remote Desktop Connection Manager Windows Classical multi windows RDP client.
MobaXterm Windows Multi windows SSH client combined with SCP capabilities.
Virtual Machine Readiness assessment Windows Toolset used to evaluate a VM’s readiness for Azure. Gives you a detailed report of the machine state.
Certification Test tool for Azure Certified Windows This tool allows you to self-assess your VM configuration against Azure best practices for certification (prerequisite for the Marketplace).
Virtual Machine Manager (VMM) Plugin Windows Allows you to manage your Azure resources from VMM.

 

General Automation

Tool Platforms Notes
PowerShell Windows Direct MSI Setup, avoiding the infamous WebPI. Script center to find examples: Browse script center
Cross platform CLI Linux, Mac, Windows The cross platform command line interface for Azure.

 

Documenting platforms

Tool Notes
http://armviz.io/ Visualize a JSON template graphically
http://www.azuredockit.com/ Generate a documentation or diagram of a deployment
Azure, Cloud and Enterprise Symbols, Icon Set – Visio stencil, PowerPoint, PNG, SVG Complete Visio and PNG illustration to document your Azure deployments
Reference Architectures Link to reference architecture and cloud design patterns
Visio File for Reference Architectures Mandatory for all cloud architects!
Architecture blueprints Architecture diagrams and blueprints for various services, can copy/paste the SVG resources from the webpage.

 

Azure Templates Authoring

Tool Platforms Notes
Visual Studio Code Mac, Linux, Windows Very nice tool to edit JSON templates for Azure and Azure Stack.
Visual Studio Windows Complete IDE for your application, includes a comprehensive support to edit and consume Azure resources directly.
Azure SDK Installation Mac, Linux, Windows, etc. Contains installers for all platforms.
https://github.com/Azure/azure-quickstart-templates Templates and quick starters for JSON templates.
Git Desktop Mac, Windows Allows to sync your Github repos on your laptop.
https://resources.azure.com/ Allows you to query API in JSON format “graphically”.
Azure Container Services Engine Mac, Windows, Linux ACSEngine helps you build ARM templates for your clustered Docker deployments.

 

Hope this was useful, please comment and have fun on Azure!

Arnaud