Preparing AzureCAF 2.0.0, published on October 19, 2026, gave us a chance to improve the whole delivery process: discovering work, preparing changes, keeping maintainers informed, and getting a release out safely.

Testing was a particularly useful application of AI: we could expand the checks, investigate failures, and build release confidence over successive iterations.

The provider generates Azure resource names in Terraform. Its history gives us a practical case study in AI-assisted development, community contributions, and the maintainer time needed to bring them together.

One repository connects the work​

I use Copilot through the CLI, Visual Studio Code, and the desktop app for interactive work. The cloud agent handles delegated tasks, preparing changes in a cloud environment and bringing them back for review.

GitHub Agentic Workflows runs recurring research and event-driven tasks. Findings, proposed changes, test results, and maintainer reports come back into the same repository.

Shared issues, PRs, and checks connect the tools with maintainer decisions. Illustrations use GitHub Octicons; editable diagram source.

Before delegating, I want a clear task, an expected result, and a way to check it. A cloud agent can work on a bounded change while I investigate another problem locally. The PR becomes the handoff: a diff, supporting sources, and evidence from the checks. Release approval remains a maintainer decision.

Shared repository skills give agents the research and testing procedures behind that handoff.

Being proactive between releases​

The Weekly Azure Sync workflow compares our catalog with tracked AzureRM resources and investigates naming-guidance changes. Issue Triage and Issue Arborist help organize the resulting backlog.

Selected issues labeled new-resource can trigger the Issue-to-PR workflow. It follows the research procedure, updates the catalog, builds the provider, and proposes a PR with supporting sources.

An upstream change can become a research issue before a user reports a failure. Maintainers choose which findings deserve implementation. Each resulting PR should explain its sources, compatibility implications, and remaining uncertainty. Fresh upstream inputs and explicit reporting of incomplete checks are part of maintaining this loop.

A briefing for the maintainer​

The Repo Status workflow gathers recent activity and recommends next steps. It helps me return to the project and decide what to review, investigate, or defer.

When maintenance competes with other commitments, I want a briefing I can act on: the changes awaiting review, the issues behind them, and the next decisions to make. Links to the underlying work let me check a recommendation before committing maintainer time.

Originally daily, it now covers the previous seven days on a weekly schedule. We adjusted the cadence alongside other workflow improvements to keep maintainer attention focused.

Security stays in the review path​

GitHub Advanced Security and other checks supply review evidence: CodeQL scans Go and Actions code; Dependabot security updates, secret scanning, and push protection are enabled. These controls cover agent-prepared changes too. Private-repository availability depends on the relevant GitHub security products.

Where the time went​

To understand where time was spent, I followed Copilot-opened changes from draft PR to review-ready proposal, merge, and publication. The table measures the pace through those stages, using the records available for each milestone.

The recorded proposals typically reached review in hours, while the merged changes reached publication in days. These are calendar times, including waiting between steps. The samples differ, so read each median independently.

The merged PRs in this sample shipped in earlier 1.x releases. Human-led, AI-assisted work, including the 2.0.0 preparation, sits outside this Copilot-author timing sample.

The bulk update behind the opening figures shows the work between those milestones. Review removed 16 invalid candidates from the initial proposal. The final change added 89 definitions, taking the catalog from 405 to 494, before publication about 11 days after PR creation.

The 2.0.0 release PR also closed 18 issues with a median age of 497 days, incorporating earlier community work and checking resolutions against the original reports.

Earlier unmarked merged PRs had a median 7.90 days to publication across 99 PRs. Different tasks, periods, and release conditions make that an imperfect baseline. A causal comparison would need comparable work and recorded effort.

Building release confidence over time​

Testing was one of the clearest benefits of working with Copilot. The Copilot-coauthored testing work added edge cases and integration checks. Re-running historical provider tests shows statement coverage rising from 82.5% at the earlier baseline to 95.6% in 2.0.0, while named Go test functions grew from 33 to 124.

My confidence built gradually. Reviews and test runs exposed names changing unexpectedly, inputs unavailable during planning, and invalid test fixtures. We investigated each failure, added regression checks, and reran the release gates. That repeated cycle made me more comfortable publishing the release.

The final release evidence included 445 passing AzureRM mock workspaces, plus lifecycle and packaging checks. AI helped us expand and exercise those checks; their results supported the decision to release.

# main.tf
terraform {
  required_version = ">= 1.7.0"

  required_providers {
    azurecaf = {
      source  = "aztfmod/azurecaf"
      version = "= 2.0.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "= 5.0.1"
    }
  }
}

provider "azurecaf" {}

provider "azurerm" {
  features {}
  subscription_id = "00000000-0000-0000-0000-000000000000"
}

variable "azurerm_name_override" {
  type    = string
  default = null
}

resource "azurecaf_name" "example" {
  name          = "myproject"
  resource_type = "azurerm_resource_group"
  prefixes      = ["prod"]
  clean_input   = true
}

resource "azurerm_resource_group" "example" {
  name     = coalesce(var.azurerm_name_override, azurecaf_name.example.result)
  location = "westeurope"
}

output "result" {
  value = azurecaf_name.example.result
}

# tests/validate.tftest.hcl
mock_provider "azurerm" {}

run "validate_generated_name" {
  command = apply

  assert {
    condition     = output.result != ""
    error_message = "AzureCAF returned an empty name."
  }

  assert {
    condition     = length(output.result) >= 1 && length(output.result) <= 90
    error_message = "The resource group name must contain 1 to 90 characters."
  }

  assert {
    condition     = can(regex("^[a-zA-Z0-9-._\\(\\)]{0,89}[a-zA-Z0-9-_\\(\\)]$", output.result))
    error_message = "The name does not match the CAF resource group definition."
  }

  assert {
    condition     = azurerm_resource_group.example.name == azurecaf_name.example.result
    error_message = "The AzureRM resource name must match the AzureCAF result."
  }
}

run "second_apply" {
  command = apply

  assert {
    condition     = output.result == run.validate_generated_name.result
    error_message = "The generated name changed on the second apply."
  }
}

run "replan" {
  command = plan

  assert {
    condition     = output.result == run.validate_generated_name.result
    error_message = "The generated name changed during the next plan."
  }
}

# registry.tfrc
provider_installation {
  direct {}
}

TF_CLI_CONFIG_FILE="$PWD/registry.tfrc" terraform init
TF_CLI_CONFIG_FILE="$PWD/registry.tfrc" \
  terraform test -filter=tests/validate.tftest.hcl -verbose

TF_CLI_CONFIG_FILE="$PWD/registry.tfrc" \
  TF_VAR_azurerm_name_override='invalid!name' \
  terraform test -filter=tests/validate.tftest.hcl

# terraform.rc
provider_installation {
  dev_overrides {
    "aztfmod/azurecaf" = "/absolute/path/to/local-provider-build"
  }
  direct {}
}

make test_mock_azurerm_changed
make test_mock_azurerm_all

Keep the automation worth running​

The no-op tracker recorded 401 reports from distinct runs between June 11 and September 9, 2026; 251 came from Issue-to-PR. Some explicitly reported unrelated labels. Clean health checks can be useful; those irrelevant event-triggered runs showed where filtering needed attention.

We used that feedback to refine the process. After the release, aztfmod/terraform-provider-azurecaf#936 moved predictable test jobs into ordinary scheduled Actions and tightened agent triggers or reduced their frequency.

Agents remain useful for research, interpretation, and proposed changes. Their schedules and outputs need the same attention as other automation. The tracker measures activity; financial cost would require billing data.

on:
  issues:
    types: [labeled]
    names: [new-resource]

safe-outputs:
  create-pull-request:
    title-prefix: "[auto] "
    labels: [automated, new-resource]

Turning capacity into outcomes​

A researched proposal gives me useful preparation capacity. A richer test suite gives me more evidence for review. Both help, and both still need maintainer time, prioritization, and a path to release. The timestamps show the elapsed time; understanding each delay takes further investigation.

I would read enterprise AI productivity figures the same way. More prepared changes can increase the queue at an already-busy review or integration stage. Realizing the benefit also depends on approvals, rollout windows, and adoption by users.

For engineering leaders, I would follow three measures together:

• Preparation: time to a review-ready change, including the rework needed to make it acceptable.
• Delivery: time through review, integration, and release, with attention to growing queues.
• Outcomes: whether users adopt the change and receive the intended benefit.

In AzureCAF, publication is the milestone we can observe. User adoption and production reliability would need their own evidence.

If changes wait for review, the next improvement might be clearer PR evidence, smaller changes, or protected reviewer time. If they wait after merge, look at release preparation and rollout constraints. Tracking the handoffs helps a team choose an investment that can move delivery forward.

terraform {
  required_providers {
    azurecaf = {
      source  = "aztfmod/azurecaf"
      version = "~> 2.0"
    }
  }
}

data "azurecaf_name" "example" {
  name          = "myproject"
  resource_type = "azurerm_resource_group"
  prefixes      = ["prod"]
  suffixes      = ["001"]
}

output "resource_group_name" {
  value = data.azurecaf_name.example.result
}

resource "azurecaf_name" "current" {
  name          = "stdevmyapp001"
  resource_type = "azurerm_storage_account"
  passthrough   = true
}

Now it's your turn​

Start with one recurring maintenance task, give it a clear output and owner, and follow it through review and release. Leave the useful checks and procedures in the repository for the next run. Then use the delivery data to decide where to spend the next hour.

The AzureCAF workflows and release notes are public. Happy to hear what you find!

Thanks,

Arnaud

Today we are going to review how to contribute to the Cloud Adoption Framework for Azure Terraform module Open Source project.

The CAF module​

Almost a year ago we switched to a one-module approach that allows high speed of evolution (we know how time-consuming it is to update a set of small modules). We have implemented that with conditional submodules feature introduced in Terraform 0.13 and we have been running that way up to Terraform 1.0.0 with excellent feedbacks.

Having one single module makes the development more difficult for the developer, as it requires working on the iterative structures and junction between the different objects – One could argue this is the job of anyone trying to put more than two Terraform modules together. On the other hand, having the single module integrated allows composition and configuration way faster for the DevOps engineers and architects putting together a configuration.

This module can be leveraged from any Terraform code via the Terraform registry, using the following syntax:

module "caf" {
  source  = "aztfmod/caf/azurerm"
  version = "5.3.11"
  # insert the 6 required variables here
}

You can find many examples on the module GitHub repository here.

The power of the community​

With the speed of evolution of Terraform and the Azure provider, inner-sourcing components for enterprises is a pragmatic option that allows DevOps engineers to focus on delivering value.

Adding a new capability​

Let’s say you are reviewing the CAF module capabilities and realise it’s missing a feature, and you want to write it and contribute to the community.

We will do that with a simple example: someone in the community opened an issue for Azure Dedicated Hosts, which allows you to deploy a dedicated Hypervisor for your Virtual Machines. You can find all the details about it here:

Basically we will create two objects:

• the hosts groups: a set of machines in a particular region with a set of capabilities like availability sones and fault domains:
• the hosts: the hypervisor itself, which will be hosting the Virtual Machines.

And we can foresee that we will need to change the virtual machines module capabilities to declare that a particular VM will be deployed on a dedicated host.

The toolset​

In order to get things started, I will get the following development environment:

• GitHub Codespace
  • Codespace allows me to develop directly off my browser. I can fork the repo, then I don’t even need to clone it locally. Since the module has a .devcontainer it will pick the right version of development environment plus the development tools I need.
    I could also clone the project it and then open it locally into Visual Studio Code, the same development environment would have been created.
• Terraform documentation
  • For Azure Dedicated Host, I browse off the Terraform registry and find the following related components:
    • https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/dedicated_host
    • https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/dedicated_host_group
• Azure subscription
  • You can get started for free here: https://azure.microsoft.com/en-us/free/

Aligning all side-by-side, and lets go for the coding!

For the rest, let’s do it in a video – full screen required :):

Refactoring and dependencies​

It’s very rare that we get things right from the beginning, so after a review, I detect that I can improve the following ones:

Object syntax for the VM​

In my initial implementation, I did the following syntax to reference the Dedicated Host to my virtual machine:

 dedicated_host_group = {
        dedicated_host_group_key = "dh1"
        # lz_key = "remoteLZKey"
        # id = "full resource ID"
    }

But I actually don’t the need group but the host, so I refactor the object and standardize on our pattern that allow using the object from:

• resource ID of the object deployed outside of this module
• key of an object deployed locally
• key of an object from another landing zone (via the lz_key attribute)

  dedicated_host = {
        key = "dh1"
        # lz_key = "remoteLZKey"
        # id = "full resource ID"
    }

Composition patterns to retrieve the Dedicated VM dedicated​

At first the pattern to locate the dedicated host_id in the VM object was the following:

dedicated_host_id = try(try(each.value.dedicated_host_group.id, var.dedicated_hosts[try(each.value.dedicated_host_group.lz_key, var.client_config.landingzone_key)][each.value.dedicated_host_group.dedicated_host_group_key].id), null)

It worked, but did not align with updated patterns that offer better visibility and troubleshooting, so I just updated it into:

dedicated_host_id = try(coalesce(
    try(each.value.dedicated_host.id, null),
    var.dedicated_hosts[try(each.value.dedicated_host.lz_key, var.client_config.landingzone_key)][each.value.dedicated_host.key].id,
    ),
    null
  )

Dependencies​

There are also dependencies that I managed in the meantime, like the name convention provider. I checked at the naming reference here.

The CAF Terraform name provider can be found on the Terraform registry here

And we load it this way:

terraform {
  required_providers {
    azurecaf = {
      source  = "aztfmod/azurecaf"
      version = "~> 1.2.0"
    }
}

It was my first PR to the name provider so I was quite surprised of the easiness of contribution, the most complicated part was to find the right regex to match the supported characters for Azure Dedicated Hosts.

You can review the PR here and contribution guide.

Now it’s your turn​

Let’s get started! Happy to hear your thoughts and learn from your feedbacks, also if you identify a missing feature and you want to give it a try, lets:

1. In the GitHub Issues, verify if there is an Epic covering the module you are describing.
2. If the change you are proposing is a sub-feature of an epic, please open an issue describing your changes in details and the reasons for the change with an example.
3. On submitting the PR, please mention the Issue related to the PR.

Also before submitting the PR, make sure:

1. Make sure you are using the Visual Studio Dev environment with pre-commit hooks effective.
2. Matching with coding conventions and common engineering criteria described here.
3. Provide examples including the main scenarios the module is supposed to achieve.
4. Include integration tests for your examples.

Thanks

Arnaud

In the meantime lot of great things have happened: an enterprise-scale reference architecture and it’s ARM-based implementation, alongside with an incredible acceleration on the release rhythm of the Azure Terraform provider reducing the delay between features appearing in Azure and time it is available in native Terraform.

Terraform 0.13​

Terraform 0.13 has been released mid August, and you can read the full details here. For us, the major improvements are:

• Registry-based provider sourcing: No more need to side-load our custom provider, you can leverage it directly from the Terraform registry just like we for modules: our CAF provider is published here
• Variables validation: Only allow variable to be within a certain range or validating a regex.
• Iterations and conditions on modules: more later in this article.

Testing Terraform 0.13 with rover​

After weeks of testing reliability of Terraform 0.13 during this summer’s beta, we were very happy with the stability and performance so we decided to push further our way of operating.

rover is part of the DevOps toolset we provide you with and recommend using for development teams and pipelines deployment. During this testing stage, it played full role allowing us to switch fast from one codebase to the other and also to one version of Terraform to the other.

What’s new in CAF landing zones​

Leveraging Terraform 0.13, we were able to introduce new concepts in landing zones on Azure:

One module to rule them all​

We have been curating 20+ modules during the last year, all published on the Terraform registry and some of them being consumed more than 26,000 times.

While it was important to have different modules to maintain a very fine-grained versioning of the components we use, we found it to be a lot of work, for little added value.

We then decided to explore a model where we use only one module, that would call and iterate on different submodules – that permitted by Terraform 0.13.

We must admit we have been impressed by the results on how the graph performs, and the speed at which it works.

So the new module is still in preview but already available available here https://registry.terraform.io/modules/aztfmod/caf/azurerm/latest

Iteration-based objects deployment​

To deploy core features, landing zones are now calling one module. This master module has all the major components we need to deploy within landing zones, and it iterates on every objects in the following way:

So from the configuration prospective, you define your network configuration with a complex object like this one:

So wether you need one or ten virtual networks, we iterate automatically for you.
By default the vnets like all the other variables are set to {}. So it means nothing will be created, only the variables you populate will be iterated on.

Key-based configuration and customization​

All configuration objects will call each other based on the object keys. As we just seen, we use complex objects that are iterated and referenced via their keys.

It means for instance we create all the resource groups using the following object:

In that example, we create two resource groups which keys are vnet_region1 and vnet_region2. We we create the virtual network called hub (and which key is hub_sg we reference the resource group via the resource_group_key property.

Under the hood, the module is mapping back the resource group to the key with the following logic:

No-code environment composition​

Overall this makes writing the modules code slightly more complicated, but what it means for users is the possibility to compose complex environment without changing anything in the code.

A good example for that is the networking landing zone where we are able to compose all kind of Azure network topologies (like Hub-and-Spokes virtual networks, Virtual WAN-based hub-and-spokes, etc.).

We can establish peering between on object in the current landing zone and a remote landing zones (this is very common to have separate states for the hub and the spokes)

Overall we have tested it internally and externally and have found:

• We have been able to compose any kind of architecture using this pattern.
• It is very fast to compose a new environment.
• It is very fast to process by Terraform and Terraform graph.

DevOps from the ground-up​

At the root of deployments, we have our launchpad which sets the Azure backend and collaboration requirements.

We want to offer our customers choices and options so the new launchpad is modular: allowing add-ons to complement the configuration like:

• DevOps Pipelines configuration and secret management leveraging the official Microsoft Azure DevOps provider for Terraform
• Terraform Cloud and Terraform Enterprise
• GitHub and GitHub Enterprise
• Any other solution.

For an example of landing zones on Azure DevOps, you can refer to the following demo:

For an example of landing zones on Terraform Cloud, you can refer to the following demo:

Coding everywhere​

Using Visual Studio Codespaces or GitHub Codespaces, you can develop and deploy landing zones without installing anything on your laptop, with full access to the rover and development environment.

You can try it now: or on GitHub Codespaces

The journey ahead​

Enterprise-scale landing zones​

Enterprise-scale is a reference architecture, set of design guidelines, and reference implementation for an Azure enterprise environment.
You can find all the details here..

We are working on it with the team and are integrating the module on the foundations layers. You can also try out the module here.

Delivering solutions​

We found a lot of interest from customers and partners to leverage the DevOps and everything-as-code environment we setup in order to accelerate the development and the deployment of ready-to-use solutions.

We are currently working to publish solutions that you can stack-up on top of the lower levels of landing zones, amongst them, you will be able to find:
* AKS topologies including layer 4 applications
* Data and analytics, to deploy Azure Synapse, Databricks, Machine Learning, etc..
* More to come…

On the way to Terraform 0.14​

Just announced, Terraform 0.14 will also bring some good features, you will be able to test it out soon in a new rover. You can read the news here

Contribute​

All of that is still work in progress and you can contribute by opening an issue, a pull request or just testing it!

The repo is here: https://github.com/Azure/caf-terraform-landingzones and (most) of the things described are currently in the 0.4 branch, and will be available on this month release (2010 Update)

We’d love to hear from you, so don’t hesitate to give us feedback here or on Gitter

Arnaud

CAF landing zones are an open source project living on GitHub and we welcome any contribution: https://aka.ms/tf-landingzones

In this article, you will find a set of videos and articles that should help you understanding the landing zones architectures and how to start crafting your own.

Cloud Adoption Framework: Introduction landing zones for Terraform​

Cloud Adoption Framework: Deep-dive on landing zones for Terraform​

First Deployment:​

Setup Environment:​

Cloud Adoption Framework landing zones with Terraform

Official Cloud Adoption Framework landing zones:

https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/expanded-scope/terraform-landing-zone

If you are getting started with Terraform on Azure:

• Terraform.io: https://learn.hashicorp.com/terraform?track=azure#azure

• Step by steps guidance on Terraform for Azure: https://azurecitadel.com/automation/terraform/

• Getting started with Terraform on Azure

Operating governance on cloud native technologies:

• Visualising a Cloud Native Operating Model for Enterprise Adoption:
  https://medium.com/@lachlan_white/visualising-a-cloud-native-operating-model-for-enterprise-adoption-b70cc5790d48 More to come soon!

Adopting CAF landing zones with Terraform, customer consistenly realize they can:

• deploy foundations of cloud environments fast
• easily deploy governance and policies as code (with ongoing compliance enforcement and remediation)
• have consistent ways to deploy innovation (infra as code, policies as code or application code are using the same mechanisms).
• and many more.

This overall enables them to: optimize their operations, innovate faster and cheaper, but we will come back to that in another article.

For now, let’s get you started with landing zones development and deployment!

When deploying Infra-As-Code environments, we found it extremely important to have:

• strong versioning (accross dev environment, DevOps pipelines, etc.).
• short feedback loops: ability to innovate fast on your development, test new code without having to go through the whole pull-request and so mechanisms.
• accomodate diversity of environments (running Windows, Mac, Linux).
• strong identity consistency and no secret in any code.

In order to enable that, we use Docker containers as development (on your laptop) and deployment (CI/CD pipelines) environement. The toolset is packaged inside what we called the rover and in order to get started – whichever your platform is, just:

• Install Docker
• Install Visual Studio Code

Once its done, make sure Docker is up and running, then Open Visual Studio Code:

We need to install “Remote Development” extension, so click the Extensions icon and then find and install “Remote Development” from Microsoft:

To make your life easier, we are going to leverage Visual Studio Development Containers, which allows you to seamlessly work on your machine and execute your code in the rover container.:

So on your machine, you will have your Terraform files, with your Git connection and other tools, but when you run the code, its seemlessly integrated with the Rover running in the container, so you can develop, test, run the complete environment.

Deploying your first landing zone

Once you have deployed the prerequisites, you can just clone (with Git, or GitHub Desktop) from our repository: http://aka.ms/tf-landingzones and open it in Visual Studio.

If you look at the files, it’s classic Terraform scripts except for the  .devcontainer folder where we have two files:

• devcontainer.json: describes how to connect to the container, the mounting points and extensions.
• docker-compose.yml: describes the container configuration needed, especially where to get the rover image (tip: we put it on the Docker registry so you dont have to manage it)

You can then go to the bottom left, green part of Visual Studio Code and select

Open Remote-Containers: Open Workspace in Container, then select the default workspace we created for you (workspace.code-workspace). You will see a new window opening and you can see the details of the Docker container operations:

• downloading the container from registry
• mounting the volumes
• creating the network
• installing VSCode drivers in the containers

You are now ready to start hacking, you can start by launching:

1. rover login 
2. rover /tf/caf/landingzones/landingzone_caf_foundations plan 
3. rover /tf/caf/landingzones/landingzone_caf_foundations apply 

So let the fun begin!

Demo

TLDR; Here is a video with the different steps I described:

Happy hacking, let me know your feedbacks and lets connect!

@arnaudlheureux

On-demand session​

Here is the link to attend the full session, on-demand: https://info.microsoft.com/AP-AzureSec-WBNR-FY20-10Oct-24-AzureSentinel-SRDEM10204_LP02OnDemandRegistration-ForminBody.html 

Slides​

View the slides on SlideShare

Demos​

Onboarding Sentinel and dahsboards exploration​

Security Investigations with Azure Sentinel​

Additionnal resources:​

• Sentinel Onboarding: https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard 
• Azure Sentinel Landing Page: https://azure.microsoft.com/en-sg/services/azure-sentinel/
• Connectors list: https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources 
• Community GitHub: https://github.com/Azure/Azure-Sentinel
• Insecure protocol dashboards: https://blogs.technet.microsoft.com/jonsh/azure-sentinel-insecure-protocols-dashboard-setup/
• MITRE ATT&CK Detection rules: https://github.com/BlueTeamLabs/sentinel-attack/tree/master/detections 
• Converting Sigma detection rules to KQL: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Importing-Sigma-Rules-to-Azure-Sentinel/ba-p/657097 
• Hunting framework: https://github.com/wortell/AZSentinel and https://github.com/BlueTeamLabs/sentinel-attack 
• Demo of F5 Big IP Integration with Azure Sentinel: https://www.youtube.com/watch?v=4uLoEW_l6EQ 

As usual, happy to hear your feedbacks!

Arnaud

As a quick reminder, below is the set of network protections in front of your Azure instances. DDoS protection exists in a free tier which is present by default on all resources you publish using a public IP address. In this session we discuss about the addition of the “Standard” edition of the Azure DDos protection.

On demand session​

https://info.microsoft.com/AP-AzureINFRA-WBNR-FY20-09Sep-19-AzureDDoSProtectionStandard-SRDEM4832_LP01Registration-ForminBody.html \

Slides​

View the slides on SlideShare

Demo​

Additionnal links:​

• Overview: https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview 
• BreakingPoint.cloud: https://www.ixiacom.com/products/breakingpoint-cloud

As usual, feel free to send your feedbacks and suggestions!

Arnaud

https://arnaud-web.azurewebsites.net/2019/11/15/cloud-adoption-framework-landing-zones-with-terraform/

Cloud Adoption Framework for Azure has a great set of recommendations to accelerate deployment of Azure for entreprises who seek to consolidate their IT environment in the cloud and innovate on their applications.

CAF introduces landing zones as a concept that describes all the elements that must be in place to deploy a production-grade quality deployment (ie, that includes a minimal set of auditing, controls, policies, etc).

In order to accelerate that, let’s review how to deploy our first landing zone for Azure based on Terraform! We assume that you know Terraform and Azure already, if thats not the case, spend some time on my previous post.

We have published and will keep on updating a repository on GitHub: http://aka.ms/tf-landingzones

Getting started​

The fastest way is to use Azure Cloud Shell:

1. Open https://shell.azure.com
2. Go to the clouddrive directory: cd clouddrive
3. Clone the GitHub repo from http://aka.ms/tf-landingzones git clone https://github.com/aztfmod/blueprints.git
4. Initialize the environment – this will create the fundamentals for the Terraform state, like Storage Account, Azure Key Vault, and the managed identities: ./launchpad.sh
5. Deploy your first tranquility blueprint: ./launchpad.sh landingzone_vdc_level1 plan
6. Review the configuration and if you are ok with it, deploy it by running: ./launchpad.sh landingzone_vdc_level1 apply

Below is a quick demo of doing that:

Customization​

In order to ease your first contact with the landing zone, we created a sample configuration file proto.landing_zone_vdc_level1.auto.tfvars. As any .auto.tfvars file, it is going to be picked up automatically by Terraform when running. This file automatically configures all variables needed to get started:

• Retention period for Activity logs, and operations logs.
• Names of the resource groups to be created.
• Location of the resources to be deployed.
• Tags for the resources.
• Name of log analytics and list of solutions to be deployed.
• Security center contact details.

You can tune it to match your criteria, we hope the syntax is self explanatory, feel free to provide feedback on it!

Quick tour of the architecture:​

Currently the solution is composed of 3 main components:

1. Launchpad.sh​

Is a shell script, it initiates the Terraform state locally, uploads it to the Azure storage account, manages the environment variables and communication accross landing zones and other components.

2. Level0_launchpad​

Creates a Key Vault, an Azure managed identity a storage account that is used to create store the Terraform state of our environment. It also creates a serie of service principals to be used to access the Terraform state and to integrate with Azure DevOps (in a future release). For full documentation, refer to the readme file.

3. Landingzone_vdc_level1​

This vdc level1 landing zones leverages one blueprint (called tranquility) that sets the foundation for everything accounting and operations logs in your Azure subscription:

• Resource groups

• Activity Logging

• Diagnostics Logging

• Log Analytics

• Security Center

Each of those features deployments are accomplished by a respective module, which is also on the GitHub, which Terraform download when it needs it (at the plan stage).

A diagram of landingzone_vdc_level1 would look something like that:

For full documentation, refer to the readme file.

That’s it for now, it should be enough for you to get started on the Azure Landing Zones using Terraform. Keep in mind there is much more to come on the Landing Zones, we will keep on publishing more and we will have a couple of webinars to go deep dive on the subject!

Happy landing landing zones crafting!

Arnaud Lheureux

Slides:​

▶ View the document on OneDrive

Reference Links:​

• Terraform Documentation: https://www.terraform.io 
• Terraform AzureRM provider: https://www.terraform.io/docs/providers/azurerm/ 
• Terraform modules registry: https://registry.terraform.io
• Azure Terraform Hub: http://aka.ms/tfhub 
• Great serie of step-by-step guidance for Terraform on Azure: https://azurecitadel.com/automation/terraform/ 

Tips to get started with Visual Studio Code:

Install the Terraform extension, you may notice that the 0.12 type of syntax is not recognized by default as its still under development. You can enable preview version running Terraform: Enable/Disable Language Server in the palette.

Azure Cloud Adoption Framework in Terraform samples:​

If you want to kick-start your Azure deployment based on Cloud Adoption Framework Landing Zones, here are some Terraform examples of it (more webinars on this coming soon): http://aka.ms/tf-landingzones

Have fun with this!

Demos​

Demo 1: Getting started with your environment

Demo 2: First deployment

Demo 3: States and outputs

Demo 4: Modules

As usual, feel free to send your feedbacks.

Arnaud

Since we started to help customers of all sizes to deploy cloud technologies, we have developed many frameworks which all evolved in parallel over time. You may have heard about: Cloud Adoption Framework, Cloud Operations Model, Entreprise Cloud Strategy, Entreprise Scaffolding and maybe a couple more.

The CAF is dead, long live the CAF!​

A couple of weeks ago, we published a new version of CAF – Cloud Adoption Framework for Azure, which consolidates all of our engineering and field best practices, as well as patterns that we’ve seen from big entreprises going to the cloud.

CAF has now five main sections which guide you throughout the whole circle:

1. Plan
2. Ready
3. Migrate
4. Manage
5. Govern

This model is very realistic and field inspired, including some discussions around adoption with one or more cloud providers.

Governance​

One of the most intimidating aspects of cloud adoption is the governance: how to manage new risks that are involved with cloud deployments and how to accompany that with entreprise processes and policies (and how does it remain current).

It is of course an iterative process that will evolve as you add new services into your environment: from dev/test to prod, and from legacy 3-tiers application to a brand new cloud-native application.

We distinguish 5 disciplines in governance:

1. Cost management
2. Security baseline
3. Resource consistency
4. Identity baseline
5. Deployment Acceleration

But the difficulty is the first step: how do I get a minimal viable product (MVP) for my first cloud deployment?

Actions: In order to avoid you the blank page syndrome, we have prepared you some actions:

1. Determine your immediate objectives with cloud, and the readiness of your organization. Cloud Assessment Tool: https://aka.ms/CAF/gov/assess 
2. Establish your governance MVP:
   1. Small to Medium Entreprises
   2. Large Entreprises

For all those journey we document a minimum viable product across the five disciplines, we explain the design decisions we took for you, the discussion points and alternative design considerations.

When we define governance, we also think about compliance to the rules, and automatic remediation methods for it: this is called Azure Policy.

Along the way, if you are going for ongoing compliance, why not going to continuous integration and continuous deployment for your infrastructure?

If you want to have a look at all of that in action, check at:

• Our webinar on Azure Cloud and Compliance
• Infra as Code hands-on-labs – https://www.azuredevopslabs.com/labs/vstsextend/terraform/ 

Azure Scaffolding​

We used to talk a lot of  “scaffolding” as it is an excellent checklist, or set of mandatory technical implentation details for a good cloud deployment. It is being replaced by the “landing zone” construct (see next section).

Here is a refresher picture about what scaffolding includes:

Important readings on Azure Scaffolding:

• the documentation: https://docs.microsoft.com/en-gb/azure/architecture/cloud-adoption/appendix/azure-scaffold 
• an example: https://docs.microsoft.com/en-gb/azure/architecture/cloud-adoption/appendix/azure-scaffold-examples 

Azure Landing Zones​

Landing Zone is our new construct to describe a good deployment, its replacing the scaffolding idea but takes all of its good ideas.

It has the idea of primitives which includes all mandatory decisions:

• Management Groups
• Resource Groups
• Naming Standards
• Number of subscriptions

On the technical implementations of Governance it includes all of:

• Policies
• Cost
• Monitoring
• Identity

Moreover, it comes with all set of decision trees in order to help you when it comes to implementation with your customers/partners:

• Compute decisions
• Storage decisions
• Networking decisions
• Database decisions

Azure Virtual Datacenter​

Azure VDC is a set of concepts, implentation guidance and automation scripts that allows you to build a highly available and highly secure datacenter, based on Microsoft Azure services.

You can find all the materials here: https://docs.microsoft.com/en-gb/azure/architecture/vdc/ 

Check at the automation scripts and all the archetypes that allow you to deploy a VDC environment fast – based on Docker and Python : https://github.com/Azure/vdc

As last reference, as usual, our Azure Architecture Center

That’s it, now you will have a very well architected Azure deployment!

Arnaud

This is a webinar that we had on March 21, which is now available on demand here: https://info.microsoft.com/AP-AzureINFRA-WBNR-FY19-03Mar-21-AzureNetworkMonitoring-MCW0012270_02OnDemandRegistration-ForminBody.html  

Slides​

▶ View the document on OneDrive

Demos​

Overview of network monitoring solutions: https://docs.microsoft.com/en-us/azure/networking/network-monitoring-overview

Monitoring VM​

Virtual machine network bandwidth: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-machine-network-throughput

Azure Monitor for Networking​

Analysis of network connection data with Azure Monitor for virtual machines: https://azure.microsoft.com/en-us/blog/analysis-of-network-connection-data-with-azure-monitor-for-virtual-machines/ 

Azure Connection Monitor​

Monitor network communication: https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor

Azure Packet Capture​

Manage packet captures with Azure Network Watcher: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-manage-portal

Azure NSG Flow Logs​

Reading NSG flow logs: https://docs.microsoft.com/en-gb/azure/network-watcher/network-watcher-read-nsg-flow-logs

Azure Traffic Analytics​

Introduction to Traffic Analytics: https://aka.ms/trafficanalyticsdocs 

Azure Virtual Network Tap​

Virtual network TAP: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview

Enjoy the fun and lets catchup on @arnaudlheureux

Session​

Slides​

Download the slides here

Demo 1: Architecture Center, Service Trust Portal​

• Azure Trust Center for APAC: https://www.microsoft.com/en-sg/apac/trustedcloud/default.aspx
• Azure Service Trust Portal: http://aka.ms/stp 
• Architecture Center: https://docs.microsoft.com/en-us/azure/architecture/ 
• Azure Virtual Datacenter: http://aka.ms/vdc 
• All Azure Governance Documentation:https://docs.microsoft.com/en-us/azure/governance/ 
• The governance journeys, per organization types: https://docs.microsoft.com/en-gb/azure/architecture/cloud-adoption/governance/journeys/overview
• Microsoft Cloud Adoption Framework for Azure: https://docs.microsoft.com/en-us/azure/architecture/cloud-adoption/overview 

Demo 2: Azure Management Groups & Azure Policy​

• Azure Management Groups: https://docs.microsoft.com/en-us/azure/governance/management-groups/
• Azure Policy Documentation: https://docs.microsoft.com/en-us/azure/governance/policy/overview
• Azure Policy Github: https://github.com/Azure/azure-policy/ 

Demo 3: Create custom policies with Terraform​

• Terraform: https://www.terraform.io/
• Getting started with Terraform: https://docs.microsoft.com/en-us/azure/terraform/ 

Demo 4: Azure Blueprints​

• Azure Blueprints Documentation: žhttp://aka.ms/whatareblueprints
• Azure Blueprints Github: http://github.com/ajf214/personal-arm-templates 
• Azure Friday Video: https://azure.microsoft.com/en-us/resources/videos/azure-friday-an-overview-of-azure-blueprints/ 

More​

Follow the new sessions coming up on the Azure APAC webinar series: 

https://www.microsoft.com/en-sg/apac/azurewebinar 

As usual, feel free to reach out if you have any question!

Arnaud

https://info.microsoft.com/AP-AzureINFRA-WBNR-FY19-11Nov-15-OptimizeyourCloudWithAzureNetworking-MCW0009873_02OnDemandRegistration-ForminBody.html 

Slides

▶ View the document on OneDrive

Demo

Azure Front Door

Azure Firewall

Reference materials:

• Azure Virtual WAN Overview: https://azure.microsoft.com/en-us/services/virtual-wan/ 
• Azure DDoS Protection Standard: https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview 
• Azure Application Security Groups: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview 
• Azure Application Gateway: https://docs.microsoft.com/en-us/azure/application-gateway/overview
• Azure Firewall: https://docs.microsoft.com/en-us/azure/firewall/overview 
• Azure Front Door: https://docs.microsoft.com/en-us/azure/frontdoor/
• Azure Monitor: https://docs.microsoft.com/en-us/azure/azure-monitor/overview 
• Azure Networking Analytics: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-azure-networking-analytics
• Azure Traffic Analytics: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics
• Azure Virtual Network TAP: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview 
• Azure ExpressRoute Direct: https://docs.microsoft.com/en-us/azure/expressroute/expressroute-erdirect-about
• Azure ExpressRoute Global Reach: https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach 

As usual, feel free to reach out if you have any question – @arnaudlheureux !

You can replay the session on-demand:
https://info.microsoft.com/AP-AzureINFRA-WBNR-FY19-09Sep-18-ThesecretsbehindawellorchestratedmigrationtoAzure-MCW0008785_01Registration-ForminBody.html 

You can view the slides:

▶ View the document on OneDrive

You can find the reference materials from this session:

• Azure Migrate Team blog: https://aka.ms/migrate/blog
• Architecture Reference: https://docs.microsoft.com/en-us/azure/#pivot=architecture 
• Azure Migration Center: https://azure.microsoft.com/en-us/migration/ 
• Azure Virtual Datacenter Architecture: https://docs.microsoft.com/en-us/azure/architecture/vdc/ 
• MOOC: Migrating Workloads to Azure: https://www.edx.org/course/migrating-workloads-to-azure-0 
• Azure Pricing Calculator: https://azure.microsoft.com/en-us/pricing/calculator/
• TCO Calculator: https://tco.microsoft.com/ 
• Partners – Intelligent Cloud Gallery Materials: http://aka.ms/icgallery 
• Partners – Migration Resources: https://partner.microsoft.com/en-us/asset/collection/azure-migration-campaign#/ 

See you soon!

Arnaud

Microsoft Azure enables you to meet the compliance requirements for data confidentiality, while ensuring data integrity and availability at all times. Tune in to this webinar to find out more about the available security technologies for your application and learn more about the security tools to help you meet the data compliance and protection requirements for your organization.

On-demand content​

Registration: https://info.microsoft.com/AP-AzureINFRA-WBNR-FY19-08Aug-29-securityandcompliancewithAzure-MCW0008428_01Registration-ForminBody.html 

Video of the session​

Slides​

▶ View the document on OneDrive

Demos​

Azure Privacy and Compliance​

• Introduction to Azure trusted cloud: https://azure.microsoft.com/en-us/overview/trusted-cloud/
• Microsoft Trust Center: https://www.microsoft.com/en-us/trustcenter/
• Data Subject Request for GDPR: https://docs.microsoft.com/en-us/microsoft-365/compliance/gdpr-dsr-azure?toc=/microsoft-365/enterprise/toc.json
• Philippines DPA https://www.microsoft.com/en-ph/TrustCenter/Privacy/DPA
• Compliance: https://www.microsoft.com/en-us/trustcenter/privacy/ensure-compliance
• MTCS: https://www.microsoft.com/en-us/trustcenter/compliance/mtcs
• Microsoft Service Trust Portal: https://servicetrust.microsoft.com/ViewPage/TrustDocuments
• Compliance Blueprints: https://servicetrust.microsoft.com/ViewPage/BlueprintOverview
• GDPR Blueprint: https://servicetrust.microsoft.com/ViewPage/GDPRBlueprint
• PCI-DSS Blueprint: https://servicetrust.microsoft.com/ViewPage/PCIBlueprint
• Azure Standard Response RFP/RFI https://gallery.technet.microsoft.com/Azure-Standard-Response-to-5de19cb6
• Azure RFP Toolkit: http://aka.ms/azurerfptoolbox 

Azure Firewall​

• Overview of Azure Firewall: https://docs.microsoft.com/en-us/azure/firewall/overview
• Getting started with Azure Firewall: https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

Azure Security Center​

• Getting started with Azure Security Center: https://docs.microsoft.com/en-us/azure/security-center/ 
• Connecting Security Center to third parties solutions: https://docs.microsoft.com/en-us/azure/security-center/quick-security-solutions 
• Azure Security Center connection to SIEM: https://docs.microsoft.com/en-us/azure/security-center/security-center-export-data-to-siem 
• Qualys Integration on Azure Security Center:
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-vulnerability-assessment-recommendations 
  • https://community.qualys.com/docs/DOC-5823-deploying-qualys-cloud-agents-from-microsoft-azure-security-center 

As usual, feel free to reach out if you have any question!

Arnaud

In this session, Cameron Gardiner, principal program manager in the SAP on Azure team, and myself cover the latest status update about technologies available in Azure to run your SAP environments.

žThis session assumes that you have a prior knowledge of SAP on Azure and cover the following topics: ž

• Latest compute offerings available in APAC region
• Latest announcements and innovation release
• žCertification status for HANA
• Running HEC on Azure
• Building SAP disaster recovery with Azure
• Support and certifications for SAP on Azure Stack and Hyper-V

The link to register to the online session: https://info.microsoft.com/AP-AzureINFRA-WBNR-FY19-07Jul-31-SAPHANAonAzure-MCW0008140_01Registration-ForminBody.html

The video of the session:

The slides of the session:

▶ View the document on OneDrive

Some additional links to document our session:

• Cameron’s Blog: https://blogs.msdn.microsoft.com/saponsqlserver/
• Azure Certification Status: http://aka.ms/sapcerts 
  • SAP IaaS Certified: https://www.sap.com/dmc/exp/2014-09-02-hana-hardware/enEN/iaas.html#categories=Microsoft%20Azure
  • SAP Note: https://launchpad.support.sap.com/#/notes/1928533 
• SAP on Azure Quick start templates (ARM templates): https://github.com/AzureCAT-GSI/SAP-on-Azure 
• SAP on Azure SUSE on the marketplace: https://azuremarketplace.microsoft.com/en-us/marketplace/apps/SUSE.SLES-SAP
• SAP on Azure Deployment Guide for High Availability: http://aka.ms/sapha
• Build a Disaster Recovery Plan for SAP on Azure: http://aka.ms/sapdr
• SQL Server 2017 Support for SAP: https://blogs.msdn.microsoft.com/saponsqlserver/2018/06/28/sap-support-for-sql-server-2017/ 
• Customers Reference for SAP on Azure: http://customers.microsoft.com/en-us/search?sq=SAP%20on%20Azure&ff=&p=0&so=story_publish_date%20desc 

Feel free to reach us for any question!

Arnaud

Session 3: Azure Backup and Disaster Recovery​

Azure Site Recovery and Backup are two features that allow you to easily build Disaster Recovery and Backup plans. In this session, we will review the different options that are available to build a DRP that you can rely on.

Session on demand: https://info.microsoft.com/AP-AzureINFRA-WBNR-FY18-03Mar-28-AzureSiteRecoveryAzureBackup-MCW0004394_02OnDemandRegistration-ForminBody.html

Slides:

▶ View the document on OneDrive

Demos:
1. Backup

▶ View the video on OneDrive

2. Disaster recovery

▶ View the video on OneDrive

Demos references:

• Azure Backup: https://docs.microsoft.com/en-us/azure/backup/backup-configure-vault
• Azure VM Backup: https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal 
• Azure Backup Server: https://docs.microsoft.com/en-us/azure/backup/backup-azure-microsoft-azure-backup
• Azure Site Recovery: https://docs.microsoft.com/en-us/azure/site-recovery/ 
• You can also refer to a previous article on the topic:
  • Getting started with – Azure Backup: https://arnaud-web.azurewebsites.net/2017/03/14/getting-started-with-azure-backup/ 
  • Getting started with – Azure Site Recovery: https://arnaud-web.azurewebsites.net/2017/02/07/getting-started-with-azure-site-recovery/

Session 4: Azure Compliance and security​

The security and compliance session review the fundamentals of Azure security in both technical and non-technical terms. After a review of certification against the best in class policies and procedures, we will spend some time reviewing the technologies that customers can leverage to deploy solutions.

Session on demand: https://info.microsoft.com/AP-AzureINFRA-WBNR-FY18-03Mar-07-AzureSecurityandCompliance-MCW0004574_01Registration-ForminBody.html

Slides:

▶ View the document on OneDrive

Demos:
1. Azure Security Center

▶ View the video on OneDrive

2. Azure Key Vault

▶ View the video on OneDrive

Demo references:

• Azure Marketplace: https://azuremarketplace.microsoft.com/en-us
• Azure Security Center: https://docs.microsoft.com/en-us/azure/security-center/
• Azure Key Vault: https://docs.microsoft.com/en-us/azure/key-vault/quick-create-portal
• Azure Disk Encryption: https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption 
• Azure Storage Security guide: https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide?toc=%2fazure%2fsecurity%2ftoc.json
• Azure Trust Center: https://www.microsoft.com/en-us/TrustCenter/Compliance/default.aspx
• Azure Service Trust Portal: http://aka.ms/stp
• You can also refer to a previous article on the topic:
  • Azure RFP Toolbox: http://aka.ms/azurerfptoolbox 

That’s it for today, in the next post, more details on the other episodes of the serie!

Arnaud

Session 1: Azure Infrastructure Overview​

We will get started with an overview of Azure datacenters and servers’ infrastructure, we will then study the best tools to get started with administering your first resources in Azure and then undercover the fundamental of grouping resources and delegating their access.

Session on demand:
https://info.microsoft.com/AP-AzureINFRA-WBNR-FY18-03Mar-07-AzureInfrastructureOverview-MCW0004573_02OnDemandRegistration-ForminBody.html

Slides:

▶ View the document on OneDrive

Demos:

▶ View the video on OneDrive

Demos references:

• Azure portal: https://portal.azure.com 
• Azure Tagging: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags
• Azure Access Control and RBAC: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal 
• Cloudyn: https://docs.microsoft.com/en-us/azure/cost-management/overview 
• Azure Toolbox: http://aka.ms/azuretoolbox 
• Azure CLI: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest
• Azure PowerShell: https://docs.microsoft.com/en-us/powershell/azure/overview

Session 2: Azure Virtual Machines​

In this session, we continue our exploration of Azure services with virtual machines and everything related to them: storage, network, monitoring and the basics of security.

Session on demand:
https://info.microsoft.com/AP-AzureINFRA-WBNR-FY18-03Mar-14-VirtualMachines-MCW0004387_02OnDemandRegistration.html

Slides:

▶ View the document on OneDrive

Demos:
1. VM Creation

▶ View the video on OneDrive

2. VM Management

▶ View the video on OneDrive

Demo references:

• Azure Marketplace: https://azuremarketplace.microsoft.com/en-us
• Azure Security Center:  https://docs.microsoft.com/en-us/azure/security-center/ 
• Azure Management:
  • Update Management: https://docs.microsoft.com/en-us/azure/automation/automation-update-management
  • Inventory Management: https://docs.microsoft.com/en-us/azure/automation/automation-vm-inventory 
  • Change Tracking: https://docs.microsoft.com/en-us/azure/automation/automation-change-tracking
  • Service Map: https://docs.microsoft.com/en-us/azure/monitoring/monitoring-service-map 

That’s it for today, in the next post, more details on the other episodes of the serie!

Arnaud

1. Introduction to Containers on Azure
2. Building Highly Available Linux applications with Azure App Service

You will find below my slides, notes to evaluate the technology and videos of the demos!

Introduction to Containers on Azure​

The slides are here:

▶ View the document on OneDrive

The videos of the demos are here:

Docker Basics​

▶ View the video on OneDrive

What is a container by docker – https://www.docker.com/what-container

Docker Overview  – https://docs.docker.com/engine/docker-overview/

Try SQL Server 2017 in a Container – https://docs.microsoft.com/en-us/sql/linux/quickstart-install-connect-docker

What’s new for Docker in WindowsServer 1709 – https://blog.docker.com/2017/09/docker-windows-server-1709/

Azure Container Registry​

▶ View the video on OneDrive

Your Docker registry in Azure – https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal

https://docs.microsoft.com/en-us/azure/container-registry/container-registry-webhook

Azure Container Instances​

▶ View the video on OneDrive

Run containers in Azure the easy way  – https://azure.microsoft.com/en-us/services/container-instances/

Azure Container Services (ACS)​

▶ View the video on OneDrive

Deploy a Docker Swarm cluster in Azure with ACS – https://docs.microsoft.com/en-us/azure/container-service/dcos-swarm/container-service-swarm-walkthrough

Deploy a DCOS cluster in Azure with ACS  – https://docs.microsoft.com/en-us/azure/container-service/dcos-swarm/container-service-dcos-quickstart

Azure Container Services (AKS)​

▶ View the video on OneDrive

Managed Kubernetes in Azure – https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough

To summarize the options to run containers on Azure: https://azure.microsoft.com/en-us/overview/containers/

Building Highly Available Linux applications with Azure App Service​

The slides are here:

▶ View the document on OneDrive

The videos of the demos are here:

WordPress for App Service on Linux​

▶ View the video on OneDrive

Introduction to Azure App Service – https://docs.microsoft.com/en-sg/azure/app-service/containers/app-service-linux-intro

AppService is also present on AzureStack – https://azure.microsoft.com/en-us/blog/general-availability-of-app-service-and-functions-on-azure-stack/

Azure App Service on Linux FAQ – https://docs.microsoft.com/en-sg/azure/app-service/containers/app-service-linux-faq

Create a Ruby on Azure using Azure App Service – https://docs.microsoft.com/en-sg/azure/app-service/containers/quickstart-ruby

App Service on Linux with GitHub integration​

▶ View the video on OneDrive

Deployment guide for Azure App Service  – https://docs.microsoft.com/en-sg/azure/app-service/containers/

Configure webapps in Azure App Service – https://docs.microsoft.com/en-sg/azure/app-service/web-sites-configure?toc=%2fazure%2fapp-service%2fcontainers%2ftoc.json

Deploy your own Docker container for App Service on Linux – https://docs.microsoft.com/en-sg/azure/app-service/containers/quickstart-custom-docker-image

App Service for Containers​

▶ View the video on OneDrive

Azure Web App for Containers: https://azure.microsoft.com/en-us/services/app-service/containers/

Running your code on #Azure … which option to choose? – https://docs.microsoft.com/en-sg/azure/app-service/choose-web-site-cloud-service-vm?toc=%2fazure%2fapp-service%2fcontainers%2ftoc.json

See you soon in another Microsoft Open Day in APAC: https://open.microsoft.com/2017/10/08/msftopenday-2017/ 

Arnaud

During the last years as an architect for Azure services, there is a set of questions and areas that always come-up, you will find here the reference materials I use to answer RFP or customer enquiries. This post assumes you already have some Azure expertise in the subjects covered, but are in search of good reference materials for documentation purposes.

Networking and connectivity​

When you design a solution running in Azure, it will most of the time run on Virtual Networks, you can connect those to:

• Your datacenter via IPsec VPN: you use the internet to transport IPsec-encrypted packets. Since it’s the internet, there’s no SLA on the link availability, but the IPsec gateway is backed by a 99.95% SLA and the speed can go up to 1 Gbps.
• Your datacenter via ExpressRoute: it’s a private connection, SLA-backed by your service provider up to 99.95%. The speed can go up to 10 Gbps if necessary.
• Internet via a Public IP: that public IP endpoint is highly available, load balanced if needed, protected by our DoS protection service. Those operations are done by Azure but you can leverage Network Virtual Appliances from the marketplace in order to add additional features like layer-7 inspection. If you want to use WAF-as-a-Service, you can also leverage Azure Application Gateway.
  

ExpressRoute Locations – https://docs.microsoft.com/en-us/azure/expressroute/expressroute-locations

Microsoft cloud services and network security – https://docs.microsoft.com/en-us/azure/best-practices-network-security

Azure Network Security Best Practices – https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices

Reference architecture – Hybrid Networking – https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/ 

High availability, Disaster Recovery and SLA​

When you build solutions on Azure, your choose the physical location of your data, which is replicated on 3 hard disk drives (based on Locally Redundant Storage), it can be replicated to another region in order to offer additional redundancy in a location with hundreds miles from the previous (3 additional copies of your data).

High availability for virtual machines is achieved:

• In-Region:
  • If you deploy an Azure VM on Premium storage, the VM automatically gets a 99.9% uptime SLA!
  • You can achieve HA at 99.95% uptime by placing multiples machines serving users inside an availability set with a load balancer in front.
  • You can achieve HA at 99.99% uptime by placing multiples machines serving users inside an availability zone with a standard load balancer in front.
• Across-regions: by duplicating the first deployment in another region. You replicate the data using application-level replication or Azure Site Recovery, then you load balance the solution using Traffic Manager.

SLA for the main Azure elements:

Datacenter and Service Recovery: How Microsoft services recovers from a DC loss – https://gallery.technet.microsoft.com/Datacenter-and-Service-d64cf003

Availability checklist – https://docs.microsoft.com/en-us/azure/architecture/checklist/availability?toc=%2Fazure%2Fsecurity%2Ftoc.json

Data security, isolation and confidentiality​

In a context of datacenter migration, usual questions are: how is my data secured, how is it isolated from other tenants and how can I protect my data in-transit, at-rest, and even in-processing.

You can get started with our RFI standard responses templates: http://aka.ms/azurerfi

A good reference is the getting started with Azure security paper: https://docs.microsoft.com/en-us/azure/security/azure-security-getting-started

Encryption at rest:​

Isolation in the Azure Public Cloud – https://docs.microsoft.com/en-us/azure/security/azure-isolation

Azure Data Encryption-at-Rest – https://docs.microsoft.com/en-us/azure/security/azure-security-encryption-atrest

Encryption in transit:​

Azure encryption technologies: Protect personal data in transit with encryption – https://docs.microsoft.com/en-us/azure/security/protect-personal-data-in-transit-encryption

Encryption in processing:​

Azure confidential computing : https://azure.microsoft.com/en-us/blog/introducing-azure-confidential-computing/

Data security is also about backup, wo you can use:

• Azure Backup:
  • Backup VM on Azure using snapshot-based built-in technologies 
  • Small agent to backup files and system states on Windows Clients and Servers 
  • Azure Backup Server to backup Linux/Windows VM, Exchange, SQL, SharePoint and VSS-aware applications 
• Any third party backup solution and use Azure Cool Storage or Azure Archive Storage to store the backups.

Datacenter operations & compliance​

Azure will very likely exceed any possible best practices and compliance regulation level that you see in a customer-run datacenter. Azure does not usually allow customers to directly audit against best practices, however we are working to certify Azure against the most relevant certifications, in the world, regionally, and locally as well as the most strict industry standards.

All certifications information can be found in the Azure Trust Center – https://azure.microsoft.com/en-us/support/trust-center/

If you need to download the certification audit reports or the certificate Service Trust Portal – http://aka.ms/stp 

Overview of Microsoft Azure compliance – https://gallery.technet.microsoft.com/Overview-of-Azure-c1be3942

How Microsoft Azure can help organizations become compliant with the EU GDPR – https://gallery.technet.microsoft.com/How-Azure-Can-Help-788a4979

Azure Solutions Blueprint for PCI DSS-compliant environments – https://docs.microsoft.com/en-us/azure/architecture/compliance/pci-dss/

Microsoft Azure HIPAA/HITECH Act Implementation Guidance – https://gallery.technet.microsoft.com/Azure-HIPAAHITECH-Act-1d27efb0

Threat protection, detection and incident response​

How does Microsoft protect instances, how does Microsoft and I do incident response? Is there a DoS protection service include and IDS/IPS? Can I or a partner conduct penetration testing to a solution in Azure?

Azure Advanced Threat Detection – https://docs.microsoft.com/en-us/azure/security/azure-threat-detection

Azure Logging and auditing – https://docs.microsoft.com/en-us/azure/security/azure-log-audit

Security Incent Response in Azure – http://aka.ms/SecurityResponsepaper

Penetration testing of your solution – https://docs.microsoft.com/en-us/azure/security/azure-security-pen-testing 

Integration of SIEM with Azure – https://docs.microsoft.com/en-us/azure/security/security-azure-log-integration-overview 

Azure Security Center is a great complement to all the security mechanisms present in Azure, and the good news is, there’s a free tier, so use it everywhere.

Azure Security Center Detection Capabilities – https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities

Using Azure Security Center for an incident response – https://docs.microsoft.com/en-us/azure/security-center/security-center-incident-response

Operations Excellence​

How do I operate, manage, an environment in Azure, how do I manage separation of roles and duties, how is done RBAC?

Customers can integrate their on-premises Active Directory with Azure Active Directory and then manage, delegate access using RBAC. When customer use Azure Active Directory, they can use all feature of Azure Active Directory Premium and also enable Just in time admin, which will elevat

Introduction to operational security in Azure – https://docs.microsoft.com/en-us/azure/security/azure-operational-security

Azure Security Management and Monitoring Overview – https://docs.microsoft.com/en-us/azure/security/security-management-and-monitoring-overview

Governance in Azure – https://docs.microsoft.com/en-us/azure/security/governance-in-azure

Identity management – https://docs.microsoft.com/en-us/azure/security/security-identity-management-overview

Let’s conclude with the Azure Security best practices and patterns collection: https://docs.microsoft.com/en-us/azure/security/security-best-practices-and-patterns

Our VM sizes reference: https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-sizes/

You might also need the Visio template in order to produce the architecture diagrams: http://download.microsoft.com/download/1/5/6/1569703C-0A82-4A9C-8334-F13D0DF2F472/RAs.vsdx 

Have fun answering RFP, don’t hesitate to suggest your additional items in the comments section!

Stay updated on Twitter: https://twitter.com/arnaudlheureux