Azure fundamentals

03/07/2019 1
Azure Fundamentals

2
alexandre.bergere@gmail.com
https://fr.linkedin.com/in/alexandrebergere
@AlexPhile
Avanade
2016 - 2019
Sr Anls, Data Engineering
Worked for 3 years as a senior analyst at
Avanade France, I have developed my skills
in data analysis (MSBI, Power BI, R, Python,
Spark, Cosmos DB) by working on innovative
projects and proofs of concept in the energy
industry.
ESAIP
Teacher
2016 - x
Data Freelance
2019 - x

03/07/2019 3
Sources
This support is a summary from the path Azure fundamentals in Microsoft Learn.

03/07/2019 4
Cloud Concepts - Principles of
cloud computing

03/07/2019 5
What is Cloud Computing?
Cloud computing is renting resources, like storage space or CPU cycles, on another company's computers. You only pay for what you use. The
company providing these services is referred to as a cloud provider. Some example providers are Microsoft, Amazon, and Google.
The cloud provider is responsible for the physical hardware required to execute your work, and for keeping it up-to-date. The computing services
offered tend to vary by cloud provider. However, typically they include:
o Compute power - such as Linux servers or web applications
o Storage - such as files and databases
o Networking - such as secure connections between the cloud provider and your company
o Analytics - such as visualizing telemetry and performance data

What are containers?
03/07/2019 6
Containers provide a consistent, isolated execution environment for applications. They're similar to VMs except they don't
require a guest operating system. Instead, the application and all its dependencies is packaged into a "container" and then
a standard runtime environment is used to execute the app. This allows the container to start up in just a few seconds
because there's no OS to boot and initialize. You only need the app to launch.
The open-source project, Docker, is one of the leading platforms for managing containers. Docker containers provide an
efficient, lightweight approach to application deployment because they allow different components of the application to
be deployed independently into different containers. Multiple containers can be run on a single machine, and containers
can be moved between machines. The portability of the container makes it easy for applications to be deployed in multiple
environments, either on-premises or in the cloud, often with no changes to the application.

What is serverless computing?
03/07/2019 7
Serverless computing lets you run application code without creating, configuring, or maintaining a server. The core idea is
that your application is broken into separate functions that run when triggered by some action. This is ideal for automated
tasks - for example, you can build a serverless process that automatically sends an email confirmation after a customer
makes an online purchase.
The serverless model differs from VMs and containers in that you only pay for the processing time used by each function as
it executes. VMs and containers are charged while they're running - even if the applications on them are idle. This
architecture doesn't work for every app - but when the app logic can be separated to independent units, you can test them
separately, update them separately, and launch them in microseconds, making this approach the fastest option for
deployment.
Serverless computing is a cloud-hosted execution environment that runs your code but completely abstracts the
underlying hosting environment. You create an instance of the service, and you add your code; no infrastructure
configuration or maintenance is required, or even allowed.

Compute approaches
03/07/2019 8
https://docs.microsoft.com/en-us/learn/modules/principles-cloud-computing/2-what-is-cloud-computing

Why cloud computing
03/07/2019 9
o Pay only for the amount you consume (stop guessing capacity)
o Increase speed and agility (minutes to waiting ressources)
o Stop spending money on running and maintening data centers
o Go global in minutes

Benefits of cloud computing
03/07/2019 10
o It’s cost-effective (pay-as-you-go or consumption-based)
o It's scalable (vertical and horizontal scaling)
o It's elastic (automatically adding or removing resources)
o It's current (eliminates the burdens of maintaining software patches, hardware setup, upgrades, and other)
o It's reliable (data backup, disaster recovery, and data replication services)
o It's global (fully redundant datacenters located in various regions all over the globe)
o It's secure (broad set of policies, technologies, controls, and expert technical skills that can provide better
security than most organizations can otherwise achieve)

Compliance terms and requirements
03/07/2019 11
When selecting a cloud provider to host your solutions, you should understand how that provider can help you
comply with regulations and standards. Some questions to ask about a potential provider include:
o How compliant is the cloud provider when it comes to handling sensitive data?
o How compliant are the services offered by the cloud provider?
o How can I deploy my own cloud-based solutions to scenarios that have accreditation or compliance
requirements?
o What terms are part of the privacy statement for the provider?

Economies of scale
03/07/2019 15
Cloud providers such as Microsoft, Google, and Amazon are large businesses leveraging the benefits of economies of scale,
and then pass the savings onto their customers.
These savings are apparent to end users in a number of ways, one of which is the ability to acquire hardware at a lower
cost. Cloud providers can also make deals with local governments and utilities to get tax savings, lowering the price of
power, cooling, and high-speed network connectivity between sites. Cloud providers are then able to pass on these
benefits to end users in the form of lower prices than what you could achieve on your own.
Economies of scale is the ability to do things more efficiently or at a lower-cost per unit when
operating at a larger scale. This cost advantage is an important benefit in cloud computing.

03/07/2019 16
CapEx versus OpEx
Capital expenditure (CapEx) versus operational expenditure (OpEx)
These two approaches to investment are referred to as:
o Capital Expenditure (CapEx): CapEx is the spending of money on physical infrastructure up front, and then deducting that
expense from your tax bill over time. CapEx is an upfront cost, which has a value that reduces over time.
o Operational Expenditure (OpEx): OpEx is spending money on services or products now and being billed for them now. You can
deduct this expense from your tax bill in the same year. There's no upfront cost. You pay for a service or product as you use it.

CapEx versus OpEx
03/07/2019 17
A typical on-premises data center includes costs such as:
o Server costs
o Storage costs
o Network costs
o Backup and archive costs
o Organization continuity and disaster recovery costs
o Datacenter infrastructure costs
o Technical personnel
A typical on-premises data center includes costs such as:
o Leasing a cloud-based server
o Leasing software and customized features
o Scaling charges based on usage/demand instead of fixed hardware or
capacity
o Billing at the user or organization level

CapEx versus OpEx
03/07/2019 18
Benefits of CapEx
With capital expenditures, you plan your expenses at the
start of a project or budget period. Your costs are fixed,
meaning you know exactly how much is being spent. This is
appealing when you need to predict the expenses before a
project starts due to a limited budget.
Benefits of OpEx
Demand and growth can be unpredictable and can outpace
expectation, which is a challenge for the CapEx model as
shown in the following graph.
https://docs.microsoft.com/en-us/learn/modules/principles-cloud-computing/3c-capex-vs-opex

03/07/2019 19
Cloud deployment models
There are three different cloud deployment models. A cloud deployment model defines where your data is stored
and how your customers interact with it – how do they get to it, and where do the applications run? It also
depends on how much of your own infrastructure you want or need to manage:
o Public cloud
o Private cloud
o Hybrid cloud

Public cloud
03/07/2019 20
Advantages:
o High scalability/agility – you don’t have to buy a new server in
order to scale
o Pay-as-you-go pricing – you pay only for what you use, no CapEx
costs
o You’re not responsible for maintenance or updates of the
hardware
o Minimal technical knowledge to set up and use - you can leverage
the skills and expertise of the cloud provider to ensure workloads
are secure, safe, and highly available
Disadvantages:
o There may be specific security requirements that cannot be met by using
public cloud
o There may be government policies, industry standards, or legal
requirements which public clouds cannot meet
o You don't own the hardware or services and cannot manage them as you
may want to
o Unique business requirements, such as having to maintain a legacy
application might be hard to meet

Private cloud
03/07/2019 21
Advantages:
o You can ensure the configuration can support any scenario or
legacy application
o You can control (and responsibility) over security
o Private clouds can meet strict security, compliance, or legal
requirements
o Economies at scale and integration with Azure Security Cente
Disadvantages:
o You have some initial CapEx costs and must purchase the hardware for
startup and maintenance
o Owning the equipment limits the agility - to scale you must buy, install,
and setup new hardware
o Private clouds require IT skills and expertise that's hard to come by

Hybrid cloud
03/07/2019 22
Advantages:
o You can keep any systems running and accessible that use out-of-
date hardware or an out-of-date operating system
o You have flexibility with what you run locally versus in the cloud
o You can take advantage of economies of scale from public cloud
providers for services and resources where it's cheaper, and then
supplement with your own equipment when it's not
o You can use your own equipment to meet security, compliance, or
legacy scenarios where you need to completely control the
environment
Disadvantages:
o It can be more expensive than selecting one deployment model since it
involves some CapEx cost up front
o It can be more complicated to set up and manage
A hybrid cloud combines public and private clouds, allowing you to run your applications in the most appropriate location.
For example, you could host a website in the public cloud and link it to a highly secure database hosted in your private
cloud (or on-premises datacenter).

03/07/2019 23
Types of cloud services

Infrastructure as a service (IaaS)
03/07/2019 24
IaaS is commonly used in the following scenarios:
o Migrating workloads. Typically, IaaS facilities are managed in a similar way as on-premises infrastructure and
provide an easy migration path for moving existing applications to the cloud.
o Test and development. Teams can quickly set up and dismantle test and development environments, bringing
new applications to market faster. IaaS makes scaling development and testing environments, fast and
economical.
o Website hosting. Running websites using IaaS can be less expensive compared to traditional web hosting.
o Storage, backup, and recovery. Organizations avoid the capital outlay and complexity of storage management,
which typically requires skilled staff to manage data and meet legal and compliance requirements. IaaS is useful
for managing unpredictable demand and steadily growing storage needs. IaaS can also simplify the planning and
management of backup and recovery systems.
When using IaaS, ensuring that a service is up and running is a shared responsibility: the cloud provider is responsible for
ensuring the cloud infrastructure is functioning correctly; the cloud customer is responsible for ensuring the service they are
using is configured correctly, is up to date, and is available to their customers. This is referred to as the shared responsibility
model.

Platform as a service (PaaS)
03/07/2019 25
PaaS provides an environment for building, testing, and deploying software applications. The goal of PaaS is to help you
create an application quickly without managing the underlying infrastructure. For example, when deploying a web
application using PaaS, you don't have to install an operating system, web server, or even system updates.
PaaS is a complete development and deployment environment in the cloud, with resources that enable organizations to
deliver everything from simple cloud-based apps to sophisticated cloud-enabled enterprise applications. Resources are
purchased from a cloud service provider on a pay-as-you-go basis and accessed over a secure Internet connection.
PaaS is commonly used in the following scenarios:
o Development framework. PaaS provides a framework that developers can build upon to develop or customize
cloud-based applications. Just like Microsoft Excel macro, PaaS lets developers create applications using built-in
software components. Cloud features such as scalability, high-availability, and multi-tenant capability are
included, reducing the amount of coding that developers must do.
o Analytics or business intelligence. Tools provided as a service with PaaS allow organizations to analyze and mine
their data. They can find insights and patterns, and predict outcomes to improve business decisions such as
forecasting, product design, and investment returns.

Software as a service (SaaS)
03/07/2019 26
SaaS is software that is centrally hosted and managed for the end customer. It is usually based on an architecture
where one version of the application is used for all customers, and licensed through a monthly or annual
subscription. Office 365, Skype, and Dynamics CRM Online are perfect examples of SaaS software.

Cost and Ownership
03/07/2019 27
IaaS PaaS SaaS
Upfront costs There are no upfront costs. Users
pay only for what they consume.
There are no upfront costs. Users pay
only for what they consume.
Users have no upfront costs; they pay
a subscription, typically on a monthly
or annual basis.
User ownership The user is responsible for the
purchase, installation,
configuration, and management of
their own software, operating
systems, middleware, and
applications.
The user is responsible for the
development of their own applications.
However, they are not responsible for
managing the server or infrastructure.
This allows the user to focus on the
application or workload they want to
run.
Users just use the application
software; they are not responsible for
any maintenance or management of
that software.
Cloud provider
ownership
The cloud provider is responsible
for ensuring that the underlying
cloud infrastructure (such as virtual
machines, storage, and networking)
is available for the user.
The cloud provider is responsible for
operating system management,
network, and service configuration.
Cloud providers are typically responsible
for everything apart from the application
that a user wants to run. They provide a
complete managed platform on which to
run the application.
The cloud provider is responsible for
the provision, management, and
maintenance of the application
software.

Management responsibilities
03/07/2019 28

03/07/2019 32
What is Azure?
Azure is Microsoft's cloud computing platform. Azure is a continually expanding set of cloud
services that help your organization meet your current and future business challenges. Azure gives
you the freedom to build, manage, and deploy applications on a massive global network using your
favorite tools and frameworks.
Azure provides over 100 services that enable you to do everything from running your existing
applications on virtual machines to exploring new software paradigms such as intelligent bots and
mixed reality.
Many teams start exploring the cloud by moving their existing applications to virtual machines that
run in Azure. While migrating your existing apps to virtual machines is a good start, the cloud is
more than just "a different place to run your virtual machines".
For example, Azure provides AI and machine-learning services that can naturally communicate with
your users through vision, hearing, and speech. It also provides storage solutions that dynamically
grow to accommodate massive amounts of data. Azure services enable solutions that are simply
not feasible without the power of the cloud.
What can I do on
Azure?

Networking
03/07/2019 35
Native firewalling capabilities with
built-in high availability,
unrestricted cloud scalability, and
zero maintenance
Azure Firewall
Protect your applications from
Distributed Denial of Service
(DDoS) attacks
Azure DDoS Protection
Establish secure, cross-premises
connectivity
VPN Gateway
Host your DNS domain in Azure
Azure DNS
Dedicated private network fiber
connections to Azure
ExpressRoute

Compute
03/07/2019 36
Provision Windows and Linux
virtual machines in seconds
Virtual Machines
Provision virtual machines for
Ubuntu, Red Hat, and more
Linux Virtual Machines
Simplify the deployment,
management, and operations of
Kubernetes
Azure Kubernetes Service (AKS)
Process events with serverless
code
Azure Functions

Databases
03/07/2019 37
Managed relational SQL Database
as a service
Azure SQL Database
Globally distributed, multi-model
database for any scale
Azure Cosmos DB
NoSQL key-value store using semi-
structured datasets
Table Storage
Managed MySQL database service
for app developers
Azure Database for MySQL
Simplify on-premises database
migration to the cloud
Azure Database Migration Service

Analytics
03/07/2019 38
Fast, easy, and collaborative
Apache Spark-based analytics
platform
Azure Databricks
Real-time data stream processing
from millions of IoT devices
Azure Stream Analytics
Hybrid data integration at
enterprise scale, made easy
Data Factory
Enterprise-grade analytics engine
as a service
Azure Analysis Services
Elastic data warehouse as a service
with enterprise-class features
SQL Data Warehouse

Storage
03/07/2019 39
REST-based object storage for
unstructured data
Blob Storage
Simplify data protection and
protect against ransomware
Azure Backup
Massively scalable, secure data
lake functionality built on Azure
Blob Storage
Azure Data Lake Storage

Internet of Things
03/07/2019 40
Connect, monitor and manage
billions of IoT assets
Azure IoT Hub
Explore and analyze time-series
data from IoT devices
Azure Time Series Insights
Receive telemetry from millions of
devices
Event Hubs

Web
03/07/2019 41
Automate business processes
Logic Apps
Quickly create and deploy mission
critical web apps at scale
Web Apps
Build mobile apps for any device
Mobile Apps

03/07/2019 42
Core Cloud Services - Azure
architecture and service
guarantees

Choose your location
03/07/2019 43

What is a region?
03/07/2019 44
A region is a geographical area on the planet containing at least one, but potentially multiple datacenters that are nearby
and networked together with a low-latency network. Azure intelligently assigns and controls the resources within each
region to ensure workloads are appropriately balanced.
When you deploy a resource in Azure, you will often need to choose the region where you want your resource deployed.
Why is this important?
Azure has more global regions than any other cloud provider. This gives you the flexibility to bring applications closer to
your users no matter where they are. It also provides better scalability, redundancy, and preserves data residency for your
services.
Special Azure regions:
Azure has specialized regions that you might want to use when building out your applications for compliance or legal
purposes. These include:
o US DoD Central, US Gov Virginia, US Gov Iowa and more: These are physical and logical network-isolated
instances of Azure for US government agencies and partners. These datacenters are operated by screened US
persons and include additional compliance certifications.
o China East, China North and more: These regions are available through a unique partnership between Microsoft
and 21Vianet, whereby Microsoft does not directly maintain the datacenters.

Geographies
03/07/2019 45
Azure divides the world into geographies that are defined by geopolitical boundaries or country borders. An Azure
geography is a discrete market typically containing two or more regions that preserve data residency and compliance
boundaries. This division has several benefits.
Geographies allow customers with specific data residency and compliance needs to keep their data and applications close.
Geographies ensure that data residency, sovereignty, compliance, and resiliency requirements are honored within
geographical boundaries.
Geographies are fault-tolerant to withstand complete region failure through their connection to dedicated high-capacity
networking infrastructure.
Geographies are broken up into the following areas:
o Americas
o Europe
o Asia Pacific
o Middle East and Africa
Each region belongs to a single geography and has specific service availability, compliance, and data residency/sovereignty
rules applied to it. Check the documentation for more information (a link is available in the summary unit).

Availability Zones
03/07/2019 46
Availability Zones are physically separate datacenters within an Azure region.
Each Availability Zone is made up of one or more datacenters equipped with independent power, cooling, and networking.
It is set up to be an isolation boundary. If one zone goes down, the other continues working. Availability Zones are
connected through high-speed, private fiber-optic networks.
https://docs.microsoft.com/en-us/learn/modules/explore-azure-infrastructure/4-availability-zones
Supported regions
Not every region has support for Availability Zones. The following regions have a
minimum of three separate zones to ensure resiliency.
o Central US
o East US 2
o West US 2
o West Europe
o France Central
o North Europe
o Southeast Asia

Region Pairs
03/07/2019 47
Availability zones are created using one or more datacenters, and there are a minimum of three zones within a single
region. However, it's possible that a large enough disaster could cause an outage big enough to affect even two
datacenters. That's why Azure also creates region pairs.
Each Azure region is always paired with another region within the same geography (such as US, Europe, or Asia) at least
300 miles away. This approach allows for the replication of resources (such as virtual machine storage) across a geography
that helps reduce the likelihood of interruptions due to events such as natural disasters, civil unrest, power outages, or
physical network outages affecting both regions at once.
Examples of region pairs in Azure are West US paired with East US, and SouthEast Asia paired with East Asia.
https://docs.microsoft.com/en-us/learn/modules/explore-azure-infrastructure/5-region-pairs

Service Level Agreements for Azure (1/3)
03/07/2019 48
Microsoft maintains its commitment to providing customers with high-quality products and services by adhering to
comprehensive operational policies, standards, and practices. Formal documents called Service-Level Agreements (SLAs)
capture the specific terms that define the performance standards that apply to Azure.
There are three key characteristics of SLAs for Azure products and services:
o Performance Targets
o Uptime and Connectivity Guarantees
o Service credits
Performance Targets
An SLA defines performance targets for an Azure product or service. The performance targets that an SLA defines are
specific to each Azure product and service. For example, performance targets for some Azure services are expressed as
uptime guarantees or connectivity rates.

03/07/2019 49
Uptime and Connectivity Guarantees
A typical SLA specifies performance-target commitments that range from 99.9 percent ("three nines") to 99.999 percent
("five nines"), for each corresponding Azure product or service. These targets can apply to such performance criteria as
uptime or response times for services.
The following table lists the potential cumulative downtime for various SLA levels over different durations:
For example, the SLA for the Azure Cosmos DB (Database) service SLA offers 99.999 percent uptime, which includes low-
latency commitments of less than 10 milliseconds on DB read operations as well as on DB write operations.
SLA % Downtime per week Downtime per month Downtime per year
99 1.68 hours 7.2 hours 3.65 days
99.9 10.1 minutes 43.2 minutes 8.76 hours
99.95 5 minutes 21.6 minutes 4.38 hours
99.99 1.01 minutes 4.32 minutes 52.56 minutes
99.999 6 seconds 25.9 seconds 5.26 minutes

03/07/2019 50
Service Credits
SLAs also describe how Microsoft will respond if an Azure product or service fails to perform to its governing SLA's
specification.
For example, customers may have a discount applied to their Azure bill, as compensation for an under-performing Azure
product or service. The table below explains this example in more detail.
The first column in the table below shows monthly uptime percentage SLA targets for a single instance Azure Virtual
Machine. The second column shows the corresponding service credit amount you receive if the actual uptime is less than
the specified SLA target for that month.
MONTHLY UPTIME PERCENTAGE SERVICE CREDIT PERCENTAGE
< 99.9 10
< 99 25
< 95 100

Azure account
03/07/2019 52
What is an Azure account?
An Azure account is tied to a specific identity and holds information like:
o Name, email, and contact preferences
o Billing information such as a credit card
An Azure account is what you use to sign in to the Azure website and administer or deploy services. Every Azure account is
associated with one or more subscriptions.
What is an Azure subscription?
An Azure subscription is a logical container used to provision resources in Microsoft Azure. It holds the details of all your
resources like virtual machines, databases, etc.
Subscription types:
Azure offers free and paid subscription options to suit different needs and requirements. The most commonly used
subscriptions are:
o Free
o Pay-As-You-Go
o Enterprise Agreement
o Student

Azure subscription
03/07/2019 53
Azure free subscription
An Azure free subscription includes a $200 credit to spend on any service for the first 30 days, free access to the most
popular Azure products for 12 months, and access to more than 25 products that are always free. This is an excellent way
for new users to get started. To set up a free subscription, you need a phone number, a credit card, and a Microsoft
account.
Credit card information is used for identity verification only. You won’t be charged for any services until you upgrade.
Azure Pay-As-You-Go subscription
A Pay-As-You-Go (PAYG) subscription charges you monthly for the services you used in that billing period. This subscription
type is appropriate for a wide range of users, from individuals to small businesses, and many large organizations as well.
Azure Enterprise Agreement
An Enterprise Agreement provides flexibility to buy cloud services and software licenses under one agreement, with
discounts for new licenses and Software Assurance. It's targeted at enterprise-scale organizations.
Azure for Students subscription
An Azure for Students subscription includes $100 in Azure credits to be used within the first 12 months plus select free
services without requiring a credit card at sign-up. You must verify your student status through your organizational email
address.

Authenticate access with Azure Active Directory
03/07/2019 54
Users, applications, and other entities registered in Azure AD aren't all lumped into a single global service. Instead, Azure
AD is partitioned into separate tenants. A tenant is a dedicated, isolated instance of the Azure Active Directory service,
owned and managed by an organization. When you sign up for a Microsoft cloud service subscription such as Microsoft
Azure, Microsoft Intune, or Office 365, a dedicated instance of Azure AD is automatically created for your organization.
When it comes to Azure AD tenants, there is no concrete definition of "organization" — tenants can be owned by
individuals, teams, companies, or any other group of people. Tenants are commonly associated with companies. If you sign
up for Azure with an email address that's not associated with an existing tenant, the sign-up process will walk you through
creating a tenant, owned entirely by you.
Azure AD tenants and subscriptions have a many-to-one trust relationship: A tenant can be associated with multiple Azure
subscriptions, but every subscription is associated with only one tenant. This structure allows organizations to manage
multiple subscriptions and set security rules across all the resources contained within them.
Here's a simple representation of how accounts,
subscriptions, tenants, and resources work together.
https://docs.microsoft.com/en-us/learn/modules/create-an-azure-account/4-azure-tenants

Azure management options (1/4)
03/07/2019 55
You can configure and manage Azure using a broad range of tools and platforms. There are tools available for the
command line, language-specific Software Development Kits (SDKs), developer tools, tools for migration, and many others.
Tools that are commonly used for day-to-day management and interaction include:
o Azure portal for interacting with Azure via a Graphical User Interface (GUI)
o Azure PowerShell and Azure Command-Line Interface (CLI) for command line and automation-based interactions
with Azure
o Azure Cloud Shell for a web-based command-line interface
o Azure mobile app for monitoring and managing your resources from your mobile device

03/07/2019 56
Azure PowerShell:
Azure PowerShell is a module that you can install for Windows PowerShell, or PowerShell Core, which is a cross-platform
version of PowerShell that runs on Windows, Linux or macOS. Azure PowerShell enables you to connect to your Azure
subscription and manage resources. Windows PowerShell and PowerShell Core provide services such as the shell window
and command parsing. Azure PowerShell then adds the Azure-specific commands.
For example, Azure PowerShell provides the New-AzureRmVM command that creates a virtual machine for you inside your
Azure subscription. To use it, you would launch PowerShell, install the Azure PowerShell module, sign in to your Azure
account using the command Connect-AzureRMAccount, and then issue a command such as:

03/07/2019 57
Azure CLI:
Azure CLI is a cross-platform command-line program that connects to Azure and executes administrative commands on
Azure resources. Cross-platform means that it can be run on Windows, Linux, or macOS. For example, to create a VM, you
would open a command prompt window, sign in to Azure using the command az login, create a resource group, then use a
command such as:

03/07/2019 58
Azure Cloud Shell:
Azure Cloud Shell is a browser-based scripting environment for command-line administration of Azure resources. It
provides support for two shell environments. Linux users can opt for a Bash experience, while Windows users can use
PowerShell.

03/07/2019 59
compute options

Azure App Service
03/07/2019 60
Azure App Service enables you to build and host web apps, background jobs, mobile backends, and RESTful APIs in the
programming language of your choice without managing infrastructure. It offers auto-scaling and high availability, supports
both Windows and Linux, and enables automated deployments from GitHub, Azure DevOps, or any Git repo to support a
continuous deployment model.
This platform as a service (PaaS) allows you to focus on the website and API logic while Azure takes care of the
infrastructure to run and scale your web applications.
Types of web apps:
With Azure App Service, you can host most common web app styles including:
o Web Apps
o API Apps
o WebJobs
o Mobile Apps
Azure App Service handles most of the infrastructure decisions you deal with in hosting web apps: deployment and
management are integrated into the platform, endpoints can be secured, sites can be scaled quickly to handle high traffic
loads, and the built-in load balancing and traffic manager provide high availability. All of these app styles are hosted in the
same infrastructure and share these benefits. This makes App Service the ideal choice to host web-oriented applications.

Serverless computing in Azure
03/07/2019 61
With serverless computing, Azure takes care of managing the server infrastructure and allocation/deallocation of
resources based on demand. Infrastructure isn't your responsibility. Scaling and performance are handled automatically,
and you are billed only for the exact resources you use. There's no need to even reserve capacity.
You focus solely on the logic you need to execute and the trigger that is used to run your code. You configure your
serverless apps to respond to events. This could be a REST endpoint, a periodic timer, or even a message received from
another Azure service. The serverless app runs only when it's triggered by an event.
Azure has two implementations of serverless compute:
o Azure Functions which can execute code in almost any modern language.
o Azure Logic Apps which are designed in a web-based designer and can execute logic triggered by Azure services
without writing any code.

Serverless computing in Azure
03/07/2019 62
- Functions Logic Apps
State Normally stateless, but Durable Functions provide
state
Stateful
Development Code-first (imperative) Designer-first (declarative)
Connectivity About a dozen built-in binding types, write code
for custom bindings
Large collection of connectors, Enterprise
Integration Pack for B2B scenarios, build custom
connectors
Actions Each activity is an Azure function; write code for
activity functions
Large collection of ready-made actions
Monitoring Azure Application Insights Azure portal, Log Analytics
Management REST API, Visual Studio Azure portal, REST API, PowerShell, Visual Studio
Execution context Can run locally or in the cloud Runs only in the cloud.
Functions and Logic Apps can both create complex orchestrations. An orchestration is a collection of functions or
steps, that are executed to accomplish a complex task. With Azure Functions, you write code to complete each
step, with Logic Apps, you use a GUI to define the actions and how they relate to one another.
You can mix and match services when you build an orchestration, calling functions from logic apps and calling
logic apps from functions. Here are some common differences between the two.

03/07/2019 63
Core Cloud Services - Azure data
storage options

Benefits of using Azure to store data
03/07/2019 64
Here are some of the important benefits of Azure data storage:
o Automated backup and recovery: mitigates the risk of losing your data if there is any unforeseen failure or
interruption.
o Replication across the globe: copies your data to protect it against any planned or unplanned events, such as
scheduled maintenance or hardware failures. You can choose to replicate your data at multiple locations across the
globe.
o Support for data analytics: supports performing analytics on your data consumption.
o Encryption capabilities: data is encrypted to make it highly secure; you also have tight control over who can access the
data.
o Multiple data types: Azure can store almost any type of data you need. It can handle video files, text files, and even
large binary files like virtual hard disks. It also has many options for your relational and NoSQL data.
o Data storage in virtual disks: Azure also has the capability of storing up to 8 TB of data in its virtual disks. This is a
significant capability when you're storing heavy data such as videos and simulations.
o Storage tiers: storage tiers to prioritize access to data based on frequently used versus rarely used information.

Types of data
03/07/2019 65
o Structured data: Structured data is data that adheres to a schema, so all of the data has the same fields or properties.
Structured data can be stored in a database table with rows and columns. Structured data relies on keys to indicate
how one row in a table relates to data in another row of another table. Structured data is also referred to as relational
data, as the data's schema defines the table of data, the fields in the table, and the clear relationship between the two.
Structured data is straightforward in that it's easy to enter, query, and analyze. All of the data follows the same format.
Examples of structured data include sensor data or financial data.
o Semi-structured data: Semi-structured data doesn't fit neatly into tables, rows, and columns. Instead, semi-structured
data uses tags or keys that organize and provide a hierarchy for the data. Semi-structured data is also referred to as
non-relational or NoSQL data.
o Unstructured data: Unstructured data encompasses data that has no designated structure to it. This also means that
there are no restrictions on the kinds of data it can hold. For example, a blob can hold a PDF document, a JPG image, a
JSON file, video content, etc. As such, unstructured data is becoming more prominent as businesses try to tap into new
data sources.

Comparison between Azure data storage and on-premises
storage
03/07/2019 66
o Cost effectiveness: An on-premises storage solution requires dedicated hardware that needs to be purchased,
installed, configured, and maintained. This can be a significant up-front expense (or capital cost). Change in
requirements can require investment in new hardware. Your hardware needs to be capable of handling peak demand
which means it may sit idle or be under-utilized in off-peak times. Azure data storage provides a pay-as-you-go pricing
model which is often appealing to businesses as an operating expense instead of an upfront capital cost. It's also
scalable, allowing you to scale up or scale out as demand dictates and scale back when demand is low. You are charged
for data services only as you need them.
o Reliability: On-premises storage requires data backup, load balancing, and disaster recovery strategies. These can be
challenging and expensive as they often each need dedicated servers requiring a significant investment in both
hardware and IT resources. Azure data storage provides data backup, load balancing, disaster recovery, and data
replication as services to ensure data safety and high availability.
o Storage types: Sometimes multiple different storage types are required for a solution, such as file and database
storage. An on-premises approach often requires numerous servers and administrative tools for each storage type.
o Agility: Requirements and technologies change. For an on-premises deployment this may mean provisioning and
deploying new servers and infrastructure pieces, which is a time consuming and expensive activity. Azure data storage
gives you the flexibility to create new services in minutes. This flexibility allows you to change storage back-ends
quickly without needing a significant hardware investment.

Comparison between Azure data storage and on-premises
storage
03/07/2019 67

03/07/2019 68
networking options

What's a virtual network?
03/07/2019 69
A virtual network is a logically isolated network on Azure. Azure virtual networks will be familiar to you if you've set up
networks on Hyper-V, VMware, or even on other public clouds. A virtual network allows Azure resources to securely
communicate with each other, the internet, and on-premises networks. A virtual network is scoped to a single region;
however, multiple virtual networks from different regions can be connected together using virtual network peering.
Virtual networks can be segmented into one or more subnets. Subnets help you organize and secure your resources in
discrete sections. The web, application, and data tiers each have a single VM. All three VMs are in the same virtual
network but are in separate subnets.
Users interact with the web tier directly, so that VM has a public IP address along with a private IP address. Users don't
interact with the application or data tiers, so these VMs each have a private IP address only.
You can also keep your service or data tiers in your on-premises network, placing your web tier into the cloud, but keeping
tight control over other aspects of your application. A VPN gateway (or virtual network gateway), enables this scenario. It
can provide a secure connection between an Azure Virtual Network and an on-premises location over the internet.
Azure manages the physical hardware for you. You configure virtual networks and gateways through software, which
enables you to treat a virtual network just like your own network. You choose which networks your virtual network can
reach, whether that's the public internet or other networks in the private IP address space.

What's a network security group?
03/07/2019 70
A network security group, or NSG, allows or denies inbound network traffic to your Azure resources. Think of a network
security group as a cloud-level firewall for your network.
For example, notice that the VM in the web tier allows inbound traffic on ports 22 (SSH) and 80 (HTTP). This VM's network
security group allows inbound traffic over these ports from all sources. You can configure a network security group to
accept traffic only from known sources, such as IP addresses that you trust.

What is a load balancer?
03/07/2019 71
A load balancer distributes traffic evenly among each system in a pool. A load balancer can help you achieve both high
availability and resiliency.
The problem here is that each VM would have its own IP address. Plus, you don't have a way to distribute traffic in case
one system goes down or is busy. How do you connect your VMs so that they appear to the user as one system?
The answer is to use a load balancer to distribute traffic. The load balancer becomes the entry point to the user. The user
doesn't know (or need to know) which system the load balancer chooses to receive the request.
The following illustration shows the role of a load balancer.
The load balancer receives the user's request and directs the request to one of
the VMs in the web tier. If a VM is unavailable or stops responding, the load
balancer stops sending traffic to it. The load balancer then directs traffic to one of
the responsive servers.
Load balancing enables you to run maintenance tasks without interrupting
service. For example, you can stagger the maintenance window for each VM.
During the maintenance window, the load balancer detects that the VM is
unresponsive, and directs traffic to other VMs in the pool.
For your e-commerce site, the app and data tiers can also have a load balancer. It
all depends on what your service requires. https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-networking/3-scale-load-balancer

What is Azure Load Balancer?
03/07/2019 72
Azure Load Balancer is a load balancer service that Microsoft provides that helps take
care of the maintenance for you. Load Balancer supports inbound and outbound
scenarios, provides low latency and high throughput, and scales up to millions of
flows for all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
applications. You can use Load Balancer with incoming internet traffic, internal traffic
across Azure services, port forwarding for specific traffic, or outbound connectivity for
VMs in your virtual network.
When you manually configure typical load balancer software on a virtual machine,
there's a downside: you now have an additional system that you need to maintain. If
your load balancer goes down or needs routine maintenance, you're back to your
original problem.
If instead, however, you use Azure Load Balancer, there's no infrastructure or
software for you to maintain. You define the forwarding rules based on the source IP
and port to a set of destination IP/ports.
The following illustration shows the role of Azure load balancers in a multi-tier
architecture.
https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-networking/3-scale-load-balancer

Azure Application Gateway
03/07/2019 73
If all your traffic is HTTP, a potentially better option is to use Azure Application Gateway. Application Gateway is a load
balancer designed for web applications. It uses Azure Load Balancer at the transport level (TCP) and applies sophisticated
URL-based routing rules to support several advanced scenarios.
This type of routing is known as application layer (OSI layer 7) load balancing since it understands the structure of the HTTP
message.
Here are some of the benefits of using Azure Application Gateway over a simple load balancer:
o Cookie affinity: Useful when you want to keep a user session on the same backend server.
o SSL termination: Application Gateway can manage your SSL certificates and pass unencrypted traffic to the backend
servers to avoid encryption/decryption overhead. It also supports full end-to-end encryption for applications that
require that.
o Web application firewall: Application gateway supports a sophisticated firewall (WAF) with detailed monitoring and
logging to detect malicious attacks against your network infrastructure.
o URL rule-based routes: Application Gateway allows you to route traffic based on URL patterns, source IP address and
port to destination IP address and port. This is helpful when setting up a content delivery network.
o Rewrite HTTP headers: You can add or remove information from the inbound and outbound HTTP headers of each
request to enable important security scenarios, or scrub sensitive information such as server names.

Use Traffic Manager to route users to the closest endpoint
03/07/2019 74
Traffic Manager uses the DNS server that's closest to the user to direct user traffic to a globally distributed endpoint.
Traffic Manager doesn't see the traffic that's passed between the client and server. Rather, it directs the client web
browser to a preferred endpoint. Traffic Manager can route traffic in a few different ways, such as to the endpoint with the
lowest latency.
Although not shown here, this setup could also include your on-premises deployment running in California. You can
connect Traffic Manager to your own on-premises networks, enabling you to maintain your existing data center
investments. Or you can move your application entirely to the cloud. The choice is yours.

Compare Load Balancer to Traffic Manager
03/07/2019 75
Azure Load Balancer distributes traffic within the same region to make your services more highly available and resilient.
Traffic Manager works at the DNS level, and directs the client to a preferred endpoint. This endpoint can be to the region
that's closest to your user.
Load Balancer and Traffic Manager both help make your services more resilient, but in slightly different ways. When Load
Balancer detects an unresponsive VM, it directs traffic to other VMs in the pool. Traffic Manager monitors the health of
your endpoints. In contrast, when Traffic Manager finds an unresponsive endpoint, it directs traffic to the next closest
endpoint that is responsive.

03/07/2019 76
Security, responsibility and trust
in Azure

Share security responsibility with Azure
03/07/2019 77
https://docs.microsoft.com/en-us/learn/modules/intro-to-security-in-azure/2-shared-responsibility

A layered approach to security
03/07/2019 78
Data
In almost all cases, attackers are after data:
o Stored in a database
o Stored on disk inside virtual machines
o Stored on a SaaS application such as Office 365
o Stored in cloud storage
It's the responsibility of those storing and controlling access to data to
ensure that it's properly secured. Often, there are regulatory
requirements that dictate the controls and processes that must be in
place to ensure the confidentiality, integrity, and availability of the data.
Application
o Ensure applications are secure and free of vulnerabilities.
o Store sensitive application secrets in a secure storage medium.
o Make security a design requirement for all application development.
Integrating security into the application development life cycle will help
reduce the number of vulnerabilities introduced in code. We encourage
all development teams to ensure their applications are secure by
default, and that they're making security requirements non-negotiable.
Compute
o Secure access to virtual machines.
o Implement endpoint protection and keep systems patched
and current.
Malware, unpatched systems, and improperly secured systems
open your environment to attacks. The focus in this layer is on
making sure your compute resources are secure, and that you
have the proper controls in place to minimize security issues.
Networking
o Limit communication between resources.
o Deny by default.
o Restrict inbound internet access and limit outbound, where
appropriate.
o Implement secure connectivity to on-premises networks.
At this layer, the focus is on limiting the network connectivity
across all your resources to allow only what is required. By
limiting this communication, you reduce the risk of lateral
movement throughout your network.

Share security responsibility with Azure
03/07/2019 79
Perimeter
o Use distributed denial of service (DDoS) protection to filter large-
scale attacks before they can cause a denial of service for end users.
o Use perimeter firewalls to identify and alert on malicious attacks
against your network.
At the network perimeter, it's about protecting from network-based
attacks against your resources. Identifying these attacks, eliminating
their impact, and alerting you when they happen are important ways to
keep your network secure.
Identity and access
o Control access to infrastructure and change control.
o Use single sign-on and multi-factor authentication.
o Audit events and changes.
The identity and access layer is all about ensuring identities are secure,
access granted is only what is needed, and changes are logged.
Physical security
o Physical building security and controlling access to
computing hardware within the data center is the first line
of defense.
With physical security, the intent is to provide physical
safeguards against access to assets. This ensures that other
layers can't be bypassed, and loss or theft is handled
appropriately.
https://docs.microsoft.com/en-us/learn/modules/intro-to-security-in-azure/2-shared-responsibility

Get tips from Azure Security Center
03/07/2019 80
A great place to start when examining the security of your Azure-based solutions is Azure Security Center. Security Center
is a monitoring service that provides threat protection across all of your services both in Azure, and on-premises. Security
Center can:
o Provide security recommendations based on your configurations, resources, and networks.
o Monitor security settings across on-premises and cloud workloads, and automatically apply required security to new
services as they come online.
o Continuously monitor all your services, and perform automatic security assessments to identify potential
vulnerabilities before they can be exploited.
o Use machine learning to detect and block malware from being installed on your virtual machines and services. You can
also define a list of allowed applications to ensure that only the apps you validate are allowed to execute.
o Analyze and identify potential inbound attacks, and help to investigate threats and any post-breach activity that might
have occurred.
o Provide just-in-time access control for ports, reducing your attack surface by ensuring the network only allows traffic
that you require.
Azure Security Center is part of the Center for Internet Security (CIS) recommendations.

Authentication and authorization
03/07/2019 81
Two fundamental concepts that need to be understood when talking about identity and access control are authentication
and authorization. They underpin everything else that happens and occur sequentially in any identity and access process:
o Authentication is the process of establishing the identity of a person or service looking to access a resource. It involves
the act of challenging a party for legitimate credentials, and provides the basis for creating a security principal for
identity and access control use. It establishes if they are who they say they are.
o Authorization is the process of establishing what level of access an authenticated person or service has. It specifies
what data they're allowed to access and what they can do with it.
Authentication is sometimes shortened to AuthN, and authorization is sometimes shortened to AuthZ.
Azure provides services to manage both authentication and authorization through Azure Active Directory (Azure AD).

What is Azure Active Directory?
03/07/2019 82
Azure AD is a cloud-based identity service. It has built in support for synchronizing with your existing on-premises Active
Directory or can be used stand-alone. This means that all your applications, whether on-premises, in the cloud (including
Office 365), or even mobile can share the same credentials. Administrators and developers can control access to internal
and external data and applications using centralized rules and policies configured in Azure AD.
Azure AD provides services such as:
o Authentication: This includes verifying identity to access applications and resources, and providing functionality such
as self-service password reset, multi-factor authentication (MFA), a custom banned password list, and smart lockout
services.
o Single-Sign-On (SSO): SSO enables users to remember only one ID and one password to access multiple applications. A
single identity is tied to a user, simplifying the security model. As users change roles or leave an organization, access
modifications are tied to that identity, greatly reducing the effort needed to change or disable accounts.
o Application management: You can manage your cloud and on-premises apps using Azure AD Application Proxy, SSO,
the My apps portal (also referred to as Access panel), and SaaS apps.
o Business to business (B2B) identity services: Manage your guest users and external partners while maintaining control
over your own corporate data Business-to-Customer (B2C) identity services. Customize and control how users sign up,
sign in, and manage their profiles when using your apps with services.
o Device Management: Manage how your cloud or on-premises devices access your corporate data.

Single sign-on
03/07/2019 83
With single sign-on (SSO), users need to remember only one ID and one password. Access across applications is granted to
a single identity tied to a user, simplifying the security model. As users change roles or leave an organization, access
modifications are tied to the single identity, greatly reducing the effort needed to change or disable accounts. Using single
sign-on for accounts will make it easier for users to manage their identities and will increase the security capabilities in
your environment.
SSO with Azure Active Directory:
By leveraging Azure AD for SSO you'll also have the ability to combine multiple data sources into an intelligent security
graph. This security graph enables the ability to provide threat analysis and real-time identity protection to all accounts in
Azure AD, including accounts that are synchronized from your on-premises AD. By using a centralized identity provider,
you'll have centralized the security controls, reporting, alerting, and administration of your identity infrastructure.

Multi-factor authentication
03/07/2019 84
Multi-factor authentication (MFA) provides additional security for your identities by requiring two or more elements for
full authentication. These elements fall into three categories:
o Something you know
o Something you possess
o Something you are
Something you know would be a password or the answer to a security question. Something you possess could be a mobile
app that receives a notification or a token-generating device. Something you are is typically some sort of biometric
property, such as a fingerprint or face scan used on many mobile devices.
Azure AD has MFA capabilities built in and will integrate with other third-party MFA providers. It's provided free of charge
to any user who has the Global Administrator role in Azure AD, because these are highly sensitive accounts. All other
accounts can have MFA enabled by purchasing licenses with this capability — as well as assigning a license to the account.

Providing identities to services
03/07/2019 85
Service principals:
To understand service principals, it's useful to first understand
the words identity and principal, because of how they are
used in the identity management world.
An identity is just a thing that can be authenticated. Obviously,
this includes users with a user name and password, but it can
also include applications or other servers, which might
authenticate with secret keys or certificates.
A principal is an identity acting with certain roles or claims.
Usually, it is not useful to consider identity and principal
separately, but think of using sudo on a Bash prompt in Linux
or on Windows using "run as Administrator." In both those
cases, you are still logged in as the same identity as before,
but you've changed the role under which you are executing.
Groups are often also considered principals because they can
have rights assigned.
A service principal is an identity that is used by a service or
application. And like other identities, it can be assigned roles.
Managed identities for Azure services:
The creation of service principals can be a tedious process,
and there are a lot of touch points that can make maintaining
them difficult. Managed identities for Azure services are much
easier and will do most of the work for you.
A managed identity can be instantly created for any Azure
service that supports it—and the list is constantly growing.
When you create a managed identity for a service, you are
creating an account on the Azure AD tenant. The Azure
infrastructure will automatically take care of authenticating
the service and managing the account. You can then use that
account like any other Azure AD account, including securely
letting the authenticated service access other Azure
resources.

Role-based access control
03/07/2019 86
Roles are sets of permissions, like "Read-only" or "Contributor", that users can be granted to access an Azure service
instance.
Identities are mapped to roles directly or through group membership. Separating security principals, access permissions,
and resources provides simple access management and fine-grained control. Administrators are able to ensure the
minimum necessary permissions are granted.
Roles can be granted at the individual service instance level, but they also flow down the Azure Resource Manager
hierarchy.
Here's a diagram that shows this relationship. Roles assigned at a higher scope, like an entire subscription, are inherited by
child scopes, like service instances.

Privileged Identity Management
03/07/2019 87
In addition to managing Azure resource access with role-based access control (RBAC), a comprehensive approach to
infrastructure protection should consider including the ongoing auditing of role members as their organization changes
and evolves. Azure AD Privileged Identity Management (PIM) is an additional, paid-for offering that provides oversight of
role assignments, self-service, and just-in-time role activation and Azure AD and Azure resource access reviews.

Encryption (1/2)
03/07/2019 88
What is encryption?
Encryption is the process of making data unreadable and unusable to unauthorized viewers. To use or read the encrypted
data, it must be decrypted, which requires the use of a secret key. There are two top-level types of encryption: symmetric
and asymmetric.
Symmetric encryption uses the same key to encrypt and decrypt the data. Consider a desktop password manager
application. You enter your passwords and they are encrypted with your own personal key (your key is often derived from
your master password). When the data needs to be retrieved, the same key is used, and the data is decrypted.
Asymmetric encryption uses a public key and private key pair. Either key can encrypt but a single key can't decrypt its own
encrypted data. To decrypt, you need the paired key. Asymmetric encryption is used for things like Transport Layer Security
(TLS) (used in HTTPS) and data signing.
Both symmetric and asymmetric encryption play a role in properly securing your data. Encryption is typically approached in
two ways:
o Encryption at rest
o Encryption in transit

Encryption (2/2)
03/07/2019 89
Encryption at rest:
Data at rest is the data that has been stored on a physical medium. This could
be data stored on the disk of a server, data stored in a database, or data
stored in a storage account. Regardless of the storage mechanism, encryption
of data at rest ensures that the stored data is unreadable without the keys
and secrets needed to decrypt it. If an attacker was to obtain a hard drive
with encrypted data and did not have access to the encryption keys, the
attacker would not compromise the data without great difficulty.
The actual data that is encrypted could vary in its content, usage, and
importance to the organization. This could be financial information critical to
the business, intellectual property that has been developed by the business,
personal data about customers or employees that the business stores, and
even the keys and secrets used for the encryption of the data itself.
Encryption in transit:
Data in transit is the data actively moving from one location to another,
such as across the internet or through a private network. Secure transfer
can be handled by several different layers. It could be done by encrypting
the data at the application layer prior to sending it over a network.
HTTPS is an example of application layer in transit encryption.
You can also set up a secure channel, like a virtual private network (VPN),
at a network layer, to transmit data between two systems.
Encrypting data in transit protects the data from outside observers and
provides a mechanism to transmit data while limiting risk of exposure.

Encryption on Azure (1/3)
03/07/2019 90
Encrypt raw storage:
Azure Storage Service Encryption for data at rest helps you protect your data to meet your organizational security and
compliance commitments. With this feature, the Azure storage platform automatically encrypts your data before persisting
it to Azure Managed Disks, Azure Blob storage, Azure Files, or Azure Queue storage, and decrypts the data before retrieval.
The handling of encryption, encryption at rest, decryption, and key management in Storage Service Encryption is
transparent to applications using the services.
Encrypt virtual machine disks:
Storage Service Encryption provides low-level encryption protection for data written to physical disk, but how do you
protect the virtual hard disks (VHDs) of virtual machines? If malicious attackers gained access to your Azure subscription
and got the VHDs of your virtual machines, how would you ensure they would be unable to access the stored data?
Azure Disk Encryption is a capability that helps you encrypt your Windows and Linux IaaS virtual machine disks. Azure Disk
Encryption leverages the industry-standard BitLocker feature of Windows and the dm-crypt feature of Linux to provide
volume encryption for the OS and data disks. The solution is integrated with Azure Key Vault to help you control and
manage the disk encryption keys and secrets (and you can use managed service identities for accessing Key Vault).

03/07/2019 91
Encrypt databases:
Transparent data encryption (TDE) helps protect Azure SQL Database and Azure Data Warehouse against the threat of
malicious activity. It performs real-time encryption and decryption of the database, associated backups, and transaction log
files at rest without requiring changes to the application. By default, TDE is enabled for all newly deployed Azure SQL
Database instances.
TDE encrypts the storage of an entire database by using a symmetric key called the database encryption key. By default,
Azure provides a unique encryption key per logical SQL Server instance and handles all the details. Bring your own key
(BYOK) is also supported with keys stored in Azure Key Vault (see below).
Encrypt secrets:
We've seen that the encryption services all use keys to encrypt and decrypt data, so how do we ensure that the keys
themselves are secure? Corporations may also have passwords, connection strings, or other sensitive pieces of information
that they need to securely store. In Azure, we can use Azure Key Vault to protect our secrets.

03/07/2019 92
Azure Key Vault is a centralized cloud service for storing your application secrets. Key Vault helps you control your applications' secrets by
keeping them in a single, central location and by providing secure access, permissions control, and access logging capabilities. It is useful
for a variety of scenarios:
o Secrets management. You can use Key Vault to securely store and tightly control access to tokens, passwords, certificates,
Application Programming Interface (API) keys, and other secrets.
o Key management. You also can use Key Vault as a key management solution. Key Vault makes it easier to create and control
the encryption keys used to encrypt your data.
o Certificate management. Key Vault lets you provision, manage, and deploy your public and private Secure Sockets Layer/
Transport Layer Security (SSL/ TLS) certificates for your Azure, and internally connected, resources more easily.
o Store secrets backed by hardware security modules (HSMs). The secrets and keys can be protected either by software, or by
FIPS 140-2 Level 2 validated HSMs.
The benefits of using Key Vault include:
o Centralized application secrets. Centralizing storage for application secrets allows you to control their distribution, and reduces
the chances that secrets may be accidentally leaked.
o Securely stored secrets and keys. Azure uses industry-standard algorithms, key lengths, and HSMs, and access requires proper
authentication and authorization.
o Monitor access and use. Using Key Vault, you can monitor and control access to company secrets.
o Simplified administration of application secrets. Key Vault makes it easier to enroll and renew certificates from public
Certificate Authorities (CAs). You can also scale up and replicate content within regions, and use standard certificate
management tools.
o Integrate with other Azure services. You can integrate Key Vault with storage accounts, container registries, event hubs and
many more Azure services.
o Because Azure AD identities can be granted access to use Azure Key Vault secrets, applications with managed service identities
enabled can automatically and seamlessly acquire the secrets they need.

What is a Firewall?
03/07/2019 93
A firewall is a service that grants server access based on the originating IP address of each request. You create firewall rules
that specify ranges of IP addresses. Only clients from these granted IP addresses will be allowed to access the server.
Firewall rules, generally speaking, also include specific network protocol and port information.
To provide inbound protection at the perimeter, you have several choices:
o Azure Firewall is a managed, cloud-based, network security service that protects your Azure Virtual Network
resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
Azure Firewall provides inbound protection for non-HTTP/S protocols. Examples of non-HTTP/S protocols
include: Remote Desktop Protocol (RDP), Secure Shell (SSH), and File Transfer Protocol (FTP). It also provides
outbound, network-level protection for all ports and protocols, and application-level protection for outbound
HTTP/S.
o Azure Application Gateway is a load balancer that includes a Web Application Firewall (WAF) that provides
protection from common, known vulnerabilities in websites. It is specifically designed to protect HTTP traffic.
o Network virtual appliances (NVAs) are ideal options for non-HTTP services or advanced configurations, and are
similar to hardware firewall appliances.

Stopping Distributed Denial of Service (DDos) attacks
03/07/2019 94
Any resource exposed on the internet is at risk of being attacked by a denial of service attack. These types of attacks
attempt to overwhelm a network resource by sending so many requests that the resource becomes slow or unresponsive.
When you combine Azure DDoS Protection with application design best practices, you help provide defense against DDoS
attacks. DDoS Protection leverages the scale and elasticity of Microsoft’s global network to bring DDoS mitigation capacity
to every Azure region. The Azure DDoS Protection service protects your Azure applications by scrubbing traffic at the Azure
network edge before it can impact your service's availability. Within a few minutes of attack detection, you are notified
using Azure Monitor metrics.
This diagram shows network traffic flowing into Azure from both customers and an attacker. Azure DDoS protection
identifies the attacker's attempt to overwhelm the network and blocks further traffic from reaching Azure services.
Legitimate traffic from customers still flows into Azure without any interruption of service.

Controlling the traffic inside your virtual network
03/07/2019 95
Virtual network security:
Once inside a virtual network (VNet), it's crucial that you limit communication between resources to only what is required.
For communication between virtual machines, Network Security Groups (NSGs) are a critical piece to restrict unnecessary
communication.
Network Security Groups allow you to filter network traffic to and from Azure resources in an Azure virtual network. An
NSG can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by
source and destination IP address, port, and protocol. They provide a list of allowed and denied communication to and
from network interfaces and subnets, and are fully customizable.
You can completely remove public internet access to your services by restricting access to service endpoints. With service
endpoints, Azure service access can be limited to your virtual network.
Network integration:
It's common to have existing network infrastructure that needs to be integrated to provide communication from on-
premises networks or to provide improved communication between services in Azure. There are a few key ways to handle
this integration and improve the security of your network.
Virtual private network (VPN) connections are a common way of establishing secure communication channels between
networks. Connection between Azure Virtual Network and an on-premises VPN device is a great way to provide secure
communication between your network and your VNet on Azure.

Protect your shared documents
03/07/2019 96
Microsoft Azure Information Protection (MSIP or sometimes referred to as AIP) is a cloud-based solution that helps
organizations classify and optionally protect documents and emails by applying labels.
Labels can be applied automatically based on rules and conditions, manually, or a combination of both where users are
guided by recommendations.
After your content is classified, you can track and control how the content is used. For example, you can:
o Analyze data flows to gain insight into your business
o Detect risky behaviors and take corrective measures
o Track access to documents
o Prevent data leakage or misuse of confidential information

Azure Advanced Threat Protection
03/07/2019 97
Azure Advanced Threat Protection (Azure ATP) is a cloud-based security solution that identifies, detects, and helps you
investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.
Azure ATP is capable of detecting known malicious attacks and techniques, security issues, and risks against your network.
Azure ATP consists of several components:
o Azure ATP portal: has its own portal, through which you can monitor and respond to suspicious activity. The Azure ATP
portal allows you to create your Azure ATP instance, and view the data received from Azure ATP sensors. You can also
use the portal to monitor, manage, and investigate threats in your network environment. You can sign in to the Azure
ATP portal at https://portal.atp.azure.com. You must sign in with a user account that is assigned to an Azure AD
security group that has access to the Azure ATP portal.
o Azure ATP sensor: installed directly on your domain controllers. The sensor monitors domain controller traffic without
requiring a dedicated server or configuring port mirroring.
o Azure ATP cloud services: runs on Azure infrastructure and is currently deployed in the United States, Europe, and
Asia. Azure ATP cloud service is connected to Microsoft's intelligent security graph.

03/07/2019 98
Apply and monitor infrastructure
standards with Azure Policy

Define IT compliance with Azure Policy
03/07/2019 99
Azure Policy is a service in Azure that you use to define, assign, and, manage standards for resources in your environment.
It can prevent the creation of disallowed resources, ensure new resources have specific settings applied, and run
evaluations of your existing resources to scan for non-compliance.
Azure Policy comes with many built-in policy and initiative definitions that you can use, under categories such as Storage,
Networking, Compute, Security Center, and Monitoring.
Creating a policy:
The process of creating and implementing an Azure Policy begins with creating a policy definition. Every policy definition
has conditions under which it is enforced. And, it has an accompanying effect that takes place if the conditions are met. To
apply a policy, you will:
1. Create a policy definition
2. Assign a definition to a scope of resources
3. View policy evaluation results

What is a policy definition? (1/2)
03/07/2019 100
A policy definition expresses what to evaluate and what action to take. For example, you could ensure all public websites
are secured with HTTPS, prevent a particular storage type from being created, or force a specific version of SQL Server to
be used.
Here are some of the most common policy definitions you can apply.
Policy definition Description
Allowed Storage Account SKUs This policy definition has a set of conditions/rules that
determine whether a storage account that is being deployed
is within a set of SKU sizes. Its effect is to deny all storage
accounts that do not adhere to the set of defined SKU sizes.
Allowed Resource Type This policy definition has a set of conditions/rules to specify
the resource types that your organization can deploy. Its
effect is to deny all resources that are not part of this defined
list.
Allowed Locations This policy enables you to restrict the locations that your
organization can specify when deploying resources. Its effect
is used to enforce your geographic compliance requirements.
Allowed Virtual Machine SKUs This policy enables you to specify a set of VM SKUs that your
organization can deploy.
Not allowed resource types Prevents a list of resource types from being deployed.

What is a policy definition? (2/2)
03/07/2019 101
The policy definition itself is represented as a JSON file - you can use one of the pre-defined definitions in the portal or
create your own (either modifying an existing one or starting from scratch). There are hundreds of samples available on
GitHub.
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"not": {
"field": "Microsoft.Compute/virtualMachines/sku.name",
"in": "[parameters('listOfAllowedSKUs')]"
}
}
]
},
"then": {
"effect": "Deny"
}
}

Assign a definition to a scope of resources
03/07/2019 102
Once you've defined one or more policy definitions, you'll need to assign them. A policy assignment is a policy definition
that has been assigned to take place within a specific scope.
This scope could range from a full subscription down to a resource group. Policy assignments are inherited by all child
resources. This means that if a policy is applied to a resource group, it is applied to all the resources within that resource
group. However, you can exclude a subscope from the policy assignment. For example, we could enforce a policy for an
entire subscription and then exclude a few select resource groups.
You can assign any of these policies through the Azure portal, PowerShell, or Azure CLI. When you assign a policy
definition, you will need to supply any parameters which are defined.
https://docs.microsoft.com/en-us/learn/modules/intro-to-governance/2-azure-policy

Policy effects
03/07/2019 103
Requests to create or update a resource through Azure Resource Manager are evaluated by Azure Policy first. Policy
creates a list of all assignments that apply to the resource and then evaluates the resource against each definition. Policy
processes several of the effects before handing the request to the appropriate Resource Provider to avoid any unnecessary
processing if the resource violates policy.
Each policy definition in Azure Policy has a single effect. That effect determines what happens when the associated policy
rule is matched. When that happens, Azure Policy will take a specific action based on the assigned effect.
Policy Effect What happens?
Deny The resource creation/update fails due to policy.
Disabled The policy rule is ignored (disabled). Often used for testing.
Append Adds additional parameters/fields to the requested resource
during creation or update. A common example is adding tags
on resources such as Cost Center or specifying allowed IPs for
a storage resource.
Audit, AuditIfNotExists Creates a warning event in the activity log when evaluating a
non-compliant resource, but it doesn't stop the request.
DeployIfNotExists Executes a template deployment when a specific condition is
met. For example, if SQL encryption is enabled on a database,
then it can run a template after the DB is created to set it up
a specific way.

Organize policy with initiatives
03/07/2019 104
Managing a few policy definitions is easy, but once you have more than a few, you will want to organize them. That's where
initiatives come in.
Initiatives work alongside policies in Azure Policy. An initiative definition is a set or group of policy definitions to help track
your compliance state for a larger goal. Even if you have a single policy, we recommend using initiatives if you anticipate
increasing the number of policies over time.
Like a policy assignment, an initiative assignment is an initiative definition assigned to a specific scope. Initiative
assignments reduce the need to make several initiative definitions for each scope. This scope could also range from a
management group to a resource group.
Once defined, initiatives can be assigned just as policies can - and they apply all the associated policy definitions.
Defining initiatives:
Initiative definitions simplify the process of managing and assigning policy definitions by grouping a set of policies into a
single item. For example, you could create an initiative named Enable Monitoring in Azure Security Center, with a goal to
monitor all the available security recommendations in your Azure Security Center.
https://docs.microsoft.com/en-us/learn/modules/intro-to-governance/3-initiatives

Enterprise governance management
03/07/2019 105
Access management occurs at the Azure subscription level. This allows an organization to configure each division of the
company in a specific fashion based on their responsibilities and requirements. Planning and keeping rules consistent
across subscriptions can be challenging without a little help.
Azure Management Groups are containers for managing access, policies, and compliance across multiple Azure
subscriptions. Management groups allow you to order your Azure resources hierarchically into collections, which provide a
further level of classification that is above the level of subscriptions. All subscriptions within a management group
automatically inherit the conditions applied to the management group. Management groups give you enterprise-grade
management at a large scale no matter what type of subscriptions you might have.
The following diagram shows an example of creating a hierarchy for governance using management groups.
https://docs.microsoft.com/en-us/learn/modules/intro-to-governance/4-
management-groups

Define standard resources with Azure Blueprints
03/07/2019 106
Adhering to security or compliance requirements, whether government or industry requirements, can be difficult and
time-consuming. To help you with auditing, traceability, and compliance with your deployments, use Azure Blueprint
artefacts and tools.
Azure Blueprint allows you to define a repeatable set of Azure resources that implement and adhere to your organization's
standards, patterns, and requirements. Blueprint enables development teams to rapidly build and deploy new
environments with the knowledge that they're building within organizational compliance with a set of built-in components
that speed up development and delivery.
Azure Blueprint is a declarative way to orchestrate the deployment of various resource templates and other artifacts, such
as:
o Role assignments
o Policy assignments
o Azure Resource Manager templates
o Resource groups

Explore your service compliance with Compliance Manager (1/3)
03/07/2019 107
Governing your own resources and how they are used is only part of the solution when using a cloud provider. You also
have to understand how the provider manages the underlying resources you are building on.
Microsoft Privacy Statement:
The Microsoft privacy statement explains what personal data Microsoft processes, how Microsoft processes it, and for
what purposes.
The statement applies to the interactions Microsoft has with you and Microsoft products such as Microsoft services,
websites, apps, software, servers, and devices. It is intended to provide openness and honesty about how Microsoft deals
with personal data in its products and services.
Microsoft Trust Center:
Trust Center is a website resource containing information and details about how Microsoft implements and supports
security, privacy, compliance, and transparency in all Microsoft cloud products and services. The Trust Center is an
important part of the Microsoft Trusted Cloud Initiative, and provides support and resources for the legal and compliance
community including:
o In-depth information about security, privacy, compliance offerings, policies, features, and practices across
Microsoft cloud products.
o Recommended resources in the form of a curated list of the most applicable and widely-used resources for each
topic.
o Information specific to key organizational roles, including business managers, tenant admins or data security
teams, risk assessment and privacy officers, and legal compliance teams.
o Cross-company document search, which is coming soon and will enable existing cloud service customers to
search the Service Trust Portal.
o Direct guidance and support for when you can't find what you're looking for.

03/07/2019 108
Service Trust Portal:
The Service Trust Portal (STP) hosts the Compliance Manager service, and is the Microsoft public site for publishing audit
reports and other compliance-related information relevant to Microsoft’s cloud services. STP users can download audit
reports produced by external auditors and gain insight from Microsoft-authored reports that provide details on how
Microsoft builds and operates its cloud services.
STP also includes information about how Microsoft online services can help your organization maintain and track
compliance with standards, laws, and regulations, such as:
o ISO
o SOC
o NIST
o FedRAMP
o GDPR

03/07/2019 109
Compliance Manager:
Compliance Manager is a workflow-based risk assessment dashboard within the Trust Portal that enables you to track,
assign, and verify your organization's regulatory compliance activities related to Microsoft professional services and
Microsoft cloud services such as Office 365, Dynamics 365, and Azure.
Compliance Manager provides the following features:
o Combines the following three items:
1. Detailed information provided by Microsoft to auditors and regulators, as part of various third-party audits of
Microsoft 's cloud services against various standards (for example, ISO 27001, ISO 27018, and NIST).
2. Information that Microsoft compiles internally for its compliance with regulations (such as HIPAA and the EU
GDPR).
3. An organization's self-assessment of their own compliance with these standards and regulations.
o Enables you to assign, track, and record compliance and assessment-related activities, which can help your
organization cross team barriers to achieve your organization's compliance goals.
o Provides a Compliance Score to help you track your progress and prioritize auditing controls that will help reduce your
organization's exposure to risk.
o Provides a secure repository in which to upload and manage evidence and other artifacts related to compliance
activities.
o Produces richly detailed reports in Microsoft Excel that document the compliance activities performed by Microsoft
and your organization, which can be provided to auditors, regulators, and other compliance stakeholders.

Monitor your service health
03/07/2019 110
Defining policy and access provides fine-grained control over resources in your cloud IT infrastructure. Once those
resources are deployed, you will want to know about any issues or performance problems they might encounter.
Azure provides two primary services to monitor the health of your apps and resources.
o Azure Monitor: maximizes the availability and performance of your applications by delivering a comprehensive
solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. It helps you
understand how your applications are performing and proactively identifies issues affecting them and the resources
they depend on (https://azure.microsoft.com/fr-fr/services/monitor/).
o Azure Service Health: is a suite of experiences that provide personalized guidance and support when issues with Azure
services affect you. It can notify you, help you understand the impact of issues, and keep you updated as the issue is
resolved. Azure Service Health can also help you prepare for planned maintenance and changes that could affect the
availability of your resources (https://azure.microsoft.com/fr-fr/features/service-health/).
More details here: https://docs.microsoft.com/en-us/learn/modules/intro-to-governance/7-monitoring.

03/07/2019 111
Control and organize Azure
resources with Azure Resource
Manager

Principles of resource groups
03/07/2019 112
Resource groups are a fundamental element of the Azure platform. A resource group is a logical container for resources
deployed on Azure. These resources are anything you create in an Azure subscription like virtual machines, Application
Gateways, and CosmosDB instances. All resources must be in a resource group and a resource can only be a member of a
single resource group. Resources can be moved between resource groups at any time. Resource groups can't be nested.
Before any resource can be provisioned, you need a resource group for it to be placed in.
Logical grouping:
Resource groups exist to help manage and organize your Azure resources. By placing resources of similar usage, type, or
location, you can provide some order and organization to resources you create in Azure. Logical grouping is the aspect that
we're most interested in here, since there's a lot of disorder among our resources.
Life cycle:
If you delete a resource group, all resources contained within are also deleted. Organizing resources by life cycle can be
useful in non-production environments, where you might try an experiment, but then dispose of it when done. Resource
groups make it easy to remove a set of resources at once.
Authorization:
Resource groups are also a scope for applying role-based access control (RBAC) permissions. By applying RBAC permissions
to a resource group, you can ease administration and limit access to allow only what is needed.
https://docs.microsoft.com/en-us/learn/modules/control-and-organize-with-azure-resource-manager/2-principles-of-resource-groups

Use resource groups for organization
03/07/2019 113
Resource groups can be organized in a number of ways, let's take a look at a few examples. We might put all resources that
are core infrastructure into this resource group. But we could also organize them strictly by resource type. For example,
put all VNets in one resource group, all virtual machines in another resource group, and all Azure Cosmos DB instances in
yet another resource group.
https://docs.microsoft.com/en-us/learn/modules/control-and-organize-with-azure-resource-manager/2-principles-of-resource-groups

What are tags?
03/07/2019 114
Tags are name/value pairs of text data that you can apply to resources and resource groups. Tags allow you to associate
custom details about your resource, in addition to the standard Azure properties a resource has:
o department (like finance, marketing, and more)
o environment (prod, test, dev),
o cost center
o life cycle and automation (like shutdown and startup of virtual machines).
A resource can have up to 15 tags. The name is limited to 512 characters for all types of resources except storage accounts,
which have a limit of 128 characters. The tag value is limited to 256 characters for all types of resources. Tags aren't
inherited from parent resources. Not all resource types support tags, and tags can't be applied to classic resources.
Tags can be added and manipulated through the Azure portal, Azure CLI, Azure PowerShell, Resource Manager templates,
and through the REST API. For example, to add a resource tag to a virtual network using the Azure CLI, you could use the
following command:
az resource tag --tags Department=Finance
--resource-group msftlearn-core-infrastructure-rg
--name msftlearn-vnet1
--resource-type "Microsoft.Network/virtualNetworks"

Use policies to enforce standards
03/07/2019 115
Azure Policy is a service you can use to create, assign, and manage policies. These policies apply and enforce rules that
your resources need to follow. These policies can enforce these rules when resources are created, and can be evaluated
against existing resources to give visibility into compliance.
Policies can enforce things such as only allowing specific types of resources to be created, or only allowing resources in
specific Azure regions. You can enforce naming conventions across your Azure environment. You can also enforce that
specific tags are applied to resources. Let's take a look at how policies work.
{
"mode": "Indexed",
"policyRule": {
"if": {
"field": "[concat('tags[', parameters('tagName'), ']')]",
"exists": "false"
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName": {
"type": "String",
"metadata": {
"displayName": "Tag Name",
"description": "Name of the tag, such as 'environment'"
}
}
}
}

Secure resources with role-based access control
03/07/2019 116
Implementing Azure Policy ensured that all our employees with Azure access are following our internal standards for
creating resources, but we have a second issue we need to solve: how do we protect those resources once they are
deployed? We have IT personnel that need to manage settings, developers that need to have read-only access, and
administrators that need to be able to control them completely. Enter Role-Based Access Control (RBAC).
RBAC provides fine-grained access management for Azure resources, enabling you to grant users the specific rights they
need to perform their jobs. RBAC is considered a core service and is included with all subscription levels at no cost.
Using RBAC, you can:
o Allow one user to manage VMs in a subscription, and another user to manage virtual networks.
o Allow a database administrator (DBA) group to manage SQL databases in a subscription.
o Allow a user to manage all resources in a resource group, such as VMs, websites, and virtual subnets.
o Allow an application to access all resources in a resource group.
To view access permissions, use the Access Control (IAM) blade in the Azure portal. On this blade, you can see who has
access to an area and their role. Using this same blade, you can also grant or remove access.

Use resource locks to protect resources
03/07/2019 117
What are resource locks?
Resource locks are a setting that can be applied to any resource to block modification or deletion. Resource locks can set to
either Delete or Read-only. Delete will allow all operations against the resource but block the ability to delete it. Read-only
will only allow read activities to be performed against it, blocking any modification or deletion of the resource. Resource
locks can be applied to subscriptions, resource groups, and to individual resources, and are inherited when applied at
higher levels.
When a resource lock is applied, you must first remove the lock in order to perform that activity. By putting an additional
step in place before allowing the action to be taken on the resource, it helps protect resources from inadvertent actions,
and helps protect your administrators from doing something they may not have intended to do. Resource locks apply
regardless of RBAC permissions. Even if you are an owner of the resource, you must still remove the lock before you'll
actually be able to perform the blocked activity.

03/07/2019 118
Predict costs and optimize
spending for Azure

Purchasing Azure products and services
03/07/2019 119
There are three main customer types on which the available purchasing options for Azure products and services are
contingent, including:
o Enterprise - Enterprise customers sign an Enterprise Agreement with Azure that commits them to spend a
negotiated amount on Azure services, which they typically pay annually. Enterprise customers also have access
to customized Azure pricing.
o Web direct - Direct Web customers pay general public prices for Azure resources, and their monthly billing and
payments occur through the Azure website.
o Cloud Solution Provider - Cloud Solution Provider (CSP) typically are Microsoft partner companies that a
customer hires to build solutions on top of Azure. Payment and billing for Azure usage occur through the
customer's CSP.

Factors affecting costs
03/07/2019 120
Just like your on-premises equipment costs, there are several elements that will affect your monthly costs when using
Azure services. Let's look at a few of the primary factors including resource type, services, the user's location, and the
billing zone:
o Resource type: Costs are resource-specific, so the usage that a meter tracks and the number of meters
associated with a resource depend on the resource type.
o Services: Azure usage rates and billing periods can differ between Enterprise, Web Direct, and Cloud Solution
Provider (CSP) customers. Some subscription types also include usage allowances, which affect costs.
o Location: Azure has datacenters all over the world. Usage costs vary between locations that offer particular
Azure products, services, and resources based on popularity, demand, and local infrastructure costs.
o Azure billing zones: Bandwidth refers to data moving in and out of Azure datacenters. Most of the time inbound
data transfers (data going into Azure datacenters) are free. For outbound data transfers (data going out of Azure
datacenters), the data transfer pricing is based on Billing Zones.
Billing zones aren't the same as an Availability Zone. In Azure, the term zone is for billing purposes only, and the full term
Availability Zone refers to the failure protection that Azure provides for datacenters.

Estimate costs with the Azure pricing calculator
03/07/2019 121
To make estimates easy for customers to create, Microsoft developed the Azure pricing calculator. The Azure pricing
calculator is a free web-based tool that allows you to input Azure services and modify properties and options of the
services. It outputs the costs per service and total cost for the full estimate.
The options that you can configure in the pricing calculator vary between products, but basic configuration options
include:
Option Description
Region Lists the regions from which you can provision a product. Southeast Asia, central Canada, the western United
States, and Northern Europe are among the possible regions available for some resources.
Tier Sets the type of tier you wish to allocate to a selected resource, such as Free Tier, Basic Tier, etc.
Billing Options Highlights the billing options available to different types of customer and subscriptions for a chosen product.
Support Options Allows you to pick from included or paid support pricing options for a selected product.
Programs and Offers Allows you to choose from available price offerings according to your customer or subscription type.
Azure Dev/Test Pricing Lists the available development and test prices for a product. Dev/Test pricing applies only when you run
resources within an Azure subscription that is based on a Dev/Test offer.

Predict and optimize with Cost Management and Azure Advisor
(1/2)
03/07/2019 122
Azure Advisor:
Azure Advisor is a free service built into Azure that provides recommendations on high availability, security, performance,
and cost. Advisor analyzes your deployed services and looks for ways to improve your environment across those four areas.
We'll focus on the cost recommendations, but you'll want to take some time to review the other recommendations as well.
Advisor makes cost recommendations in the following areas:
o Reduce costs by eliminating unprovisioned Azure ExpressRoute circuits. This identifies ExpressRoute circuits that have
been in the provider status of Not Provisioned for more than one month and recommends deleting the circuit if you
aren't planning to provision the circuit with your connectivity provider.
o Buy reserved instances to save money over pay-as-you-go. This will review your virtual machine usage over the last 30
days and determine if you could save money in the future by purchasing reserved instances. Advisor will show you the
regions and sizes where you potentially have the most savings and will show you the estimated savings you might
achieve from purchasing reserved instances.
o Right-size or shutdown underutilized virtual machines. This monitors your virtual machine usage for 14 days and then
identifies underutilized virtual machines. Virtual machines whose average CPU utilization is 5 percent or less and
network usage is 7 MB or less for four or more days are considered underutilized virtual machines. The average CPU
utilization threshold is adjustable up to 20 percent. By identifying these virtual machines, you can decide to resize
them to a smaller instance type, reducing your costs.

Predict and optimize with Cost Management and Azure Advisor
(2/2)
03/07/2019 123
Azure Cost Management:
Azure Cost Management is another free, built-in Azure tool that can be used to gain greater insights into where your cloud
money is going. You can see historical breakdowns of what services you are spending your money on and how it is tracking
against budgets that you have set. You can set budgets, schedule reports, and analyze your cost areas.
Cloudyn:
Cloudyn, a Microsoft subsidiary, allows you to track cloud usage and expenditures for your Azure resources and other
cloud providers including Amazon Web Services and Google. Easy-to-understand dashboard reports help with cost
allocation and chargebacks. Cost Management helps optimize your cloud spending by identifying underutilized resources
that you can then manage and adjust. Usage for Azure is free, and there are paid options for premium support and to view
data from other clouds.

Estimate the Total Cost of Ownership with the Azure TCO
calculator
03/07/2019 124
The pricing calculator and cost management advisor can help you predict and analyze your spend for new or existing
services.
If you are starting to migrate to the cloud, a useful tool you can use to predict your cost savings is the Total Cost of
Ownership (TCO) calculator. To use the TCO calculator, you need to complete four steps.
1. Open the TCO calculator.
2. Define your workloads: Start by entering details about your on-premises infrastructure into the TCO calculator
according to four groups:
1. Servers: Enter details of your current on-premises server infrastructure.
2. Databases: Enter details of your on-premises database infrastructure in the Source section. In the Destination
section, select the corresponding Azure service you would like to use.
3. Storage: Enter the details of your on-premises storage infrastructure.
4. Networking: Enter the amount of network bandwidth you currently consume in your on-premises environment.
3. Adjust assumptions: Adjust the values of assumptions that the TCO calculator makes, which might vary between
customers. To improve the accuracy of the TCO calculator, you should adjust the values, so they match the costs of
your current on-premises infrastructure.
4. View the report: The TCO calculator generates a detailed report based on the details you enter and the adjustments
you make. The report allows you to compare the costs of your on-premises infrastructure with the costs of using
Azure products and services to host your infrastructure in the cloud.

Save on infrastructure costs (1/2)
03/07/2019 125
o Use Azure credits: Visual Studio subscribers can activate a monthly credit benefit which allows you to experiment with,
develop, and test new solutions on Azure. Use Azure credits to try out new services such as App Service, Windows 10
VMs, Azure SQL Server databases, Containers, Cognitive Services, Functions, Data Lake, and more without incurring
any monetary costs.
o Use spending limits: Azure provides the Spending Limits feature to help prevent you from exhausting the credit on
your account within each billing period. When your Azure usage results in charges that use all the included monthly
credit, the services that you deployed are disabled and turned off for the rest of that billing period. Once a new billing
period starts, assuming there are credits available, the resources are re-activated and deployed.
o Use reserved instances: Reserved instances are purchased in one-year or three-year terms, with payment required for
the full term up front. After it's purchased, Microsoft matches up the reservation to running instances and decrements
the hours from your reservation. Reservations can be purchased through the Azure portal. And because reserved
instances are a compute discount, they are available for both Windows and Linux VMs.
o Choose low-cost locations and regions: The cost of Azure products, services, and resources can vary across locations
and regions, and if possible, you should use them in those locations and regions where they cost less.

Save on infrastructure costs (2/2)
03/07/2019 126
o Research available cost-saving offers: Keep up-to-date with the latest Azure customer and subscription offers, and
switch to offers that provide the most significant cost-saving benefit. You can check the Azure Updates page for
information about the latest updates to Azure products, services, and features, as well as product roadmaps and
announcements.
o Right-size underutilized virtual machines: Right-sizing a virtual machine is the process of resizing it to a proper size.
o Deallocate virtual machines in off hours: If you have virtual machine workloads that are only used during certain
periods, but you're running them every hour of every day, you're wasting money.
o Migrate to PaaS or SaaS services: PaaS services typically provide substantial savings in both resource and operational
costs. The challenge is that depending on the type of service, varying levels of effort will be required to move to these
services from both a time and resource perspective. You might be able to move a SQL Server database to Azure SQL
Database easily, but it might take substantially more effort to transfer your multi-tier application to a container or
serverless-based architecture. It's a good practice to continuously evaluate the architecture of your applications to
determine if there are efficiencies to be gained through PaaS services.

Save on licensing costs (1/2)
03/07/2019 127
o Linux vs. Windows: Where you have a choice, and your application doesn't depend on the underlying OS, it's useful to
compare pricing to determine whether you can save money.
o Azure Hybrid Benefit for Windows Server: Many customers have invested in Windows Server licenses and would like
to repurpose this investment on Azure. The Azure Hybrid Benefit gives customers the right to use these licenses for
virtual machines on Azure. That means you won't be charged for the Windows Server license and will instead be billed
at the Linux rate.
o Azure Hybrid Benefit for SQL Server: The Azure Hybrid Benefit for SQL Server helps you maximize the value from your
current licensing investments and accelerate your migration to the cloud. Azure Hybrid Benefit for SQL Server is an
Azure-based benefit that enables you to use your SQL Server licenses with active Software Assurance to pay a reduced
rate.
o Use Dev/Test subscription offers: The Enterprise Dev/Test and Pay-As-You-Go Dev/Test offers are a benefit you can
take advantage of to save costs on your non-production environments. This benefit gives you several discounts, most
notably for Windows workloads, eliminating license charges and only billing you at the Linux rate for virtual machines.
This also applies to SQL Server and any other Microsoft software that is covered under a Visual Studio subscription
(formerly known as MSDN).

Save on licensing costs (2/2)
03/07/2019 128
o Bring your own SQL Server license: If you are a customer on an Enterprise Agreement and already have an investment
in SQL Server licenses, and they have freed up as part of moving resources to Azure, you can provision bring your own
license (BYOL) images off the Azure Marketplace, giving you the ability to take advantage of these unused licenses and
reduce your Azure VM cost. You've always been able to do this by provisioning a Windows VM and manually installing
SQL Server, but this simplifies the creation process by leveraging Microsoft certified images. Search for BYOL in the
Marketplace to find these images.
o Use SQL Server Developer Edition: A lot of people are unaware that SQL Server Developer Edition is a free product for
nonproduction use. Developer Edition has all the same features that Enterprise Edition has, but for nonproduction
workloads, you can save dramatically on your licensing costs.
o Look for SQL Server images for Developer Edition on the Azure Marketplace and use them for development or testing
purposes to eliminate the additional cost for SQL Server in these cases.
o Use constrained instance sizes for database workloads: Many customers have high requirements for memory, storage,
or I/O bandwidth but low CPU core counts. Based on this popular request, Microsoft has made available the most
popular VM sizes (DS, ES, GS, and MS) in new sizes that constrain the vCPU count to one half or one-quarter of the
original VM size, while maintaining the same memory, storage, and I/O bandwidth.

Azure - training
03/07/2019 130

Azure – cloud workshop
03/07/2019 131

Microsoft – Hands-on Labs
03/07/2019 132

Azure - certifications
03/07/2019 133

Glossary
03/07/2019 135
Terme Definition
Service-Level Agreements (SLAs)
Microsoft maintains its commitment to providing customers with high-quality
products and services by adhering to comprehensive operational policies, standards,
and practices. Formal documents called Service-Level Agreements (SLAs) capture the
specific terms that define the performance standards that apply to Azure.
Failure Mode Analysis (FMA)
When designing your architecture you need to design for resiliency, and you should
perform a Failure Mode Analysis (FMA). The goal of an FMA is to identify possible
points of failure and to define how the application will respond to those failures.
Azure AD
Azure AD is not the same as Windows Active Directory. Windows Active Directory is
focused on securing Windows desktops and servers. In contrast, Azure AD is all about
web-based authentication standards such as OpenID and OAuth.
Availability set
An availability set is a logical grouping of two or more VMs that help keep your
application available during planned or unplanned maintenance.

Glossary
03/07/2019 136
Terme Definition
Single-Sign-On (SSO)
SSO enables users to remember only one ID and one password to access multiple
applications. A single identity is tied to a user, simplifying the security model. As users
change roles or leave an organization, access modifications are tied to that identity,
greatly reducing the effort needed to change or disable accounts.
Capital Expenditure (CapEx)
CapEx is the spending of money on physical infrastructure up front, and then
deducting that expense from your tax bill over time. CapEx is an upfront cost, which
has a value that reduces over time.
Operational Expenditure (OpEx)
OpEx is spending money on services or products now and being billed for them now.
You can deduct this expense from your tax bill in the same year. There's no upfront
cost. You pay for a service or product as you use it

Azure fundamentals

More Related Content

What's hot (20)

Similar to Azure fundamentals (20)

More from Alexandre BERGERE (8)

Recently uploaded (20)

Azure fundamentals