Category Archives: Microsoft Azure

Azure Governance: introduction to Azure Resource Graph

The Azure governance is possible thanks to a series of specially designed services to enable a management and a constant control of the various Azure resources on a large scale. Among these services are Resource Graph, a powerful tool that allows you to quickly obtain via command-line details regarding the different Azure artifacts. Using Resource Graph you can retrieve information that previously required necessarily complex and iterative scripting. This article lists the characteristics of the solution and how you can use it to find out the details of Azure resources on large scale.

Characteristics of the service

In the presence of complex Azure environments who see the presence of many subscriptions, maintain overall visibility of all Azure resources can be complex without the use of tools specifically developed. These requirements which typically need to be addressed:

Ability to view resources and their properties in a transversal way among different subscriptions.
Be able to efficiently perform queries on resources by setting filters, groupings and by imposing a specific sort order on their properties.
Explore iteratively the different resources.
Assessing the impact achieved by applying policies on a large number of cloud resources.

The service Azure Resource Graph allows, thanks to the use of an efficient and powerful language to perform the following actions:

Query on resources by applying filters, complex groupings and sorts.
Explore iteratively resources based on the governance requirements.
Assess the impact given by the application of the policy in a vast cloud.
Detailing the changes that are made to the Azure resource properties. Recently was introduced the ability to view the last 14 days of history regarding the changes made to resources, to identify which properties have been changed and when. This feature is particularly useful in the process of troubleshooting, to detect any change events in a specific time slot. Furthermore, it is functional to understand the properties that were changed when a resource has changed the status of compliance, to consider adopting Azure Policy to properly manage such properties. For further details please visit the Microsoft's official documentation.

All these actions provide important aspects in order to govern the most of their Azure environment.

When an Azure resource is updated, Resource Graph Resource Manager is notified by the relevant changes and updates its database accordingly. Resource Graph also regularly performs a complete scan of resources to ensure that your information is up to date in case of missing notifications or updates that take place outside of Resource Manager.

How to use Resource Graph

The query of Azure Resource Graph are based on the Kusto language, also used by Azure Data Explorer, Application Insights and Azure Log Analytics. For more details on using the query language of Azure Resource Graph you can see the Microsoft's official documentation, that shows how it is structured and what are the operators and supported features.

Resource Graph supports theAzure CLI, Azure PowerShell and Azure SDK for .NET. Querying Resource Graph requires the addition of the relative extension in the Azure CLI environment , while in Azure PowerShell the installation of the Resource Graph module is required. The queries are always structured in an identical manner, regardless of where they are performed.

The use of Resource Graph requires that the user with which it performs the query has at least read permissions, through Role-based access control (RBAC), about resources that you intend to query. If you don't have at least read permission on specific resources, queries will not return results related to them.

The service Azure Resource Graph is also used when performing research in the search bar of the Azure portal, in the new list of resources (‘All resources’) and in the change history of Azure Policy.

Figure 1 – Experience of ‘All resources’ using Azure Resource Graph

Sample Query

Below are some examples of query of Resource Graph and its result.

Figure 2 - Query to count by resources type (Resource Type)

Figure 3 - Query to count the resources by geographic location

The query of Azure Resource Graph have the advantage that besides being able to achieve the desired result in a simple way, they are also very performant:

Figure 4 - Running time of the query to count the resources based on location

If anyone wanted to achieve this result using the classic PowerShell method in complex Azure environments, should join to the single Azure subscription, search the necessary information and move to the next subscription. This approach was the only possible until the arrival of Resource Graph, but it was more labor intensive and much less powerful.

Figure 5 - List of VMs with the OS disk not Managed

Conclusions

Azure Resource Graph allows you to quickly and efficiently explore and analyze Azure resources, allowing to maintain a total visibility even on particularly complex Azure environments, consisting of several subscriptions, each of which with a large number of elements. Particularly useful is the functionality that allows you to see the history of changes to Azure resources. Azure Resource Graph is a tool that allows you to make a significant contribution for the governance of the Azure environment.

Azure IaaS and Azure Stack: announcements and updates (July 2019 – Weeks: 27 and 28)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Pubic preview for large file shares (100 TiB) on standard tier

Announced the public preview of large file shares for Azure Files standard tier. Azure File Sync, until now, scaling cloud file shares beyond 5 TiB required changing the paradigm for accessing data. The preview of a larger and higher scale standard tier for Azure Files, is available to all Azure customers. This preview significantly improves your experience by increasing standard file shares’ capacity and performance limits. In select regions, standard file shares in general purpose accounts can support the following larger limits:

Azure Files	Before (standard tier)	New (standard tier)
Capacity per share	5 TiB	100 TiB (20x increase)
Max IOPS per share	1,000 IOPS	10,000 IOPS (10x increase)
Max throughput per share	Up to 60 MiB/s	Up to 300 MiB/s (5x increase)

Performance limits for a single file remain the same at 1 TiB, 1000 IOPS, and 60 MiB/s. Standard file shares are backed by hard disk drives. If the workload is latency sensitive, you should consider Azure Files premium tier, that is backed by solid-state drives.

New larger B-series VM sizes with flexible CPU usage

Microsoft has released three new B-series sizes: B12ms, B16ms and B20ms. These are lower cost VMs with flexible CPU usage.

Azure Data Box Heavy is generally available

Azure Data Box Heavy has reached general availability in the US and EU. Data Box Heavy is designed for a much larger scale than the original Data Box. Data Box Heavy’s one petabyte of raw capacity and multiple 40 Gbps connectors mean that a datacenter’s worth of data can be moved into Azure in just a few weeks.

Network Watcher is Generally Available in South Africa

Network Watcher is a cloud based solution for troubleshooting and monitoring networks in Azure. Azure Network Watcher is generally available in South Africa North region.

Azure Ephemeral OS Disk is Generally Available

Ephemeral OS disks are created on the local virtual machine (VM) storage and not saved to the remote Azure Storage. Ephemeral OS disks work well for stateless workloads, where applications are tolerant of individual VM failures, but are more affected by VM deployment time or reimaging the individual VM instances. With Ephemeral OS disk, you get lower read/write latency to the OS disk and faster VM reimage. Ephemeral OS disk is free i.e., you incur no storage cost for the OS disk. You can still be charged for any data disks attached to the VM. You can use either the Marketplace or Custom or Gallery Images to deploy VM/VM Scale Set (VMSS) with Ephemeral OS Disk. This functionality is available in all Azure regions.

Azure Monitor for VMs is available in East and South East Australia regions

Azure Monitor for VMs is now available in East Australia and South East Australia. Azure Monitor for VMs monitors your Azure virtual machines and virtual machine scale sets. The service analyzes the performance and health of your Windows and Linux VMs, monitoring their processes and their dependencies on other resources and external processes.

Azure Migrate is enhanced

Azure Migrate is now enhanced and can help you discover, assess, and migrate applications, infrastructure, and data from your on-premises environments to Azure. You can centrally track progress of your migration journey across multiple Microsoft and Independent Software Vendor (ISV) tools in Azure Migrate.

This release includes the following functionality:

Extensible approach with choice across Microsoft and popular ISV assessment and migration tools
Integrated experience for discovery, assessment, and migration with end-to-end progress tracking for servers and databases
Server Assessment and Server Migration for large-scale VMware, Hyper-V, and physical server migrations
Database Assessment and Database Migration across various database targets including Azure SQL Database and Managed Instance

Azure Governance: how to organize your resources using the Azure Management Groups

In the presence of environments with a high number of Azure subscriptions it is necessary to have a different level of abstraction in order to effectively manage the accesses, policies and compliance. To this end, Azure Management Groups have been introduced, that allow to organize different subscriptions into logical containers, on which define, implement and verify government policies needed. This article examines in detail the concepts and shows directions to better organize the Azure resources in order to facilitate the process of governance.

To effectively organize Azure resources is fundamental to define a hierarchy of management groups and subscriptions to which you can apply Azure Policy, the service that allows you to create, assign and manage audit policy. The use of the Management Group is also helpful to effectively manage the assignment of permissions via role-based access control (RBAC), for administrative delegation.

Figure 1 - Example of a hierarchy of Management Groups

Each resource Azure is contained within a specific Azure Subscription, which it is associated to a single Azure Active Directory tenant, and inherits the permissions set at that level.

At the moment, a constraint to consider, is that a Management Group can contain multiple subscriptions as long as the same form part of the same Azure Active Directory tenant . In other words,, the Management Groups reside within a tenant and cannot contain subscriptions of different tenants. The security principal that can be used on management group can come only by the tenant for the management group.

Figure 2 – Relationship between Azure AD and organizational structure

Azure resources belonging to a subscription are contained in Resource Groups. The resource groups are containers of resources that, for administrative purposes, allow to obtain the following benefits:

They facilitate administrative delegation because resources contained inherit permissions to the resource group level.
On the resource group you can set tags, although these are not automatically inherited by the resources, but it is necessary to foresee specific mechanisms if they are deemed necessary.

Figure 3 – Relationship between the levels of the organisational structure

The Azure Policy can be assigned to a subscription or Management Group level and can be defined exceptions for Resource Group. In this regard it is recommended whenever possible, to organize policies in "initiative" and assign them to Management Group level.

The root Management Group is the top level and contains all configured Management Groups and various Azure subscriptions. Root Management Group cannot be removed or moved. The structure can be created with up to six levels deep, without considering the Root level and the level of subscription. Each Management Group can have more children, but supports only one parent for each Management Group and for each subscription.

In the absence of specific requirements, Microsoft recommends that you split production environments than those "DevTest", creating two tiers of management groups. The management group root by default will have fundamental policies, such as those relating to security. On the remaining Management Groups are associated specific policies. The hierarchy of Management Groups provide a model for which the policies that are defined at higher levels in the hierarchy cannot be overwritten by lower levels.

Figure 4 – Management Group & Subscription Modeling Strategy

This approach enables you to manage complex Azure environments, who see the presence of more subscriptions. in a more simple and flexible way, for the following reasons:

The concept of inheritance allows with a single association to apply the desired controls and the assignment of roles on different subscriptions.
It has a centralized management.
You may include additional subscription in the hierarchy, with the knowledge that will adhere to established policies and who will have the assignment of desired roles.

Conclusions

The goverance processes by which an organization can ensure an effective and efficient use of IT resources, in order to achieve their goals, cannot refrain from adopting a model that allows to organize effectively the Azure resources. The use of Management Groups, in environments with a significant number of subscriptions, is essential to meet the common need of standardize, and in some cases impose, how you configure the different resources in the cloud.

Azure management services and System Center: What's New in June 2019

In June have been announced, by Microsoft, a considerable number of news regarding the Azure management services and System Center. From our community, through these articles released monthly, aims to provide a general overview of the main new features of the month, in order to stay up to date on these issues and have the necessary references for further information.

Azure Log Analytics

Azure VMBoundPort Monitor

In Azure Monitor was announced the availability, in all the regions supported by Log Analytics, to consult theVMBoundPort data set. VMBoundPort contains information about all ports that accept incoming traffic and that can potentially accept it. This is a very useful feature, to analyze what ports are open and which are active, to carry out analysis of security or for troubleshooting.

New region supported for Azure Monitor for VMs

Azure Monitor for VMs, the service that allows you to analyze the performance and health of both Windows and Linux VMs, by monitoring their processes and ralative dependencies with other resources, is now also available in the region of West US 2. They become so seven Azure regions that currently support Azure Monitor for VMs.

Availability in new regions
Azure Log Analytics is now also possible to activate it in these new regions: South Africa North, Brazil South, UK West and North Central US.

Advanced Data Security available for SQL Server VMs in Azure

Advanced data security is available in preview for SQL Server on Azure VMs. This feature allows you to protect your SQL Server installations made on board of Azure virtual machines. This service currently includes the capabilities necessary to identify and mitigate potential vulnerabilities on databases and detects unusual activity that may indicate the presence of a security threat on the server.

Updates to the User Interface in Azure Monitor Log Analytics

During the month, some elements of the Azure Monitor Log Analytics underwent a change, For more details you can refer this document.

New version of the agent for Linux systems

This month the new agent version of Log Analytics for Linux systems introduces improvements relating in particular to the installation process and performance. To get more information about it you can access the GitHub official page.

Azure Site Recovery

New Update Rollup

For Azure Site Recovery was releasedUpdate Rollup 37 solving different problems and introduces some improvements. The details and the procedure to be followed for the installation can be found in the specific KB 4508614.

Data replication of new disk added

Azure Site Recovery introduced the ability to enable replication of data disks, only if managed type, that are added to a Azure VM, that has already enabled the ability to make disaster recovery.

New support limits for the Mobility service for DR scenarios of VMware VMs and physical servers

Azure Site Recovery is now able to support up to five GPT partitions on UEFI, when you use the Mobility service for disaster recovery scenarios of VMware VMs and physical servers.

Using an existing automation account for automatic updates of Mobility service

When you set up automatic updates of the Azure Site Recovery Mobility service extension running on Azure VMs enabled for disaster recovery scenarios, introduced the ability to select an existing automation account to use, instead of using the default created by Site Recovery.

Azure Backup

Support for SQL Server 2008 and 2008 R2 on VMs in Azure

The 9 July 2019 officially ends support for SQL Server 2008 and 2008 R2 and thanks to the Microsoft approach, which guarantees other 3 years of security updates if migrated to Azure environment, many customers are proceeding with its migration. In the event you choose to move the SQL Server on-premises, in a VM in Azure environment, is appropriate to manage the backup and for this reason, Microsoft has decided to introduce in Azure Backup the support (at the time public preview) of SQL Server 2008 and SQL Server 2008 R2 from Windows 2008 R2 SP1.

System Center Configuration Manager

New release for the Technical Preview Branch

For Configuration Manager was released the update 1906 that among the main innovations provides the ability to specify a user category as a filter in the applications that are on the Software Center page.

To verify the details about what's new in this update you can see this document.

Please note that the releases in Technical Preview Branch help you to evaluate the new features of SCCM and it is recommended to apply these updates only in test environments.

System Center Updates Publisher

Announced the availability of System Center Updates Publisher preview (SCUP) June 2019.

Evaluation of Azure and System Center

To test and evaluate free of charge the service offered by Azure you can access this page, while to try out the various components of System Center you must Access to theEvaluation Center and, after registering, you can start the trial period.

Azure IaaS and Azure Stack: announcements and updates (June 2019 – Weeks: 25 and 26)

Azure

General availability of Azure Premium Files

Premium Files is a new performance tier for Azure Files and is designed for IO intensive workloads with low latency and higher throughput requirements. Premium tier provides 20x capacity, 100x IOPS, and 170x throughput as compared to the existing standard tier. Premium Files stores data on the latest Solid-State Drives (SSDs), which makes it suitable for wide variety of workloads like file services, databases, persistent storage for containers, content and collaboration repositories, analytics, home directories, high variable and batch workloads, among many others.

Azure Bastion Public Preview

Azure Bastion enables more secure and seamless RDP and SSH access to Azure Virtual machines directly in the portal (over port 443) without the need of any public IP on the virtual machine. Additional details are available on the Azure Bastion product page, and Azure Bastion product documentation page.

Azure Firewall: public preview for multiple public IPs and Availability Zones

Azure Firewall now supports multiple public IPs and availability zones in public preview using PowerShell and templates:

Just-in-time access supports Azure Firewall

When a user requests access to a VM with a JIT policy, Security Center first checks that the user has Role-Based Access Control (RBAC) permissions to request access to a VM with a JIT policy. If the user has permissions and the request is approved, Security Center automatically configures the NSG and the Azure Firewall rules to allow inbound traffic.

ExpressRoute supports up to 4 circuits from the same peering location into the VNet

ExpressRoute now supports up to 4 circuits from a single peering location connected to an ExpressRoute virtual network gateway, which was previously limited to a single circuit in a peering location. This is generally available in Azure Public.

Preview Refresh for Azure DNS Private Zones

Announced the Refresh release for Azure DNS private zones (preview). The Preview Refresh introduces new functionality and lifts several restrictions that public preview had.

Availability of Microsoft cloud datacenter regions in the Middle East

Microsoft Azure and Office 365 are now generally available from datacenter regions in the United Arab Emirates (UAE), with plans for Dynamics 365 and Power Platform to be available by the end of 2019.

VM Health feature now supports new OS’ and is available in new regions

VM Health feature now supports new OS’ and is available in new regions

VM Health feature included in Azure monitor for VMs is now available for VMs that are running on Windows 2012 R2 and 2019. Additionally, VM Health feature is also available in cases where the associated workspace is in SEA (South East Asia), UKS (UK South), and CCAN (Canada Central) regions.

Public preview of monitoring VM scale sets

Public preview of monitoring Windows and Linux VM scale sets from within the scale set resource blade.

Update rollup for Azure File Sync Agent

An update rollup for the Azure File Sync agent was released.

Improvements and issues that are fixed:

Accessing or browsing a server endpoint location over SMB is slow on Windows Server 2012 R2.
Increased CPU utilization after installing the Azure File Sync v6 agent.
Cloud tiering telemetry improvements.

More information about this update rollup:

This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
The agent version of this update rollup is 6.3.0.0.
A restart may be required if files are in use during the update rollup installation.
Installation instructions are documented in KB4489739.

M-series VMs are available in the South Africa North region

Azure M-series VMs are now available in the US South Central region. M-series VMs offer configurations with memory from 192 GB to 3.8TiB (4TB) RAM and are certified for SAP HANA.

GPU Optimized Visualization VMs now available in new regions

NVv3-Series VMs are now available in South Central US, West US, West Europe and North Europe Azure regions.

Azure Stack

Azure Stack update

This update includes new improvements, and fixes for Azure Stack. This article describes the contents of the 1906 update package.

Azure Networking: all you should know about the new Application Gateway

The Application Gateway is the offer for application delivery controller as-a-service present in Azure that enables customers to make the application republishing, with integrated layer-7 load balancing, Security and Web Application Firewall (WAF). Microsoft recently announced the availability of a fully revised version of Azure Application Gateway and its Web Application Firewall module (WAF). This article lists the improvements and additional features that are present in the new SKUs, calls respectively Standard_v2 and WAF_v2.

Enhancements and new features

The following section shows the areas where the new Azure Application Gateway version has made improvements and additional features.

Figure 1 - Diagram with the new features of SKU V2

Scalability

The new version of Azure Application Gateway allows you to automatically perform a scale-up or a scale-down of the number of instances to use, based on traffic detected towards the applications republished. In this way the size of the Application Gateway will always be suitable to support the necessary traffic and will not be more appropriate sizing this component to maximum capacity to sustain moments with traffic spikes. Consequently, with this feature you can get significant cost savings in scenarios where there are workloads that do not have a homogeneous flow, but subject to change.

Zone redundancy

In the new SKU it is possible to do the deployment of the Application Gateway in different areas of availability (availability zone) so as not to be subject to disruptions in the event of problems related to the single zone of Azure. This method of deployment allows increasing the resilience of published applications.

Public Static IP Assignment

The Virtual IP Address assigned to the Application Gateway can be static, thus ensuring a constant IP address assignment for the lifetime of the component. This feature is particularly useful for managing rules on Azure external firewall systems and for web publishing scenarios of Azure Web App.

Header Rewrite

Header Rewrite functionality allows you to easily manage the publications of applications as it is allowed to add, remove or modify HTTP request and response headers, directly from the Application Gateway and without needing to change the code of the application.

Performance

The adoption of the new Application Gateway SKU allows a significant improvement in performance during the provisioning and during the configuration update activities. Furthermore, it shows an improvement in performance, up to 5 times higher than the previous SKU, in SSL offloading scenarios.

The recommendation

For all new implementations is raccomanded to consider the adoption of the new Azure Application Gateway SKU, while for those who are making application publications by Application Gateway V1, it is recommended that you migrate the SKU V2 quickly, for the following reasons:

New features and improvements: Migrating to new SKU you can benefit from the improvements and new features listed above.
Cost: view the new pricing policy adopted for the SKU V2, based on consumption and no longer on the size and the number of instances, this may be generally more convenient than SKU V1. For more information on the costs of the new Azure Application Gateway version, you can see the relative costs page.
Platform support: soon Microsoft will disable the ability to create new Application Gateway V1. Furthermore, in the future, Microsoft will release additional new features, but most of these will be released exclusively for the SKU V2.

As migration occurs to the SKU V2

Currently the Azure platform does not provide an automatic procedure to migrate from V1 to V2 SKU, but it is necessary to proceed with a side-by-side migration. To proceed with this activity is necessary a suitable preliminary analysis to verify the presence of all the necessary requirements. The migration of existing configuration can be done through Special scripts of support, but may still be required manual activities. Completed the configuration of all settings to the new Azure Application Gateway V2 you need to redirect the flow of traffic coming from client to the new Application Delivery Service.

Conclusions

The introduction of the new features described above makes the offer of application delivery controller as-a-service available in Azure platform even more complete and functional, to the point of being highly competitive with other vendor solutions, long established on the market. To be constantly updated with the rapid evolution of the cloud is recommended to determine as soon as possible the transition to the new Application Gateway version in order to benefit from the advantages mentioned above.

Azure IaaS and Azure Stack: announcements and updates (June 2019 – Weeks: 23 and 24)

Azure

Web Application Firewall (WAF) for Azure Front Door service is generally available

Customers can use WAF to define security policies that allow, block, forward or rate limit access to their web applications delivered through Azure Front Door.

A WAF security policy may consist of an ordered list of custom rules and Azure managed pre-configured rulesets.
Custom rules are based on a combination of client IP addresses, geolocation, http parameters, request methods and size constraints.
The pre-configured default rule set can be enabled to protect your applications from OWASP top 10 threats.
New or updated WAF configurations are deployed globally within minutes, letting you respond quickly to changing attack patterns.
WAF for Azure Front Door is integrated with Azure Monitor and the logs can be accessed through an Azure storage account, Azure Event Hub or Azure Log Analytics.

DevTest Labs supports the Shared Image Gallery feature

It enables lab users to access images from a shared location while creating lab resources. It also helps you build structure and organization around your custom-managed VM images.

High-Performance Computing Virtual Machines are available in West US 2, East US

HC-series Virtual Machines, designed to provide supercomputer-grade performance and scalability with the best price-performance on the public cloud, are generally available in West US 2 and East US.

Azure File Sync is GA for Azure Government cloud

Azure File Sync is generally available for Azure Government cloud. Azure File Sync in Government Cloud can be used with the same v6 agent that a customer would use in public cloud. It is at feature parity with what’s available publicly.

Azure Shared Image Gallery are generally available

Shared Image Gallery provides a simple way to share your applications with others in your organization, within or across Azure Active Directory (AD) tenants and regions. This enables you to expedite regional expansion or DevOps processes and simplify your cross-region HA/DR setup.

Azure DevTest Labs: PowerShell module to simplify management of labs

You can now make use of Az.DevTestLabs, a PowerShell module to simplify the management of Azure DevTest Labs. It provides composable functions to create, query, update and delete labs, virtual machines, custom images and environments.

Advanced data security for SQL servers on IaaS

Advanced data security is now available for SQL Server on Azure Virtual Machines. Advanced data security for SQL Server on Azure Virtual Machines currently includes functionality for surfacing and mitigating potential database vulnerabilities and detecting anomalous activities that could indicate a threat to your server.

Adaptive Network Hardening in Security Center id generally available

Security Center learns the network traffic and connectivity patterns of Azure workloads and provides NSG rule recommendations, for Internet facing virtual machines. This helps our customer better configure their network access policies and limit their exposure to attacks.

Azure Application Gateway Web Application Firewall custom rules are Generally Available

Custom rules for WAF_v2 allow customers to create their own rules with IP/IP range or String based matching conditions. For example, customers will be able to create rules which block requests from a specific IP range, or those matching a specific regular expression in the request’s header/cookie/URI/queryString/form elements. Users can also join multiple matching conditions into a single custom rule. More details can be found here.

Update rollup for Azure File Sync Agent

Improvements and issues that are fixed

After creating a server endpoint, High CPU usage may occur when background recall is downloading files to the server.
Sync and cloud tiering operations may fail with error ECS_E_SERVER_CREDENTIAL_NEEDED due to token expiration.
Recalling a file may fail if the URL to download the file contains reserved characters.

More information about this update rollup:

This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
The agent version of this update rollup is 6.2.0.0.
A restart may be required if files are in use during the update rollup installation.
Installation instructions are documented in KB4489738.

Azure Stack HCI: introduction to the solution

The use of hyper-converged infrastructure in recent years has increased sharply and estimates from authoritative sources report that in the coming 12-18 months investing in solutions of this kind will be among the most significant for the modernization of datacenters, for about the 54% of the organizations. With the arrival of Windows Server 2019, Microsoft introduced the solution Azure Stack HCI, that can run virtual machines and easy connection to Azure with a hyper-converged infrastructure (HCI). This article lists the main features of the solution and its potential.

The trend that is emerging is the transition from a "three tier" traditional infrastructure, composed of network switches, appliance, physical systems with onboard hypervisors, storage fabric and SAN, toward hyper-converged infrastructure (HCI), where different hardware components are removed, substitutes by the "magic" of the software, able to combine the layer of compute, storage and network in one solution.

Figure 1 – "Three Tier" Infrastructure vs Hyper-Converged Infrastructure (HCI)

All this is made possible by the new operating system Windows Server 2019, that lets you use Hyper-V, a solid and reliable hypervisor, along with Software Defined Storage and Software-Defined Networking solutions. To this is added Windows Admin Center, that allows you to fully manage and with a graphical interface the hyper-converged environment. The whole is implemented on hardware specially validated by various vendors.

Figure 2 – Azure Stack HCI Solution overview

The positioning of the solution Azure Stack HCI is as follows, side-by-side with Azure and Azure Stack, but with specific and distinct purposes.

Figure 3 – Azure Family

Azure Stack HCI is an evolution of Windows Server Software-Defined solution (WSSD) available in the past with Windows Server 2016. Azure Stack HCI was inducted into the Azure family as it shares the same software-defined technologies used from Azure Stack.

Azure Stack HCI allows the execution of virtualized applications in the on-premises environment, on hardware tested and validated specifically. In order to get certified hardware is subjected to rigorous validation testing, that guarantee the reliability and stability of the solution. To consult the different solutions for Azure Stack HCI of the various hardware vendors you can access this page.

Figure 4 – Azure Stack HCI solutions hardware partners

Proper hardware sizing is critical to achieving the desired results in terms of performance and stability, Therefore, you should always use hardware solutions validated in a specific way and do not use hardware components assembled at will. This condition is also required to obtain a solution of Azure Stack HCI fully supported.

Through the use and support of the latest innovations in hardware devices, Azure Stack HCI enables you to achieve very high performance, much to achieve an important record of IOPS (-> 13.798.674) for the hyper-converged platforms, doubling the maximum performance that had been reached with Windows Server 2016.

Figure 5 - Hardware Innovations supported by Azure Stack HCI

The hyper-converged solution with Windows Server 2016 saw a big problem due to the fact that the configuration and management of the environment had to be made predominantly from the command line.

Thanks to the introduction of Windows Admin Center you have the ability to manage and control hyper-converged environment totally via web interface. Furthermore, many vendors of hardware solutions provide the Windows Admin Center extensions to enhance the management capabilities.

The following video shows the management of a hyper-converged environment from Windows Admin Center:

In software-defined storage, the Storage Space Direct technology allows you to take advantage of many features, making it a complete solution, reliable and secure.

Figure 6 – Features in software-defined storage scope

In Windows Server 2019 important improvements have been made in the field of data deduplication and compression that allow you to have a higher quantity of usable storage space.

Figure 7 – Possible disk space savings using deduplication and compression

This configuration can be achieved very easily directly from Windows Admin Center.

Figure 8 – Enabling deduplication and compression from Windows Admin Center

Azure Stack HCI can be used for smaller environments with two nodes and can scale up to a maximum of 16 nodes.

Figure 9 -Scalability of the solution

In the presence of clusters composed by exactly two nodes Windows Server 2019 you can use the Nested resiliency, a new feature in Storage Spaces Direct, introduced in Windows Server 2019, that allows you to support more faults at the same time without losing access to storage.

Figure 10 - Hardware Fault supported

Using this feature you will have a lower capacity than a classic two-way mirror, but you get better reliability, essential for hyper-converged infrastructure, exceeding the limit from previous versions of Windows Server in the presence of cluster environments with only two nodes . The nested resiliency brings together two new options in the resiliency, implemented in software and without the need for specific hardware:

Nested two-way mirror: on each server is used locally a two-way mirror, and an additional resiliency is ensured by a two-way mirror between the two servers. Actually it's a four-way mirror, where there are two copies of the data for each server.
Nested mirror-accelerated parity: mixes two-way mirror, described above, with the nested parity.

Figure 11 – Nested two-way mirror + Nested mirror-accelerated parity

Azure Stack HCI connects on-premises resources to public cloud Azure to extend the feature set, a totally different approach from Azure Stack, that allows you to adopt the Azure services on-premises, getting a totally consistent experience to the public cloud, but with resources that are located in your datacenter.

Figure 12 – Hybrid approach: Azure Stack vs Azure Stack HCI

The ability to connect Azure Stack HCI with Azure services to obtain a hybrid hyper-converged solution is an important added value that differs strongly from other competitors. Also in this case the integration can be done directly from Windows Admin Center to enjoy the following services Azure:

Azure Site Recovery to implement disaster recovery scenarios.
Azure Monitor to monitor, in a centralized way, what happens at the application level, on the network and in its hyper-converged infrastructure, with advanced analysis using artificial intelligence.
Cloud Witness to use Azure storage account as cluster quorum.
Azure Backup for offsite protection of your infrastructure.
Azure Update Management to make an assessment of the missing updates and proceed with its distribution, for both Windows and Linux systems, regardless of their location, Azure or on-premises.
Azure Network Adapter to easily connect on-premises resources with the VMs in Azure via a point-to-site VPN.
Azure Security Center for monitoring and detecting security threats in virtual machines.

Figure 13 – Windows Azure hybrid Integration services from Admin Center

Conclusions

Microsoft has made significant investments to develop, improve and make its own proposition for hyper-converged scenarios more reliable and efficient. Azure Stack HCI is now a mature solution, that exceeds the limits of previous Windows Server Software-Defined solution (WSSD) and incorporates everything you need to create a hyper-converged environment into a single product and a single license: Windows Server 2019. The ability to connect remotely Azure Stack HCI to various Azure services also make it an even more complete and functional solution.

Azure management services and System Center: What's New in May 2019

To stay up to date on news about Azure management services and System Center, our community releases this monthly summary, allowing you to have an overview of the main new features of the month. In this article you will find the news, presented in a synthetic way and accompanied with the necessary references to be able to conduct further studies.

Azure Log Analytics

New version Agent for Linux systems

This month the new agent version of Log Analytics for Linux systems introduces improvements concerning the stability and reliability. For more information about this, you can access the GitHub official page.

Availability in new regions

The availability of Azure Log Analytics has been extended for another five new regions: Central US, East US 2, East Asia, West US and South Central US.

Azure Site Recovery

Improvements in the monitor of VMware and physical systems

In the replication scenario of VMware systems and physical machines , the role Process Server acts as replication gateway, then receives replication data, performs an optimization through caching and compression mechanisms, provides encryption and sends them to the storage in the Azure environment. This role is also responsible to make the discovery of virtual machines on VMware systems. There are several factors that may impact on the smooth functioning of this component: high data change rate (churn), network connectivity, bandwidth availability, undersizing of the computing capacity required. In ASR were added different States of health that facilitate troubleshooting for this component. For each alert is also proposed corrective action deemed necessary, in order to better manage this role, essential for the proper functioning of the replication process.

Azure Backup

Network Security Group service tags for Azure Backup

Microsoft announced the ability to use within the Network Security Groups (NSGs) the service tag for Azure Backup. Using the tag AzureBackup it is possible to allow in the NSG outbound access to the Azure Backup service, so you can protect your workloads (SQL Server) on board of the virtual machines, instead of having to manage a whithelist that contains the IP addresses of the service. This is useful, in addition in the presence of the SQL Server workloads to be protected, also to make VM backup via MARS agent.

System Center Configuration Manager

New release for the Technical Preview Branch

For Configuration Manager was released the update 1905 that among the main innovations provides the ability to create application groups to be sent to collection of users or devices into a single deployment. The applications in the group can be installed with a specific order and the group will be displayed in Software Center as a single entity (suite of products).

To verify the details about what's new in this update you can see this document.

Please note that the Technical Preview Branch releases help you to evaluate new features of SCCM and it is recommended to apply these updates only in test environments.

Evaluation of Azure and System Center

To test and evaluate free of charge the services offered by Azure you can access this page, while to try the various System Center components you must access theEvaluation Center and, after registering, you can start the trial period.

Azure IaaS and Azure Stack: announcements and updates (June 2019 – Weeks: 21 and 22)

Azure

Generation 2 virtual machines in Azure in Public Preview

Generation 2 virtual machines use the new UEFI-based boot architecture vs. the BIOS-based architecture used by Generation 1 VMs. The new architecture enables customers to:

Build large virtual machines (up to 12TB)
Provision OS disks sizes that exceed 2TB, and
Leverage advanced security capabilities like SecureBoot and Virtual Trusted Platform Module (vTPM) to secure their Virtual Machines.

If you want to take advantage of these features, you can now create Generation 2 virtual machines in Azure. For a complete list of capabilities, limitations and details associated with the deployment of Generation 2 virtual machines on Azure, please refer to this documentation.

Azure DDoS Protection Standard introduces DDoS Alert integration with Azure Security Center

DDoS Protection Standard customers can view DDoS Alerts in Azure Security Center (ASC) and this capability is generally available for all ASC and DDoS Standard customers. These DDoS alerts will be available for review in the Security Center in near real-time without any setup or manual integrations required and will provide details on DDoS attacks detected and automatically mitigated by the service.

General availability of Azure NetApp Files

Azure NetApp Files, the industry’s first bare-metal cloud file storage and data management service, is general availability (GA). Azure NetApp Files is an Azure first-party service for migrating and running the most demanding enterprise file-workloads in the cloud including databases, SAP, and high-performance computing applications with no code changes. Azure NetApp Files is a fully managed cloud service with full Azure portal integration. It’s sold and supported exclusively by Microsoft. Customers can seamlessly migrate and run applications in the cloud without worrying about procuring or managing storage infrastructure. Additionally, customers can purchase Azure NetApp Files and get support through existing Azure agreements, with no up-front or separate term agreement.

OpenVPN support in Azure VPN gateways

Microsoft announced the General Availability (GA) of OpenVPN protocol in Azure VPN gateways for P2S connectivity. Form more details you can read this article.

Azure Mv2 Virtual Machines are generally available

Azure Mv2-series virtual machines are hyper-threaded and feature Intel® Xeon® Platinum 8180M 2.5GHz (Skylake) processor, offering up to 208 vCPU in 3TB and 6 TB memory configurations. Mv2 virtual machines provide unparalleled computational performance to support large in-memory databases and workloads such as SAP HANA and SQL Hekaton. Mv2-series VMs are certified by SAP for SAP HANA OLTP and OLAP production workloads. Mv2 VMs are available in US East and US East 2 regions. Mv2 VMs in U.S. West 2, Europe West, Europe North and Southeast Asia regions will become available in the coming months.

Azure Stack

Azure App Service on Azure Stack 1.6 (Update 6) Released

This release updates the resource provider and brings the following key capabilities and fixes:

Updates to App Service Tenant, Admin, Functions portals and Kudu tools. Consistent with Azure Stack Portal SDK version.
Updates to Kudu tools to resolve issues with styling and functionality for customers operating disconnected Azure Stack.
Updates to core service to improve reliability and error messaging enabling easier diagnosis of common issues.

All other fixes and updates are detailed in the App Service on Azure Stack Update Six Release Notes. The App Service on Azure Stack Update 6 build number is 82.0.1.50.