Fundamentals AZ-900 Microsoft Azure - SoftwareArchitect.ca

1 AZ-900 Microsoft Azure FundamentalsScott Duffy, Instructor 2019 Scott Duffy, get the course for these slides at: Azure Fundamentals foundational level knowledge of cloud services and how those services are provided with Microsoft Azure Microsoft Azure Fundamentals Candidates with non-technical backgrounds Candidates with a technical background who have a need to validate their foundational level knowledge around cloud servicesMicrosoft Azure Fundamentals Understand cloud concepts Understand core Azure services Understand security, privacy, compliance and trust Understand Azure pricing and supportYou ll be prepared to take an pass the AZ-900 examBut you don t have to, if you just want to learn cloud conceptsWhat is the Cloud?The ability to rent computing resources - on demandWhat Computing Resources?

2 Virtual MachinesUnlimited StorageDatabasesQueuesContent Delivery NetworkBatch Processing JobsWhat Computing Resources?Big Data - HadoopMedia ServicesMachine LearningChat BotsCognitive Services1000+ Azure Service optionsUnderstand Cloud Concepts (15-20%)High AvailabilityExpressed as a percentage, it s the ability of a system to respond to nines, 4 minutes per monthScalabilityThe ability of a system to handle growth of users or workMax capacityNumber of concurrent usersApp failureElasticityThe ability of a system to automatically grow and shrink based on application demandUserdemandcapacityAgilityThe ability to change rapidly based on changes to market or environmentFault ToleranceThe ability of a system to handle faults like power, networking, or hardware failuresDisaster RecoveryThe ability of a system to recover from failure within a period of time.

3 And how much data is lostEconomies of ScaleIt s cheaper for Microsoft to run a server than you can ever achieve yourselfCapital Expenditure (CapEx) and Operational Expenditure (OpEx)CapEx is money invested in assets (like computers) that return investment over timeOpEx is money spent every day on operating expenses Consumption-Based ModelPay per minutePay per hourPay per executionInfrastructure-as-a- Service (IaaS)Virtual machines, networking, load balancers, firewallsPlatform-as-a-Service (PaaS)Upload code packages and have them run, without access to the hardwareSoftware-as-a-Service (SaaS)Access to configuration onlyCompare and ContrastPublic cloudComputing services offered over the public Internet; anyone can sign upPrivate cloudComputing services offered to only select users; internal or corporate cloudHybrid cloudCombination of public and private clouds.

4 Scale private infrastructure to the cloudCompare and ContrastPublic vs private vs hybridAZ-900 Microsoft Azure FundamentalsScott Duffy, Instructor 2019 Scott Duffy, get the course for these slides at: Core Azure Services (30-35%)Regions54 Regions - not all accessible by everyoneAvailability ZonesResource GroupsAzure Resource Manager (ARM)Core Azure architectural componentsComputeVirtual MachinesVirtual Machine Scale SetsApp Service FunctionsNetworking Virtual NetworkLoad BalancerVPN GatewayApplication Gateway Content Delivery NetworkStorage Azure Storage - Blob, File, Table, QueueManaged DiskBackup and Recovery StorageDatabases Cosmos DBAzure SQL DatabaseAzure Database Migration serviceAzure SQL Data WarehouseAzure MarketplaceInternet of Things (IoT)IoT FundamentalsIoT Hub IoT CentralBig Data and AnalyticsSQL Data WarehouseHDInsight Data Lake AnalyticsArtificial Intelligence (AI)

5 Azure Machine Learning Service StudioServerless Azure FunctionsLogic Apps App gridAzure ToolsAzure CLIP owerShellAzure PortalAzure AdvisorAZ-900 Microsoft Azure FundamentalsScott Duffy, Instructor 2019 Scott Duffy, get the course for these slides at: Security, Privacy, Compliance, and Trust (25-30%) Azure FirewallAzure DDoS ProtectionNetwork Security Group (NSG)Choose an appropriate Azure security solutionAll virtual network subnets should use NSGIt s a strong lock on windows and doors that you don t useDDoS - as needed or after attackedApplication Gateway with WAFS ecurity through layersThe difference between Authentication and AuthorizationAuthentication is a user proving who they are - user id and passwordAuthorization is ensuring that a user is permitted to perform an action Move away from all authenticated users having admin accessAzure Active DirectoryIdentity as a service(IDaaS)

6 Microsoft s preferred solution for identity managementComplete solution for managing users, groups, rolesSingle-sign onSynchronize with your corporate ADAzure Multi-Factor AuthenticationFirst factor is your user id - might be easy to guessSecond factor is your password - hopefully hard to guess(Also hopefully unique)Third factor is that you have your phone on youSMS, authenticator app, phone callAzure SecurityPhysical vs digital securityShared security modelAzure ADMFARole-Based Access Control (RBAC)Layered approachSecurity Layers Data - virtual network endpoint Application - API Management Compute - Limit Remote Desktop access, Windows Update Network - NSG, use of subnets, deny by default Perimeter - DDoS, firewalls Identity & access - Azure AD Physical - Door locks and key cardsAzure Security Center usage scenariosUnified security management and advanced threat protectionFree tier and Standard tierKey VaultCentral, secure repository for your secrets, certificates and keysAzure Information Protection (AIP)Apply labels to emails and Confidential, Super Confidential, Top SecretUsed to protect documents from being viewed, printed and/or sharedAzure Advanced Threat Protection (ATP)

7 Monitor and profile user behavior and activitiesProtect user identities and reduce the attack surfaceIdentify suspicious activities and advanced attacksInvestigate alerts and user activitiesAzure PolicyGovernanceCreate rules across all of your Azure resourcesEvaluate compliance to those rulesExamples of Built-In Policies Require SQL Server Allowed Storage Account SKUs Allowed Locations Allowed Virtual Machine SKUs Apply tag and its default value Not allowed resource typesCan create custom policies using JSON definitionPolicy InitiativesA set of policies, grouped together Every resource and resource group must have these five tags. 10 policies that need to be enforcedGrouped together as a policy initiativeRole-Based Access Control (RBAC) Microsoft recommended solution for access controlCreate roles that represent the common tasks of the jobAccountantDeveloperBusiness LeadAssign granular permissions to that roleAssign users to that roleDo not assign granular permissions to an individualReaderContributorOwnerLocksRea d OnlyCan Not DeleteUsing RBAC, you can restrict who has access to locksAzure Advisor security assistanceAzure MonitorAzure Service HealthAzure Monitor vs Azure Service HealthAzure Monitor collects all the data for you to analyze and create alerts onSpecific to your application, your actionsAzure Service Health are general alerts across all of AzureCompliance terms such as GDPR.

8 ISO and NISTMany different standards for technology across the worldMicrosoft claims to be in compliance with many of themAnd has tools to help you be in compliance with othersGeneral Data Protection Regulation (GDPR)GDPR is a new set of rules designed to give EU citizens more control over their personal dataAffects companies outside of the EU that handle EU citizen s dataData has to be collected legally under strict conditionsData has to be protected misuseReporting obligations is data is mishandledISO - International Organization for StandardizationISO 9001:2015 is for Quality Management Systems (QMS)ISO/IEC 20000-1:2011 is for Service Management Systems (SMS)NIST Cybersecurity Framework (CSF)National Institute of Standards and Technology (NIST)Audited for compliance to security and privacy processesMicrosoft Privacy Trust Managerworkflow-based risk assessment tool.

9 To help you manage regulatory complianceAzure Government servicesSeparate accountFor US government agencies - federal, state and localDepartment of Defence (DoD) has its own tooIsolated data centers separate from the Azure public cloudMeets standards specific to governmentFedRAMP, NIST (DIB), ITAR, IRS 1075, DoD L4, and URLs for connecting to storage, functions, Germany servicesSeparate accountData remains in GermanyStrictest EU data protectionGerman Data trusteeSTART HEREAZ-900 Microsoft Azure FundamentalsScott Duffy, Instructor 2019 Scott Duffy, get the course for these slides at: Azure Pricing and Support (25-30%) Azure SubscriptionSubscription is a billing unitUsers have access to one or more subscriptions, with different rolesAll resources consumed by a subscription will be billed to the ownerCan be used to organize resources into completely distinct accountsManagement groupsPurchasing Azure products and servicesPurchase from Microsoft Pay as you go Enterprise AgreementNegotiatedMinimum SpendAnnualCustom PricesPurchase from a Microsoft Partner Microsoft Cloud Solution Provider (CSP)

10 Azure Free $200 credit for the first 30 days12 months of free servicesSome services are always freeFactors affecting costsDifferent services are billed based on different factorsFree servicesFree servicesResource groupsVirtual network (up to 50)Load balancer (basic) Azure Active Directory (basic)Network security groupsFree-tier web apps (up to 10)Pay per usage (consumption model)Opportunity for cost savingsAzure Functions: 1 million executions free per month $ per million executions Cheapest virtual machine is $20 per monthPay per usage servicesFunctionsLogic AppsStorage (pay per GB)Outbound bandwidthCognitive Services APIPay for time (per second)Per second billing means billing stops when the VM is stopped *Stability in pricingPay a fixed price per month for computing power or storage capacityWhether you use it or notDiscounts for 1-year or 3-year commitment in VM (Reserved Instances)Multi-tenant or isolated environmentPay for bandwidthFirst 5 GB is freeInbound data is freeBandwidth costsOutbound data, $ to $ / GB for Zone 1 (NA and EU w/o Germany)Outbound data, $ to $ / GB for DE Zone 1 (Germany)