# Manage Azure Identities and Governance ### **1. Manage Azure Active Directory (Azure AD) Identities** #### **1.1 Users** ##### **1.1.1 Create, update, delete users in Azure AD** - **Create users**: You can create users using the **Azure portal**, **Azure CLI**, **PowerShell**, or via synchronization from an on-premises Active Directory. - Required fields include username, display name, password, usage location, and optionally a directory role. - **Portal steps**: 1. Go to `Azure Active Directory > Users > New user` 2. Fill in user details 3. Click **Create** - **Update users**: You can edit user attributes such as name, contact info, job title, group memberships, or roles. - **Delete users**: Deleted users go to the **“Deleted users”** container and remain recoverable for **30 days** (soft delete period). ##### **1.1.2 Assign user roles (e.g., User, Global Administrator)** - **Azure AD roles** control administrative privileges. - Common roles: - **Global Administrator**: Full permissions in Azure AD - **User Administrator**: Can manage users and groups - **Billing Administrator**: Can manage subscriptions and billing - **How to assign a role**: 1. Go to `Azure Active Directory > Users > Select the user` 2. Click `Assigned roles > Add assignment` 3. Choose a role, click **Add** ##### **1.1.3 Reset passwords manually and via self-service password reset (SSPR)** - **Manual reset by Admin**: - Done via Azure portal when a user forgets a password. - **Self-Service Password Reset (SSPR)**: - Allows users to reset their own passwords after verifying their identity. - **To enable SSPR**: 1. Go to `Azure AD > Password reset` 2. Enable for all or selected users 3. Configure authentication methods (email, phone, questions) #### **1.2 Groups** ##### **1.2.1 Create security and Microsoft 365 groups** - **Security groups**: Manage access to Azure resources - **Microsoft 365 groups**: Include shared mailbox, calendar, files (collaboration features) - **Create a group via portal**: 1. Navigate to `Azure AD > Groups > New group` 2. Choose: - Group type (Security / Microsoft 365) - Group name - Membership type (Assigned, Dynamic) 3. Click **Create** ##### **1.2.2 Manage group memberships (static and dynamic)** - **Assigned membership**: - Admins manually add/remove users or devices. - **Dynamic membership**: - Use rules based on user/device attributes to auto-assign membership. - Example rule: `user.department -eq "Finance"` adds all Finance users to the group. ##### **1.2.3 Configure group-based licensing** - Assign licenses (e.g., Microsoft 365, Azure AD Premium) to a group. - Azure automatically adds/removes licenses as users enter or exit the group. - **Steps**: 1. Go to `Azure AD > Groups > Select group` 2. Click `Licenses > Assignments` 3. Select and assign product licenses #### **1.3 Devices** ##### **1.3.1 Register and join devices to Azure AD** - **Azure AD registered**: - Personal, user-owned devices (usually mobile or BYOD). - **Azure AD joined**: - Organization-owned, directly joined to Azure AD and managed. - **Hybrid Azure AD joined**: - On-prem Active Directory devices that are also registered with Azure AD for hybrid environments. ##### **1.3.2 Manage device identities and access** - View and manage devices under `Azure AD > Devices`. - You can: - Enable/disable a device - Delete stale devices - Configure **device compliance policies** - Require **MFA** for device join - Apply **Conditional Access** policies (e.g., only compliant devices can access Teams or SharePoint) #### **1.4 Administrative Units (AUs)** ##### 1.4.1 What are Administrative Units? Administrative Units (AUs)** are **logical containers** in Azure AD that help **delegate administration** of subsets of users, groups, or devices to specific admins—without granting them rights over the entire directory. This is especially useful in **large organizations**, such as: - A university with different faculties - A company with multiple regional departments ##### **1.4.2 Use cases** - A Helpdesk admin in “New York” should manage only New York employees. - An IT admin in “Engineering” can reset passwords only for users in that department. ##### **1.4.3 Key concepts** - AUs contain **users, groups, and devices**. - You can assign **scoped roles** (like User Administrator) **only within an AU**. - A single user/device can be a member of multiple AUs. - AUs **do not affect access** or policies—**they only control administrative boundaries**. ##### **1.4.4 Creating and managing AUs** 1. Go to `Azure AD > Administrative units > + Add`. 2. Provide a name and description. 3. Add users or groups to the AU. 4. Assign **scoped admin roles** to users within that AU. #### **1.5 External Identities** ##### **1.5.1 What are External Identities?** Azure AD External Identities allow **users outside your organization** to **access your Azure resources or applications** securely. This feature enables **Business-to-Business (B2B)** and **Business-to-Consumer (B2C)** collaboration. - In AZ-104, we focus on **B2B guest collaboration**. ##### **1.5.2 B2B Guest Users** A **B2B guest user** is someone from another Azure AD tenant (or even a non-Microsoft account) who gets invited to your directory. ###### Key Features: - Guests use their **own credentials** (no need to manage their passwords). - They appear in your directory with **UserType = Guest**. - Access is controlled via **RBAC, groups, or Conditional Access**. ##### **1.5.3 How to Invite Guest Users** You can invite guests through: - **Azure Portal**: 1. Go to `Azure AD > Users > New guest user`. 2. Enter email and optional message. 3. Assign access as needed (e.g., to groups or apps). - **Microsoft Teams / SharePoint** (via sharing interface) - **PowerShell / B2B APIs** (for bulk invitation) ##### **1.5.4 Managing Guest Access** - Use **Access Reviews** to periodically check if guests still need access. - Apply **Conditional Access** policies (e.g., require MFA for guests). - Use **Terms of Use** for compliance (guest users must accept policies). - Restrict invitation rights (e.g., only admins can invite guests). ##### **1.5.5 External Collaboration Settings** Configure from: `Azure AD > External Identities > External collaboration settings` You can control: - Who can invite guests - Guest user permissions (e.g., limited access to directory) - Restrictions on domains (e.g., block certain email domains) ### **2. Manage Role-Based Access Control (RBAC)** RBAC (Role-Based Access Control) is the **core authorization mechanism** in Azure. It controls **who can perform what actions on which resources**. #### **2.1 Understand RBAC structure** ##### **2.1.1 What is RBAC?** RBAC is a **permission model** that allows administrators to: - Grant only the **minimum required permissions** to users, groups, service principals, or managed identities. - Control **actions like read, write, delete** on specific Azure resources. RBAC = **Security Principal** + **Role Definition** + **Scope** ##### **2.1.2 RBAC Core Concepts** - **Security Principal**: The identity receiving permissions. - Examples: A user, a group, a service principal (for apps), or a managed identity. - **Role Definition**: A set of permissions grouped into a role. - Examples: `Reader`, `Contributor`, `Owner`, or a **custom role**. - **Scope**: The level at which permissions apply. - **Management group** - **Subscription** - **Resource group** - **Resource** **Scopes are hierarchical**: Assigning a role at the subscription level means all resource groups and resources under that subscription inherit the role. ##### **2.1.3 Common Built-in Roles** | Role | Description | | ----------------------------- | ----------------------------------------------------------- | | **Owner** | Full access to everything, including RBAC | | **Contributor** | Full access to manage resources, but **can’t assign roles** | | **Reader** | **Read-only** access to resources | | **User Access Administrator** | Can manage RBAC assignments, but not resources themselves | #### **2.2 Assign roles** ##### **2.2.1 How to assign a role** You can assign roles using: - **Azure Portal** - **Azure CLI** - **Azure PowerShell** - **ARM templates** ##### **2.2.2 Assign a role in the Azure Portal** 1. Navigate to the **resource**, **resource group**, or **subscription**. 2. Click **Access control (IAM)** in the left menu. 3. Click the **Role assignments** tab, then click **+ Add > Add role assignment**. 4. Select: - Role (e.g., Reader) - User, group, or service principal - Scope 5. Click **Save**. ##### **2.2.3 Assign a role using Azure CLI** Example: ```bash az role assignment create --assignee \ --role "Contributor" \ --scope "/subscriptions//resourceGroups/" ``` ##### **2.2.4 Scoping Best Practices** - Assign roles at the **lowest possible scope** needed. - Prefer assigning at **resource** or **resource group** level, not entire subscriptions. - Use **groups** instead of assigning roles to individuals. - Regularly **review and audit** role assignments. #### **2.3 Custom roles** ##### **2.3.1 What are Custom Roles?** If no built-in role matches your exact needs, you can define your own **custom role**. A custom role is defined in a **JSON** file and includes: - Allowed `Actions` - Optional `NotActions` - `AssignableScopes` where the role is valid ##### **2.3.2 Example: Custom Read-Only Role for Storage** ```json { "Name": "Storage Read Only", "IsCustom": true, "Description": "Can read storage accounts.", "Actions": [ "Microsoft.Storage/storageAccounts/read" ], "NotActions": [], "AssignableScopes": [ "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" ] } ``` You can create this custom role using PowerShell or Azure CLI. ##### **2.3.3 Best Practices** - Follow the **Principle of Least Privilege**: grant only the minimum permissions required. - Avoid assigning **Owner** role unless absolutely necessary. - Perform regular audits using: - **Azure Activity Logs** - **Access Reviews** (if using Azure AD Premium P2) ### **3. Manage Subscriptions and Governance** Azure provides tools to help you organize resources, manage access, enforce policies, and control costs across your environment. This section explains how. #### **3.1 Azure Subscriptions** ##### **3.1.1 Create and manage subscriptions** - A **subscription** is an agreement with Microsoft to use Azure services, tied to a billing account. - Each subscription has: - **Unique ID** - **Billing scope** - **Quota limits** (number of VMs, storage capacity, etc.) You can have multiple subscriptions for: - **Different departments or projects** - **Separation of environments** (Dev/Test/Prod) - **Different billing or regulatory needs** Subscriptions can be created through: - Azure portal (by billing administrator) - Microsoft 365 admin center (if using Microsoft Customer Agreement) - Azure CLI / PowerShell for enterprise accounts ##### **3.1.2 Assign users to subscription roles** Roles like **Owner**, **Contributor**, or **Reader** can be assigned at the subscription level to control who can manage resources within that subscription. Example: Assign the “Contributor” role to the DevOps team at the subscription level so they can manage all resources inside it. ##### **3.1.3 Rename, move, or cancel subscriptions** - You can **rename** subscriptions for clarity (e.g., "Marketing Dev Subscription"). - **Move resources** between subscriptions if needed (must meet move conditions). - **Cancel** subscriptions if they are no longer needed (possible through the portal or billing portal). #### **3.2 Management Groups** ##### **3.2.1 What are Management Groups?** Management groups help you **organize multiple Azure subscriptions** into a hierarchy. Use cases: - Apply policies across many subscriptions - Group subscriptions by **department, region, or environment** - Apply **RBAC and Azure Policy** at the management group level Each management group: - Can contain **subscriptions or other management groups** - Can have **RBAC and policies applied**, inherited by children - Is structured in a **tree** format ##### **3.2.2 Example structure** ``` Root Management Group ├── CorpGroup │ ├── Sub-Marketing │ └── Sub-Sales ├── DevGroup │ └── Sub-DevOps ``` ##### **3.2.3 Key Points** - You must be assigned the **Management Group Contributor or Owner** role to create and manage them. - Use them to apply **governance at scale**. - The **root management group** is created automatically for each tenant (can be renamed). #### **3.3 Tags** ##### **3.3.1 What are Tags?** Tags are **key-value pairs** used to label and organize Azure resources for: - Cost management - Automation - Resource organization Example: ```plaintext Environment = Production Department = Finance Owner = John.Doe ``` ##### **3.3.2 How to apply tags** You can apply tags: - When creating a resource - After deployment using the portal, CLI, or PowerShell - Automatically using **Azure Policy** ##### **3.3.3 Best Practices** - Use consistent naming standards - Use automation tools like Azure Policy to **enforce tag requirements** - Use **tag-based billing reports** in Cost Management #### **3.4 Resource Locks** ##### **3.4.1 What are resource locks?** Resource locks **prevent accidental deletion or modification** of resources. There are two types: - **ReadOnly**: Can view but cannot update or delete. - **CanNotDelete**: Can update but not delete. ##### **3.4.2 Use cases** - Protect critical production resources (e.g., databases or storage accounts). - Prevent developers from deleting shared infrastructure by mistake. ##### **3.4.3 How to apply a lock** 1. Go to the **resource** or **resource group**. 2. Click **Locks** in the left menu. 3. Click **+ Add**, choose the type, and provide a name. #### **3.5 Azure Policy** ##### **3.5.1 What is Azure Policy?** Azure Policy is a governance tool that helps you **enforce rules and effects** over your Azure resources, ensuring they **comply with your organization’s standards**. It allows you to: - Control **what can or cannot be deployed** - Audit existing resources for **non-compliance** - **Automatically remediate** non-compliant resources ##### **3.5.2 Key Terms** | Term | Description | | --------------------- | ------------------------------------------------------------------------------- | | **Policy definition** | A rule stating what is allowed or denied (e.g., only specific VM sizes allowed) | | **Policy assignment** | Attaches a policy to a scope (resource group, subscription, etc.) | | **Parameters** | Values you can input when assigning a policy (e.g., allowed regions) | | **Initiative** | A collection of policies grouped together under one assignment | ##### **3.5.3 Common Policy Examples** - Allow only specific Azure regions. - Enforce tagging rules (e.g., every resource must have `Department` tag). - Audit usage of public IPs. - Deny certain VM SKUs or storage SKUs. ##### **3.5.4 How to assign a policy** 1. Go to `Azure Policy` in the portal. 2. Select **Definitions** to view built-in policies. 3. Choose a policy and click **Assign**. 4. Select a **scope** (subscription, resource group, etc.). 5. Configure parameters (if applicable). 6. Click **Review + Create**. ##### **3.5.5 Azure Policy Effects** When defining a policy, you choose its **effect**, such as: - `Deny` – prevents resource creation or changes - `Audit` – logs non-compliant resources but doesn’t block them - `DeployIfNotExists` – deploys a resource if it doesn't exist - `Modify` – changes the resource configuration automatically #### **3.6 Azure Blueprints** ##### **3.6.1 What are Azure Blueprints?** Azure Blueprints are used to **package and deploy a set of governance components** together in one reusable bundle. A blueprint may include: - **Resource groups** - **Role assignments** - **Policy assignments** - **ARM templates** They’re ideal for: - Setting up **standardized environments** - Enforcing **compliance** across multiple subscriptions ##### **3.6.2 Use cases** - Deploy a **production environment** with: - NSG policies - Audit policies - Specific tags - Contributor access for operations team - Create **templates for new departments or projects** ##### **3.6.3 How it works** 1. **Create a blueprint**: Define what resources, policies, and RBAC should be included. 2. **Publish** the blueprint definition. 3. **Assign** it to a subscription or management group. Once assigned, Azure enforces the blueprint and tracks compliance. #### **3.7 Cost Management** ##### **3.7.1 View and analyze spending** Azure Cost Management + Billing helps you: - Track spending over time - Break down costs by subscription, resource group, service - Export data to Excel or Power BI Tip: Tag resources by department or project for **tag-based cost tracking**. ##### **3.7.2 Set budgets and alerts** You can define **budgets** for: - Subscriptions - Resource groups - Tags (e.g., Environment = Dev) Then set **alerts** to notify stakeholders when spending hits: - 50% - 75% - 100% of the budget ##### **3.7.3 Use Cost Analysis and Azure Advisor** - **Cost Analysis**: Visualize and explore spending by category. - **Azure Advisor**: Offers **cost-saving recommendations**, such as: - Rightsizing VMs - Deleting unused disks - Reserving resources for predictable workloads --- # Implement and Manage Storage ### **1. Secure Storage** #### **1.1 Encryption** Encryption ensures that data is unreadable to unauthorized users. In Azure Storage, encryption happens **by default**. ##### **1.1.1 Server-side encryption (SSE)** Server-side encryption means Azure encrypts your data **as it’s written to storage**, and decrypts it **when read**. There are **two main key management options**: ###### a. **Microsoft-managed keys (MMK)** - Default option (no setup required). - Microsoft controls and rotates the encryption keys. - Fully automatic and compliant with most standards (e.g., ISO, SOC, GDPR). ###### b. **Customer-managed keys (CMK)** - You manage your own keys using **Azure Key Vault**. - Gives you more control: - You can rotate keys manually. - You can revoke access to data by disabling the key. - Useful in regulated industries (finance, healthcare, etc.). ##### **1.1.2 Client-side encryption** - Here, **you encrypt data on the client** before uploading it to Azure Storage. - You manage your own encryption libraries and keys. - Used when you need **end-to-end control** or **extra protection** for sensitive data. - Example: Use a custom app to encrypt data using AES before uploading. #### **1.2 Access Control** Controlling **who can access what data** is essential for security. Azure offers several mechanisms: ##### **1.2.1 Shared Access Signatures (SAS)** SAS tokens let you grant **limited-time** and **permission-scoped** access to storage data. There are **three types**: | Type | Purpose | | ----------------------- | ------------------------------------------------------------------------- | | **User delegation SAS** | Uses **Azure AD credentials**, more secure, applies to Blob Storage | | **Service SAS** | Grants access to specific storage resources (like a blob, file, or table) | | **Account SAS** | Grants access at the **account level**, broader access than service SAS | SAS tokens are URLs with query parameters — shareable via code or email, **but should be treated like passwords**. ##### **1.2.2 Azure AD integration for storage authentication** - Azure Storage supports **Azure AD-based access** for Blob and Queue storage. - Benefits: - Centralized identity management. - Role-based access control (RBAC) applies. - Users must authenticate with Azure AD and be assigned roles like: - **Storage Blob Data Reader** - **Storage Blob Data Contributor** ##### **1.2.3 Storage access policies and permissions** - Access control can be done using: - **RBAC (via Azure AD)** — recommended for most secure scenarios. - **Access keys** — provide full admin-level access to a storage account (not recommended for sharing). - **SAS tokens** — provide scoped and temporary access. Best Practice: **Avoid sharing access keys**; prefer **SAS or Azure AD RBAC**. ##### **1.2.4 Firewall and virtual network rules** You can restrict storage account access to: - **Specific IP address ranges** - **Virtual networks (VNets)** and **subnets** Steps: 1. Go to the storage account in the portal. 2. Under **Networking**, choose `Selected networks`. 3. Add VNets or IP ranges allowed to access the account. Use **private endpoints** for **secure access over private IPs** within your VNet. ### **2. Manage Storage Accounts** #### **2.1 Types of Storage Accounts** Azure Storage accounts are **containers for your data services**, such as blobs, files, queues, and tables. Choosing the correct type affects pricing, performance, and available features. ##### **2.1.1 General-purpose v2 (GPv2) – Recommended** - Supports all storage types: **Blob, File, Queue, Table, and Disk** - Access tiers: **Hot, Cool, Archive** - Most feature-rich and cost-efficient for modern use cases - Supports all redundancy and performance options This is the **default and recommended** storage account type. ##### **2.1.2 General-purpose v1 (Legacy)** - **Older type**, limited features - No support for access tiers - Not recommended for new deployments ##### **2.1.3 Blob Storage Account (Legacy)** - Optimized for storing **only blobs** - Supports **Hot/Cool** access tiers - Rarely used now—GPv2 accounts include all Blob features and more ##### **2.1.4 Premium vs Standard Performance Tiers** | Tier | Use Case | Media | Notes | | ------------ | ---------------------- | ------------------- | ------------------------ | | **Standard** | General workloads | HDD/Standard SSD | Cost-effective | | **Premium** | High-performance needs | Premium SSD or NVMe | Low latency, higher IOPS | Examples: - Use **Premium** for workloads like databases or virtual machine disks. - Use **Standard** for logs, backups, documents. ##### **2.1.5 Access Tiers (for Blob Storage)** Control **how frequently your data is accessed**: | Tier | Use case | Pricing | | ----------- | ------------------------------------- | --------------------------------------------------------------------- | | **Hot** | Frequently accessed data | Higher storage cost, lower access cost | | **Cool** | Infrequently accessed data (≥30 days) | Lower storage cost, higher access cost | | **Archive** | Rarely accessed data (≥180 days) | Cheapest storage, highest access cost and delay (~hours to rehydrate) | You can **change tiers per blob** or **automatically with lifecycle rules**. #### **2.2 Replication** Replication determines **how your data is duplicated** for durability and high availability. ##### **Replication Options** | Type | Scope | Use Case | | ----------------------------------- | ----------------------------------------------------- | ------------------- | | **LRS (Locally Redundant Storage)** | 3 copies within one datacenter | Least expensive | | **ZRS (Zone-Redundant Storage)** | Across 3 availability zones in a region | Higher availability | | **GRS (Geo-Redundant Storage)** | Replicates to secondary region (read access disabled) | Disaster recovery | | **RA-GRS (Read-Access GRS)** | Like GRS, but with **read access** to secondary | Read during outages | | **GZRS (Geo+Zone Redundant)** | Across zones + replicated to another region | Max durability | | **RA-GZRS** | GZRS with **read access** to secondary | Premium option | Choose based on **criticality and budget**. #### **2.3 Configure Storage Settings** ##### **2.3.1 Network Settings** - **Public access**: Open to all networks (not recommended) - **Selected networks**: Allow only specific **IP ranges or VNets** - **Private endpoint**: Assigns a **private IP address** inside your VNet, ensures secure communication ##### **2.3.2 Custom Domain and TLS** - **Custom Domain**: Replace default `*.blob.core.windows.net` with your own domain (e.g., `storage.mycompany.com`) - **TLS Settings**: Enforce secure transfer (`https only`) to enhance security ##### **2.3.3 Lifecycle Management Rules** Used to **automate blob tiering and deletion** based on rules: - Move blobs to **Cool** after 30 days of no access - Move to **Archive** after 90 days - **Delete blobs** after 365 days Steps: 1. Go to `Storage Account > Data Management > Lifecycle Management` 2. Add a rule 3. Set filters (e.g., prefix or blob type) 4. Define actions and conditions ### **3. Manage Data in Azure Storage** This section is about **how you actually store, organize, access, and transfer data** in Azure using different storage services. #### **3.1 Blob Storage** Blob = **Binary Large Object** It is optimized for **massive unstructured data**, such as images, videos, backups, and logs. ##### **3.1.1 Blob types** | Blob Type | Description | Use Case | | --------------- | ------------------------------- | ------------------------------------------------------- | | **Block Blob** | Stores data in blocks | Most common; used for images, documents, backups | | **Append Blob** | Optimized for append operations | Ideal for logging; you can only add to the end | | **Page Blob** | Optimized for random read/write | Used for virtual hard disks (VHDs), like Azure VM disks | **Block blob** is the default and most widely used blob type. ##### **3.1.2 Upload, download, delete blobs** You can interact with blobs using: - **Azure Portal** (manual upload/download) - **AzCopy** (command-line tool) - **Azure CLI** or **PowerShell** - **SDKs and REST APIs** Supports operations like: - Uploading large files in blocks (resumable) - Deleting blobs individually or in batch - Versioning and snapshot support ##### **3.1.3 Configure containers, metadata, soft delete, versioning** - **Containers** are like folders inside a blob storage account. Each blob must belong to a container. - **Metadata**: Key-value pairs stored with each blob (e.g., owner = “finance”) - **Soft Delete**: Allows recovery of deleted blobs (like a recycle bin) - **Versioning**: Automatically stores past versions of a blob for rollback or recovery Enable these features from: `Storage Account > Data Protection` #### **3.2 File Shares** Azure Files provides **shared folders** in the cloud that you can mount via **SMB or NFS**. ##### **3.2.1 SMB and NFS protocol support** - **SMB (Server Message Block)**: Used by Windows clients; can map drives like `\\storageaccount.file.core.windows.net\share` - **NFS (Network File System)**: For Linux-based systems Azure File Shares support standard file operations and access control (NTFS ACLs on SMB shares) ##### **3.2.2 On-prem sync via Azure File Sync** Use **Azure File Sync** to: - Synchronize your **on-prem Windows Server** file shares with Azure Files - Enable cloud tiering: keep **frequently accessed files local**, others in the cloud - Create a **hybrid file server** model Setup involves: 1. Create a file share in Azure 2. Install **Azure File Sync agent** on your Windows Server 3. Register the server in Azure 4. Create a sync group and add endpoints ##### **3.2.3 Share snapshots and backups** - **Snapshots**: Point-in-time copies of a file share. Useful for recovery or auditing. - Can restore individual files or entire share to a previous state. - Snapshots don’t need extra tools — managed within the **Azure portal or CLI**. #### **3.3 Data Transfer Methods** Azure offers several options for **moving data in and out of Azure Storage**. ##### **3.3.1 AzCopy** - Command-line tool - Fast, efficient, resumable uploads/downloads - Example command: ```bash azcopy copy "file.txt" "https://.blob.core.windows.net/?" --recursive ``` ##### **3.3.2 Azure Storage Explorer** - **GUI tool** for Windows/macOS/Linux - Easy to manage blobs, tables, queues, and file shares - Great for non-developers or ad-hoc data tasks ##### **3.3.3 Azure Data Factory** - ETL tool used for **data integration and migration** - Supports moving data from: - On-prem SQL, Oracle - AWS S3, FTP - Other cloud storage ##### **3.3.4 Import/Export Service** - For **large-scale data transfer** (TBs to PBs) - Microsoft provides **encrypted disks** for physical shipping to/from Azure datacenters - Useful when network bandwidth is limited or expensive ##### **3.3.5 ADLS Gen2 hierarchical namespace** - Azure Data Lake Storage Gen2 supports a **file-system-like structure** with folders and access control - Hierarchical namespace enables: - Faster access to files - ACL-based security - Efficient big data analytics Ideal for use with **Azure Synapse**, **Databricks**, or **Hadoop** ### **4. Configure Azure Files and Azure Blob Storage** This section focuses on **advanced configurations**, **optimization features**, and **troubleshooting techniques** for Azure’s two core data storage services. #### **4.1 Azure File Sync Setup and Cloud Tiering** ##### **4.1.1 What is Azure File Sync?** Azure File Sync allows you to **synchronize** on-premises Windows file servers with **Azure Files**, creating a **hybrid cloud file system**. Benefits: - Centralized file management in Azure - Reduced on-prem storage usage with **cloud tiering** - Disaster recovery and data protection ##### **4.1.2 How to Set Up Azure File Sync** **Steps:** 1. Create an **Azure File Share** 2. Deploy **Azure File Sync Agent** on the Windows server 3. Register the server in **Azure Storage Sync Service** 4. Create a **sync group** in Azure 5. Add the Azure file share and on-prem path as **endpoints** File changes are **synchronized both ways** (cloud ↔ local) ##### **4.1.3 Cloud Tiering** - **Cloud tiering** saves space on the local server. - Frequently accessed files remain on-premises. - Other files become **stubs**, pulled from Azure on demand. Configuration settings: - Set a **volume free space threshold** (e.g., keep 20% of disk free) - File tiering is **automatic and policy-driven** #### **4.2 Implement Soft Delete for File Shares** Soft delete protects against accidental deletions. ##### **4.2.1 How it works** - When a file share is deleted, it is retained in the **"soft deleted" state** for a configurable number of days (up to 365). - You can **undelete** it during that retention window. ##### **4.2.2 Enabling Soft Delete** 1. Go to `Storage Account > Data Protection` 2. Enable **soft delete for file shares** 3. Set the **retention period** Can also be enabled for blobs and containers. #### **4.3 Monitor and Troubleshoot Access Issues** ##### **4.3.1 Diagnostic Logging** Enable **diagnostic logs** to track: - Access patterns - Errors - Latency and throughput Steps: 1. Go to `Storage Account > Diagnostic settings` 2. Choose logs to send to: - **Log Analytics** - **Event Hub** - **Storage account (for archiving)** ##### **4.3.2 Common Troubleshooting Scenarios** | Issue | Possible Cause | Solution | | ------------------- | -------------------------------- | ------------------------------------- | | Access denied (403) | Invalid SAS or RBAC permissions | Verify token or role | | Network timeout | Firewall or NSG blocking traffic | Check network settings | | Slow access | Too many concurrent requests | Scale up or optimize request patterns | | Sync delays | Agent offline or misconfigured | Restart sync agent and check status | Use **Azure Monitor**, **Metrics**, and **Activity Log** to investigate issues in real-time. ### **5. Implement Storage Security and Monitoring** This section focuses on **tracking usage**, **detecting threats**, and **monitoring the performance** and health of your Azure Storage resources. #### **5.1 Enable and Configure Diagnostic Logging** ##### **5.1.1 What is diagnostic logging?** Diagnostic logging provides detailed logs about: - Who accessed what - What operations were performed (read, write, delete) - Latency and request details Useful for **auditing, troubleshooting**, and **security forensics**. ##### **5.1.2 How to enable diagnostic logging** 1. Go to your **Storage Account > Monitoring > Diagnostic settings** 2. Click **+ Add diagnostic setting** 3. Choose what to log: - **Blob, File, Queue, Table** logs - Read, Write, Delete operations - Metrics (requests, errors, latency) 4. Choose where to send logs: - **Log Analytics** (for querying) - **Event Hub** (for streaming to SIEM tools) - **Storage account** (for long-term storage) You can enable **one or more destinations** at once. #### **5.2 Monitor Performance and Access Logs via Azure Monitor or Log Analytics** ##### **5.2.1 Azure Monitor** Azure Monitor provides: - **Built-in metrics** for storage accounts (e.g., total requests, egress, latency) - **Custom alerts** - **Charts and dashboards** Access from: `Storage Account > Monitoring > Metrics` Common metrics: - `TotalRequests` - `Availability` - `Egress / Ingress (data transfer)` - `SuccessServerLatency`, `SuccessE2ELatency` ##### **5.2.2 Log Analytics with Kusto Query Language (KQL)** Use **Log Analytics** to write powerful queries for diagnostics logs. Example: ```kusto StorageBlobLogs | where StatusCode == 403 | summarize count() by CallerIpAddress ``` Helps identify: - Unauthorized access attempts - IPs causing errors - Access trends over time #### **5.3 Set Up Alerts for Key Storage Events** Azure allows you to define **alerts** for any abnormal behavior. ##### **5.3.1 How to create alerts** 1. Go to `Storage Account > Monitoring > Alerts` 2. Click **+ New alert rule** 3. Define: - **Condition**: e.g., `TotalRequests > 10,000`, or `Availability < 99%` - **Scope**: specific storage account - **Action Group**: who to notify and how (email, SMS, webhook, etc.) Use **alert severity levels (0–4)** to classify urgency. ##### **5.3.2 Best Practices** - Set up **alerts on performance** thresholds to detect slowdowns - Alert on **error spikes (e.g., 403 or 500 errors)** - Create **security alerts** for suspicious IPs or denied requests - Combine alerts with **Log Analytics Workbooks** for visualization --- # Deploy and Manage Azure Compute Resources ### **1. Configure VMs for High Availability and Scalability** Azure provides several mechanisms to ensure that **virtual machines (VMs) stay available** and can **scale up or down** depending on demand. #### **Availability Options** ##### **1.1 Availability Sets** - Used to **distribute VMs across multiple fault domains and update domains** in a single Azure datacenter. - Protects against: - **Hardware failures** (fault domains) - **Planned maintenance updates** (update domains) - Ideal for **multiple-tier applications** needing high uptime. - A minimum of **two or more VMs** is required to gain the redundancy benefit. VMs in an availability set: - Are spread **across multiple physical racks** - Receive **rolling updates**, not all at once ##### **1.2 Availability Zones** - Provide **higher availability** than availability sets. - Azure regions are divided into **physically separate zones**, each with its own power, cooling, and networking. - You deploy VMs to **specific zones** (e.g., Zone 1, Zone 2, Zone 3). - If one zone fails, others can continue operating. Use cases: - **Mission-critical workloads** - **Low-latency replication** between zones ##### **1.3 VM Scale Sets (VMSS)** - Used to deploy and manage **a group of identical, auto-scaling VMs**. - Supports: - **Manual or automatic scaling** - Integration with **Azure Load Balancer** or **Application Gateway** - Benefits: - Built-in **load balancing** - Support for **custom images** - Rolling upgrades and health probes Perfect for stateless applications like web servers or batch jobs. ##### **1.4 Load Balancer Integration** - Azure Load Balancer distributes incoming traffic to VMs. - Use with: - **Availability Sets** to balance traffic across healthy VMs - **Availability Zones** to direct traffic to active zones Use **Basic or Standard Load Balancer** depending on scale/security needs. ### **2. Create and Configure VMs** This section covers **how to deploy virtual machines**, how to size and connect them, and how to extend their capabilities. #### **2.1 Deployment Methods** ##### **2.1.1 Azure Portal** - **GUI-based method** for beginners. - Walk-through wizard helps you configure: - Image (OS) - Size (SKU) - Disks - Networking - Management features - Best for **manual or one-time deployments**. ##### **2.1.2 Azure CLI (`az vm create`)** - Lightweight, scriptable option for **developers or DevOps engineers**. - Example: ```bash az vm create \ --resource-group MyRG \ --name MyVM \ --image UbuntuLTS \ --admin-username azureuser \ --generate-ssh-keys ``` ##### **2.1.3 Azure PowerShell** - Ideal for **Windows admins** comfortable with scripting in PowerShell. - Offers full control with scripting and loops. ##### **2.1.4 ARM Templates** - Infrastructure-as-Code using **JSON**. - Declarative: define what you want, not how. - Great for **repeatable and standardized** deployments. ##### **2.1.5 Terraform** - Open-source IaC tool, cloud-agnostic. - Preferred in **multi-cloud environments**. - Uses its own configuration language (`.tf` files). Best for DevOps teams managing **large, repeatable infrastructure setups**. #### **2.2 VM Sizing** ##### **2.2.1 Understand VM Series** Azure offers many VM sizes (SKUs), grouped by series: | Series | Use Case | | ------------ | --------------------------------------- | | **B-series** | Burstable, low-cost workloads | | **D-series** | General purpose, good for most apps | | **E-series** | Memory-intensive apps (databases) | | **F-series** | CPU-intensive tasks (gaming, analytics) | | **N-series** | GPU-intensive tasks (AI, ML, rendering) | Choose based on **workload profile** (CPU-bound, memory-bound, etc.) ##### **2.2.2 Resize VMs** - You can **resize a VM** if performance or cost needs change. - Limits: - Must **deallocate** VM first - Target size must be **available in the region and hardware cluster** Steps: 1. Go to `VM > Size > Resize` 2. Pick a new SKU 3. Restart VM if required #### **2.3 Storage Configuration** ##### **2.3.1 OS Disk and Data Disks** - **OS Disk**: Attached by default (contains Windows or Linux OS) - **Data Disks**: Optional; for storing app files, databases, logs - You can attach multiple data disks based on the VM size Disks are **managed** by Azure and come in various types (next section) ##### **2.3.2 Disk Types** | Type | Description | Use Case | | ---------------- | --------------------------- | ------------------------- | | **Standard HDD** | Low-cost, high-latency | Backup, infrequent access | | **Standard SSD** | Better performance than HDD | Web servers, dev/test | | **Premium SSD** | High performance | Production apps | | **Ultra Disk** | High IOPS and low latency | Databases, OLTP workloads | Choose based on performance needs and budget. ##### **2.3.3 Disk Encryption** - Azure uses **Azure Disk Encryption (ADE)** for encrypting VM disks. - For Windows: uses **BitLocker** - For Linux: uses **DM-Crypt** - You can choose: - **Microsoft-managed keys** - **Customer-managed keys** in Azure Key Vault Encryption is important for compliance and data protection. #### **2.4 Networking** ##### **2.4.1 IP Addressing** - **Dynamic IP**: Changes upon VM restart (default for most VMs) - **Static IP**: Stays fixed; useful for DNS or firewall rules ##### **2.4.2 NSGs (Network Security Groups)** - Used to control inbound and outbound traffic. - Rules define: - **Priority** - **Protocol** - **Source/destination** - **Port** - **Allow/Deny** Attach NSGs to: - **Subnets** (broader control) - **NICs** (per-VM control) ##### **2.4.3 VNets and Subnets** - All VMs must be deployed inside a **Virtual Network (VNet)**. - VNets are divided into **subnets**. - Subnets can host: - VMs - Gateways - App Services with VNet integration #### **2.5 VM Extensions** ##### **2.5.1 What Are Extensions?** Extensions are **small programs** that run inside a VM to perform tasks such as: - Post-deployment configuration - Monitoring - Security scanning ##### **2.5.2 Common Extensions** | Extension | Use | | --------------------------- | ------------------------------------------------ | | **Custom Script Extension** | Run PowerShell or shell scripts after deployment | | **Azure Monitor Agent** | Collect performance and diagnostic data | | **Diagnostics Extension** | Collects boot diagnostics and crash data | Use **extensions** to automate software installs, deploy agents, or register VMs with monitoring services. ### **3. Automate Deployment of VMs** Automation is essential for **consistency**, **scalability**, and **repeatability** in Azure environments. Azure offers several tools to automate the deployment of virtual machines. #### **3.1 ARM Templates** ##### **3.1.1 What are ARM Templates?** - **ARM (Azure Resource Manager) templates** are **JSON files** that define your infrastructure as code. - They allow you to **deploy and configure Azure resources declaratively**. ARM templates are ideal for: - Enforcing **consistent environments** across dev/test/prod - Deploying **entire applications or infrastructure stacks** ##### **3.1.2 Key Elements of an ARM Template** | Element | Description | | -------------- | ------------------------------------------------------------------ | | **Parameters** | Input values you can provide during deployment | | **Variables** | Reusable values, often derived from parameters | | **Resources** | Definitions of Azure services to deploy (e.g., VMs, NSGs, storage) | | **Outputs** | Return values after deployment (e.g., VM IP address) | ##### **3.1.3 Example: Simple VM Template Snippet** ```json "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2021-07-01", "name": "[parameters('vmName')]", "location": "[resourceGroup().location]", "properties": { "hardwareProfile": { "vmSize": "Standard_B2s" } } } ] ``` #### **3.2 Custom Script Extension** ##### **3.2.1 What is the Custom Script Extension?** - It allows you to **run scripts automatically** on a VM after it’s provisioned. - Scripts can: - Install software - Modify system settings - Perform configuration steps Very useful in **automated deployment pipelines**. ##### **3.2.2 Example Use Case** Install Apache on a Linux VM using a shell script: ```bash #!/bin/bash apt-get update apt-get install apache2 -y ``` Upload the script to Azure Storage and reference it in the extension: ```json "fileUris": ["https://.blob.core.windows.net/scripts/install-apache.sh"] ``` #### **3.3 Cloud-init** ##### **3.3.1 What is cloud-init?** - A **Linux-specific initialization tool** used for automating configuration during VM provisioning. - It uses **YAML syntax**. ##### **3.3.2 Use cases** - Create users - Set hostnames - Install packages - Configure network or SSH settings ##### **3.3.3 Example cloud-init config** ```yaml #cloud-config users: - name: azureuser groups: sudo shell: /bin/bash ssh-authorized-keys: - ssh-rsa AAAAB3NzaC... packages: - nginx runcmd: - systemctl start nginx ``` You pass this YAML file during VM creation via the **Azure Portal**, **CLI**, or **Terraform**. ### **4. Create and Configure Containers** Azure provides tools to run and manage **containers** without needing to manage virtual machines directly. This section introduces two key services: **Azure Container Instances (ACI)** and **Azure Kubernetes Service (AKS)**. #### **4.1 Azure Container Instances (ACI)** ##### **4.1.1 What is ACI?** Azure Container Instances allow you to **run containers directly in Azure** without provisioning or managing VMs. It’s a **serverless container service**, best for: - Running **single containers** or **simple applications** - Short-term or **batch jobs** - Testing and development ##### **4.1.2 Key Features** - Fast startup (containers launch in seconds) - Per-second billing - Supports **Linux and Windows containers** - Supports **public IPs**, **DNS**, **environment variables** ##### **4.1.3 How to deploy a container in ACI** **Using Azure CLI:** ```bash az container create \ --resource-group myResourceGroup \ --name myContainer \ --image mcr.microsoft.com/azuredocs/aci-helloworld \ --cpu 1 --memory 1 \ --dns-name-label myacilabel --ports 80 ``` This deploys a container running a basic web server, accessible via a DNS name. ##### **4.1.4 Networking Options** - **Public IP**: Exposes the container to the internet - **VNet Integration**: Runs container privately inside a **Virtual Network** (for secure internal access) #### **4.2 Azure Kubernetes Service (AKS) – Basic Knowledge** ##### **4.2.1 What is AKS?** AKS is a **managed Kubernetes service** in Azure. Kubernetes is an open-source platform for **orchestrating containers**. In AZ-104, you are **only expected to understand the basics**, not in-depth AKS operations. ##### **4.2.2 Key Concepts** | Concept | Description | | ------------------------ | ------------------------------------------------------ | | **Node pool** | A group of VMs (nodes) that run containerized apps | | **Scaling** | AKS can automatically scale node pools based on demand | | **Azure AD integration** | Use Azure AD for Kubernetes API authentication | | **Helm** | A package manager for Kubernetes apps | ##### **4.2.3 When to use AKS** - Complex, **multi-container** applications - Apps requiring **load balancing**, **auto-scaling**, **service discovery** - **Production workloads** with microservices architecture AKS is best when you need full control over container lifecycle and orchestration. ### **5. Create and Configure Web Apps** Azure provides **Platform as a Service (PaaS)** options for deploying and managing web applications with **minimal infrastructure management**. The primary service is **Azure App Service**. #### **5.1 Azure App Services** ##### **5.1.1 What is Azure App Service?** Azure App Service lets you **deploy web applications** and **APIs** without managing servers or virtual machines. Key features: - Fully managed infrastructure - Autoscaling and high availability - Continuous deployment support (GitHub, Azure DevOps, etc.) - Built-in monitoring and diagnostics ##### **5.1.2 Supported Languages** - **.NET / .NET Core** - **Node.js** - **Python** - **Java** - **PHP** - Also supports custom containers (Docker) ##### **5.1.3 Deployment Slots** - Used for **safe deployment and testing**. - You can create **multiple slots** like: - **Staging** - **Testing** - **Production** - You can **swap slots** to move new code into production with **no downtime**. #### **5.2 Configuration** ##### **5.2.1 App Settings and Connection Strings** - Define key/value pairs used by your app at runtime. - Used for: - App behavior customization - Connection strings to databases or storage - Environment variables are injected into the app runtime. You can set them from: `App Service > Configuration` ##### **5.2.2 Authentication and Authorization** - App Service integrates with **identity providers** like: - **Azure Active Directory** - **Google** - **Facebook** - **Twitter** This provides **secure user authentication** without writing custom login code. Steps: 1. Go to `App Service > Authentication` 2. Enable App Service Authentication 3. Choose your identity provider 4. Configure client IDs/secrets #### **5.3 Scaling** Azure App Services support **multiple scaling options**: ##### **5.3.1 Manual Scaling** - You manually increase or decrease the number of **instances** (servers) running your app. ##### **5.3.2 Autoscaling** - App Service can **automatically scale** based on: - CPU usage - Memory usage - HTTP queue length - Time schedule (e.g., scale up during business hours) Define **rules** under: `App Service Plan > Scale out (App Service Plan)` ##### **5.3.3 Pricing Tiers** | Tier | Features | | ----------------- | ------------------------------------------------------------------- | | **Free / Shared** | Test only; very limited resources | | **Basic** | Custom domains, SSL | | **Standard** | Autoscaling, backups | | **Premium** | Enhanced performance, VNet integration, more slots | | **Isolated** | Runs in a VNet for maximum security (App Service Environment - ASE) | #### **5.4 Monitoring and Backup** ##### **5.4.1 Diagnostics and Logs** - Enable **detailed error messages**, **HTTP logs**, and **App logs** for troubleshooting. - Use **Application Insights** for: - Performance tracking - Exception logging - Live metrics stream Enable from: `App Service > Monitoring > Diagnostics settings` ##### **5.4.2 Backup and Restore** - App Services support **automatic backups** (in Standard tier or higher). - You can back up: - Web app content - Database connections - Configuration settings Restore from backups through the portal if needed. --- # Implement and Manage Virtual Networking ### **1. Implement and Manage Virtual Networks (VNets)** Azure Virtual Network (VNet) is the **foundation of Azure networking**. It allows you to securely connect Azure resources to each other, to the internet, and to your on-premises environment. #### **1.1 VNet Fundamentals** ##### **1.1.1 Logical Isolation** - A VNet provides **logical isolation** in Azure—your own private network environment in the cloud. - Resources inside a VNet can **communicate privately**. ##### **1.1.2 Address Space (CIDR Notation)** - When you create a VNet, you define an address space using **CIDR format**, such as `10.0.0.0/16`. - This space is further divided into **subnets**. CIDR = Classless Inter-Domain Routing `10.0.0.0/16` means there are **65,536 IP addresses** available. ##### **1.1.3 Subnetting** - You divide your VNet into **subnets** to group resources logically. - Example: `10.0.1.0/24` for Web tier, `10.0.2.0/24` for App tier - Subnets **segregate traffic** and help apply **network security rules**. #### **1.2 IP Addressing** ##### **1.2.1 Static vs Dynamic IPs** - **Dynamic IP**: Assigned automatically by Azure (default) - **Static IP**: Manually assigned and never changes (useful for DNS, firewalls) Applies to: - **Private IPs** (within the VNet) - **Public IPs** (internet-facing) ##### **1.2.2 Reserved Public IPs and DNS Labels** - Public IPs can be: - **Basic**: Static or dynamic, not zone-aware - **Standard**: Always static, zone-aware - DNS label: - Gives your public IP a friendly name - Example: `mywebapp.eastus.cloudapp.azure.com` #### **1.3 Subnet Configuration** ##### **1.3.1 Logical Segmentation** - Subnets are used to organize resources like: - VMs - Load balancers - App services (via integration) - Helps apply different **security rules** and **route tables** to each segment. ##### **1.3.2 Associate NSGs with Subnets** - NSGs (Network Security Groups) can be linked to subnets to **control traffic rules** for all resources within. ##### **1.3.3 Subnet Delegation** - Allows you to dedicate a subnet to a specific Azure service. - Examples: **Azure Bastion**, **App Service Environment**, **Azure NetApp Files** - Delegation enables the service to **fully manage the subnet**. #### **1.4 Network Interfaces (NICs)** ##### **1.4.1 NIC Basics** - Each VM must have **at least one NIC**. - The NIC defines: - IP configuration (static/dynamic) - NSG rules - DNS settings - Associated subnet ##### **1.4.2 NIC Management** - You can: - **Attach** or **detach** NICs (secondary only) - Change **IP assignment** - Apply **NSGs at the NIC level** **Primary NICs** cannot be detached from the VM. ### **2. Configure Name Resolution** Name resolution (or DNS) ensures that **IP addresses can be translated to human-readable names** (and vice versa) within your Azure environment. #### **2.1 Azure-Provided DNS** ##### **2.1.1 Default DNS in VNets** - Azure provides **built-in DNS services** to resolve hostnames to internal IP addresses within a VNet. - No configuration needed for most scenarios. - Example: A VM named `vm1` in VNet `contoso-vnet` can be resolved as: ``` vm1.contoso-vnet.internal.cloudapp.net ``` ##### **2.1.2 Internal Name Resolution** - Azure auto-registers and resolves VMs by hostname **within the same VNet**. - Works only if: - **VMs are in the same region** - **Default DNS is used** - It does **not support cross-VNet resolution** unless using **VNet peering + custom DNS**. #### **2.2 Custom DNS** ##### **2.2.1 Assigning Your Own DNS Servers** - You can **override Azure’s default DNS** by specifying your own: - On-premises DNS server - BIND or Windows DNS in Azure - Configuration is at the **VNet level**: 1. Go to `VNet > DNS Servers` 2. Choose **Custom** 3. Add one or more DNS server IPs VM NICs must be restarted to apply DNS changes. ##### **2.2.2 Conditional Forwarding** - You can configure your DNS server to **forward specific requests** to: - Azure internal DNS (for `.azure.com`) - On-prem DNS servers - This is useful for **hybrid cloud** scenarios or **split-horizon DNS**. #### **2.3 Private DNS Zones** ##### **2.3.1 What is a Private DNS Zone?** - A **Private DNS Zone** provides **DNS resolution inside your VNets** without requiring custom DNS servers. ##### **2.3.2 Benefits** - No need to manage or maintain your own DNS servers - Supports: - **Automatic registration** of VM names (with auto-registration enabled) - **Custom DNS names** - **VNet linking** ##### **2.3.3 How It Works** 1. Create a private DNS zone (e.g., `internal.contoso.com`) 2. Link it to one or more VNets 3. Enable **auto-registration** if needed 4. Create **A records**, **CNAMEs**, or allow Azure to register VMs automatically Use cases: - **Custom internal DNS names** - **Cross-VNet name resolution** - **Hybrid network setups** ### **3. Secure Access to Virtual Networks** Securing your network in Azure is essential to **control traffic flow**, **prevent unauthorized access**, and **ensure compliance**. Azure provides multiple layers of network security. #### **3.1 Network Security Groups (NSGs)** ##### **3.1.1 What is an NSG?** An NSG is a **firewall-like filter** that controls **inbound and outbound traffic** to: - **Subnets** - **Network interfaces (NICs)** Each NSG contains **security rules**. ##### **3.1.2 Security Rule Components** Each rule includes: - **Name** - **Priority** (lower number = higher priority) - **Source/Destination** (IP, range, tag) - **Protocol** (TCP, UDP, * for any) - **Port range** - **Action** (Allow or Deny) NSG rules are **stateful**: if inbound traffic is allowed, the response is automatically allowed. ##### **3.1.3 Best Practices** - Apply NSGs at the **subnet level** for shared rules. - Apply at **NIC level** for fine-grained control. - Use **deny-by-default** and only **allow what’s needed**. #### **3.2 Service Tags & Application Security Groups (ASGs)** ##### **3.2.1 Service Tags** - **Predefined labels** for common Azure services and groups of IPs. - Examples: - `Internet` - `VirtualNetwork` - `AzureLoadBalancer` - `Storage` Simplifies NSG rules by **abstracting IP addresses**. ##### **3.2.2 Application Security Groups (ASGs)** - Logical groups for **VMs with similar functions**. - Can be used in NSG rules to define **source/destination** by group name rather than IP. Makes rules **more readable and maintainable**. Example: Allow traffic from Web-ASG to App-ASG on port 80. #### **3.3 Azure Firewall** ##### **3.3.1 What is Azure Firewall?** Azure Firewall is a **stateful, fully managed network security service**. Features: - **Packet filtering** (L3/L4) - **Application rules** (L7 filtering for HTTP/S) - **FQDN filtering** - **Threat intelligence** - **SNAT/DNAT** ##### **3.3.2 Use Cases** - Centralized control in **hub-and-spoke architectures** - **Audit and log** all traffic - **Restrict access to known domains** Azure Firewall is **highly scalable** and integrates with **Azure Monitor logs**. #### **3.4 Just-In-Time (JIT) VM Access** ##### **3.4.1 What is JIT Access?** JIT allows **time-limited access** to VMs via RDP/SSH. It’s part of **Microsoft Defender for Cloud** (formerly Security Center). ##### **3.4.2 How it works** - RDP/SSH ports are **blocked by default**. - When needed, an admin can request access: - Define source IP, duration, port - NSG rules are **opened temporarily**, then closed automatically. Protects VMs from **constant port scanning and brute-force attacks**. ##### **3.4.3 How to enable JIT** 1. Go to `Microsoft Defender for Cloud > JIT VM access` 2. Select a VM and enable JIT 3. Configure access ports and allowed source IPs ### **4. Configure VNet Peering** VNet Peering allows you to **connect two virtual networks** seamlessly and securely, enabling **private communication** between them without using public IPs, VPNs, or gateways. #### **4.1 VNet-to-VNet Peering (Same/Different Region)** ##### **4.1.1 Same-Region Peering** - **Low-latency, high-bandwidth** connection between two VNets in the **same region**. - Peered VNets can: - Share resources - Communicate via private IP addresses - Appear as **one network** to resources No need for a VPN or public internet access. ##### **4.1.2 Global VNet Peering** - Peers VNets across **different regions**. - Still **private and secure**, using Microsoft’s backbone. - Use case: **multi-region applications**, disaster recovery setups. Supports cross-region workloads without traffic going over the public internet. #### **4.2 Peering Configuration** To peer two VNets: 1. Go to `Virtual Network > Peerings > + Add` 2. Choose: - The remote VNet - Name of the peering (on both sides) - Traffic settings: - **Allow VNet access** - **Allow forwarded traffic** - **Allow gateway transit** (for shared VPN connections) Peering is **non-transitive**: If VNet A peers with B, and B with C, **A cannot communicate with C** unless directly peered. #### **4.3 Peering Limits** ##### **Limits to Know** - Maximum peering connections per VNet: **500** (may vary with region/SKU) - Each peering must be configured **in both VNets** - Cannot directly peer **VNets in different Azure AD tenants** without extra configuration All traffic between peered VNets remains **within Azure’s private backbone**, not exposed to the internet. ### **5. Configure VPN and ExpressRoute** Azure provides options to **connect your on-premises network** to Azure securely, either over the **public internet (VPN)** or through a **private dedicated connection (ExpressRoute)**. #### **5.1 Site-to-Site (S2S) VPN** ##### **5.1.1 What is a Site-to-Site VPN?** A **Site-to-Site VPN** connects your **on-premises network to an Azure Virtual Network** using **IPsec/IKE tunnels** over the internet. Best for: - **Permanent hybrid connectivity** - Businesses with **on-premises data centers or offices** ##### **5.1.2 Requirements** - An **on-prem VPN device** (must be compatible with Azure) - A **public IP address** for the VPN device - A **Virtual Network Gateway** in Azure - A **local network gateway** (represents the on-prem network) #### **5.2 Point-to-Site (P2S) VPN** ##### **5.2.1 What is a Point-to-Site VPN?** A **P2S VPN** is for **individual users** to connect securely from their devices (e.g., laptops) to Azure over the internet. Best for: - Remote workers or small teams - Testing or development use cases ##### **5.2.2 Authentication Methods** - **Certificate-based authentication** (generate and install client certs) - **Azure AD authentication** (use user credentials and MFA) #### **5.3 ExpressRoute** ##### **5.3.1 What is ExpressRoute?** ExpressRoute provides a **private connection** from your on-premises infrastructure to Azure **via a Microsoft partner provider**. Key Benefits: - **Not over the public internet** - **High availability** - **Consistent latency** - **High bandwidth options (up to 10 Gbps)** ##### **5.3.2 Use Cases** - Enterprise-grade workloads - Large-scale data transfers - Financial services, healthcare, or regulated industries #### **5.4 Gateway Configuration** ##### **5.4.1 Virtual Network Gateway** A **Virtual Network Gateway** is required to create: - **S2S and P2S VPNs** - **ExpressRoute connections** You must choose the **gateway type**: - **VPN**: for IPsec/IKE-based tunnels - **ExpressRoute**: for dedicated lines ##### **5.4.2 SKU Selection** Choose a **gateway SKU** based on: - **Bandwidth needs** - **Connection count** - **Features** (e.g., BGP support) | SKU | Type | Use | | ------------ | ------------ | ------------------------------ | | **Basic** | VPN | Entry-level, limited features | | **VpnGw1-5** | VPN | Production-grade VPN | | **ErGw1-3** | ExpressRoute | Dedicated private connectivity | Gateway creation may take **up to 45 minutes**. Plan accordingly. ### **6. Configure Load Balancing** Azure provides **multiple load balancing options** to distribute traffic, ensure high availability, and support global scalability. The right choice depends on **traffic type**, **protocol layer**, and **deployment scope**. #### **6.1 Azure Load Balancer (Layer 4)** ##### **6.1.1 What is Azure Load Balancer?** A **Layer 4 (TCP/UDP)** load balancer that distributes **incoming traffic** across backend resources (e.g., VMs) in a **virtual network**. Best for: - Load balancing **VM traffic** within a region - Supporting **high availability** ##### **6.1.2 Key Features** - **Inbound NAT rules**: Route specific ports to VMs (e.g., port 3389 to VM1) - **HA ports**: Enable load balancing across **all ports** - **Health probes**: Check VM status before forwarding traffic - **Outbound rules**: Control internet traffic from backend pool ##### **6.1.3 SKU Comparison** | Feature | Basic | Standard | | ----------------------- | ------- | ---------- | | Backend pool size | Limited | Up to 1000 | | Availability zones | No | Yes | | Diagnostics and metrics | No | Yes | | SLA | None | 99.99% | Use **Standard Load Balancer** for production workloads. #### **6.2 Application Gateway (Layer 7)** ##### **6.2.1 What is Application Gateway?** A **Layer 7** (HTTP/HTTPS) load balancer for **web applications**. Best for: - Load balancing **web traffic** - Advanced HTTP features ##### **6.2.2 Key Features** - **SSL termination**: Offload HTTPS decryption - **Web Application Firewall (WAF)**: Protects against OWASP top 10 threats - **Cookie-based session affinity** - **URL path-based routing**: Send `/images` to server A, `/api` to server B - **Multi-site hosting**: Host multiple domains on one gateway #### **6.3 Traffic Manager (DNS-Level Routing)** ##### **6.3.1 What is Traffic Manager?** Traffic Manager is a **DNS-based load balancer** that routes users to the **best endpoint globally**, based on various rules. Best for: - **Global web applications** - **Disaster recovery routing** ##### **6.3.2 Routing Methods** | Method | Purpose | | --------------- | ---------------------------------- | | **Performance** | Route to closest endpoint | | **Priority** | Use primary, failover to secondary | | **Geographic** | Route based on user’s region | | **Weighted** | Distribute based on percentages | Traffic Manager doesn’t handle actual traffic—it only **resolves DNS** to the right endpoint. #### **6.4 Azure Front Door** ##### **6.4.1 What is Azure Front Door?** Front Door is a **global HTTP/HTTPS load balancer** and **content delivery service**. Best for: - High-performance, low-latency global apps - Advanced edge-based features ##### **6.4.2 Key Features** - **SSL offload** - **Web Application Firewall (WAF)** - **Global anycast IP** - **URL-based routing** - **Caching and CDN integration** - **Health probes** Unlike Application Gateway, **Front Door operates at the edge**, not within a VNet. --- # Monitor and Maintain Azure Resources This domain focuses on **observability**, **alerting**, **backup**, **disaster recovery**, and **ongoing maintenance** of Azure environments. ### **1. Monitor Resources Using Azure Monitor** Azure Monitor is a **comprehensive platform** for collecting, analyzing, and acting on telemetry data from Azure and non-Azure resources. #### **1.1 Azure Monitor Core Components** ##### **1.1.1 Metrics** - **Numerical, time-series data**. - Examples: - CPU usage - Disk IOPS - Network traffic Used for: - **Real-time monitoring** - **Triggering alerts** ##### **1.1.2 Logs** - **Detailed events and telemetry**, collected from: - Azure resources - Virtual machines (via agent) - Applications - Stored in **Log Analytics Workspaces** Logs support **complex queries** using KQL (Kusto Query Language). ##### **1.1.3 Workbooks** - **Visual dashboards** that combine: - Metrics - Logs - Text - Queries - Interactive and shareable for analysis or reporting #### **1.2 Diagnostic Settings** ##### **1.2.1 What They Do** - Capture resource logs (e.g., from VMs, Storage, App Services). - Allow routing to other systems. ##### **1.2.2 Where You Can Send Logs** - **Log Analytics Workspace**: for queries and analysis - **Event Hubs**: for streaming logs to external SIEM tools (like Splunk) - **Azure Storage**: for **archiving long-term** Example: - Send storage account logs to Log Analytics for querying - Send VM logs to Event Hub for off-Azure security analysis #### **1.3 Data Sources** Azure Monitor collects data from: - **Azure resources**: e.g., metrics from VMs, SQL DBs, storage - **Guest OS metrics/logs**: via Azure Monitor Agent (AMA) - **Subscriptions and tenants**: for audit logs, activity logs Supports both **platform** and **custom telemetry**. ### **2. Configure and Interpret Metrics and Logs** Understanding and working with metrics and logs is essential for diagnosing performance issues, identifying trends, and responding to incidents. #### **2.1 Metrics Explorer** ##### **2.1.1 What is Metrics Explorer?** Metrics Explorer is a tool within **Azure Monitor** that allows you to: - **Visualize metrics** in real-time - **Build charts** (line, bar, etc.) - **Set up alerts** based on metrics ##### **2.1.2 How to Use** 1. Go to a resource (e.g., VM, Storage Account) 2. Select **Monitoring > Metrics** 3. Choose: - **Metric namespace** (e.g., “Virtual Machine Host”) - **Metric** (e.g., CPU percentage) - **Aggregation**: avg, max, min, sum - **Time range** 4. (Optional) Apply **filters and splitting** by instance Helps identify **performance trends** and **anomalies** #### **2.2 Log Analytics Queries (KQL)** ##### **2.2.1 What is KQL?** Kusto Query Language (KQL) is used to **query and analyze logs** collected by Azure Monitor. Similar to SQL, but optimized for **time-series and diagnostic data**. ##### **2.2.2 Basic Query Example** ```kusto Perf | where ObjectName == "Processor" | where CounterName == "% Processor Time" | where InstanceName == "_Total" | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 5m) ``` This shows the **average CPU usage** every 5 minutes. ##### **2.2.3 Where to Run KQL Queries** - In the **Log Analytics workspace** - From `Azure Monitor > Logs` - From `VM > Logs` #### **2.3 Custom Logs** ##### **2.3.1 What Are Custom Logs?** You can collect **your own application or system log files** (e.g., logs from a web server) into Log Analytics. ##### **2.3.2 Setup Steps** 1. Install **Azure Monitor Agent** 2. In the Log Analytics workspace, configure a **Custom Log** source 3. Define: - File path (e.g., `C:\logs\myapp.log`) - Delimiters or record patterns 4. Azure ingests the logs and lets you query them via KQL ##### **2.3.3 Parse Logs with KQL** Once collected, use KQL functions like `parse`, `split`, or `extract()` to analyze them. Example: ```kusto CustomLog_CL | extend Level = extract("Level=([A-Z]+)", 1, RawData) | summarize count() by Level ``` ### **3. Configure Alerts and Actions** Azure Monitor enables you to create **alerts** based on metrics, logs, or activity logs, and tie them to **automated actions** like notifications or remediation steps. #### **3.1 Alerts** ##### **3.1.1 Types of Alerts** | Alert Type | Triggers on | Example | | ---------------------- | -------------------------- | ----------------------------- | | **Metric Alert** | Real-time performance data | CPU > 80% | | **Log Alert** | KQL query result | Number of 500 errors > 10 | | **Activity Log Alert** | Azure control-plane events | Resource deletion or creation | ##### **3.1.2 Scope of Alerts** Alerts can be scoped to: - A **single resource** - A **resource group** - An **entire subscription** ##### **3.1.3 Key Alert Configuration Options** - **Thresholds**: e.g., CPU > 80% - **Frequency**: How often the condition is evaluated - **Evaluation period**: Over what time range data is analyzed - **Severity levels**: - 0 – Critical - 1 – Error - 2 – Warning - 3 – Informational - 4 – Verbose Alerts are managed under: `Azure Monitor > Alerts` #### **3.2 Action Groups** ##### **3.2.1 What is an Action Group?** An action group is a **reusable set of response actions** that are triggered when an alert fires. You define: - **Who to notify** - **What action to take** ##### **3.2.2 Notification Methods** - **Email** - **SMS** - **Push notification** (via Azure app) - **Voice call** ##### **3.2.3 Automation Actions** - **Webhook**: Notify a 3rd-party service - **Azure Function**: Run serverless code in response - **Logic App**: Trigger a workflow (e.g., post to Teams or Slack) ##### **3.2.4 How to Create and Use** 1. Go to `Azure Monitor > Alerts > Action groups` 2. Click **+ Create** 3. Add: - **Recipients** - **Actions** - (Optional) **Tags** 4. When creating an alert rule, select this action group Reuse the same action group across multiple alerts. ### **4. Implement Backup and Recovery** Azure provides **built-in backup and restore services** to protect your workloads and data. These tools support both **Azure-native resources** and **on-premises systems**. #### **4.1 Azure Backup** ##### **4.1.1 What Is Azure Backup?** A **cloud-based backup solution** that eliminates the need for on-prem backup infrastructure. It uses a component called the **Recovery Services Vault**. ##### **4.1.2 Supported Backup Workloads** - **Azure VMs**: Full snapshot-based backups - **On-premises servers**: - Using **MARS Agent** (Microsoft Azure Recovery Services) - Or **Azure Backup Server** (for more advanced workloads) - **SQL Server in Azure VMs**: App-consistent backups using VSS ##### **4.1.3 Steps to Back Up a VM** 1. Create a **Recovery Services Vault** 2. Register the **Azure VM** 3. Define a **backup policy** 4. Initiate **backup now** or wait for scheduled backup VMs can be restored **to a new instance**, or you can **restore individual files**. #### **4.2 Backup Policies** ##### **4.2.1 Define Retention Rules** - **Daily / Weekly / Monthly / Yearly** backup points - Retention duration configurable (e.g., keep weekly backups for 12 weeks) Helps organizations meet **data retention requirements** ##### **4.2.2 Instant Restore** - Keeps **up to 5 recovery points** using **snapshot-based backups**. - Enables **quick recovery** without needing to fetch from vault storage. #### **4.3 Restore Options** ##### **4.3.1 File-Level Restore** - For Azure VMs: - Mount the backup as a virtual drive - Browse and copy needed files ##### **4.3.2 Full VM Restore** - Options: - **Create new VM** - **Restore disks only** - **Replace existing VM** Use when recovering from ransomware, accidental deletion, or configuration failure. ### **5. Implement and Configure Azure Site Recovery (ASR)** Azure Site Recovery (ASR) is a **disaster recovery solution** that replicates workloads to a secondary location, allowing **business continuity** in case of failures. #### **5.1 Replication Setup** ##### **5.1.1 Azure VM to Azure Region** - You can replicate an Azure VM from one **region to another**. - Requires: - **Recovery Services Vault** - Enabling **replication settings** per VM - Azure replicates OS disks and data disks asynchronously to the secondary region. Use case: Protect production VMs from **regional outages** ##### **5.1.2 On-Prem to Azure** - ASR supports replication from: - **Hyper-V** (with or without System Center VMM) - **VMware** - **Physical servers** Steps: 1. Install **ASR agent** on-prem 2. Set up **Process Server** and **Configuration Server** 3. Create **replication policy** 4. Enable replication to Azure Azure becomes your **disaster recovery site**, reducing physical infrastructure needs. #### **5.2 Recovery Plans** ##### **What Are Recovery Plans?** Recovery plans allow you to **orchestrate the failover process**. They support: - **Grouping VMs** by application tier - **Sequencing startup** - **Custom scripts or manual steps** Useful for **multi-VM applications** where order of startup matters (e.g., DB → App → Web) #### **5.3 Failover and Failback** ##### **5.3.1 Types of Failover** | Type | Description | | ---------------------- | ----------------------------------------------------------- | | **Planned Failover** | Controlled, no data loss, used for maintenance or migration | | **Unplanned Failover** | Used during unexpected outages | | **Test Failover** | Non-disruptive; validates DR setup in isolation | All types support **automated and manual testing** via portal or PowerShell. ##### **5.3.2 Failback** - Once the primary site is restored: - You can **replicate data back** from Azure to on-prem or original region - Then **failback** systems safely ### **6. Perform Maintenance Tasks** These tasks help ensure your Azure environment remains **secure**, **up-to-date**, and **cost-efficient** over time. #### **6.1 Update Management** ##### **6.1.1 What Is Update Management?** A solution in **Azure Automation** that helps: - **Track missing updates** - **Schedule patch installation** - **Monitor compliance** Supports: - **Windows VMs** - **Linux VMs** Helps maintain **security compliance** by ensuring systems are patched. ##### **6.1.2 How to Set Up** 1. Enable **Update Management** from your VM or Automation Account 2. Link the VM to **Log Analytics** 3. Define **schedule and maintenance window** 4. Select: - **Update types** (critical, security) - **Reboot options** ##### **6.1.3 Monitoring** Use **Update Compliance reports** to track: - Successful/failed patch attempts - Overall compliance percentage - Time of last scan #### **6.2 Monitor Service Health** ##### **6.2.1 Azure Service Health Overview** Provides **personalized alerts and status notifications** for: - Azure outages - Planned maintenance - Regional issues Access via: `Azure Portal > Service Health` ##### **6.2.2 Types of Alerts** - **Health Advisories**: Best practices, changes to service behavior - **Security Advisories**: Threat detections or patches - **Maintenance Notifications**: Scheduled updates - **Service Incidents**: Real-time issue tracking You can **subscribe** to email/SMS alerts for your services and regions. #### **6.3 Resource Optimization** ##### **Azure Advisor** Azure Advisor analyzes your environment and provides recommendations for: | Category | Example | | --------------------- | ----------------------------------------------- | | **High Availability** | Enable backup for critical VMs | | **Security** | Enable MFA or NSG | | **Performance** | Resize underutilized VMs | | **Cost** | Remove idle resources or use Reserved Instances | Each recommendation includes: - **Potential impact** - **Estimated cost savings** - **Remediation steps** #### **6.4 Performance Tuning** ##### **6.4.1 VM Performance** - Resize VMs if: - CPU/memory usage is consistently high or low - Switch to different VM series based on workload ##### **6.4.2 App Service Tuning** - Upgrade or downgrade **App Service Plans** - Tune **autoscale rules** and **diagnostic settings** ##### **6.4.3 Database and Storage Tuning** - Modify SQL Database **DTUs**/vCores or **Service Tiers** - Tune Blob storage **access tiers** or **replication settings** for cost-performance balance --- # Manage Azure Identities and Governance (Additional Content) ### **1. User Management Enhancements** #### **1.1 Enforcing Multi-Factor Authentication (MFA)** Azure now **enforces MFA by default** for all users under security defaults. - **Security Defaults**: A set of preconfigured identity security settings (including mandatory MFA) applied **automatically** in new tenants unless explicitly disabled. - Users will be prompted for MFA during high-risk sign-ins or after registration. - You can configure **Conditional Access policies** for granular MFA enforcement beyond defaults. **Exam Tip**: Know how to **enable/disable security defaults** and how to **enforce MFA using Conditional Access**. #### **1.2 Cloud-Only vs Synced Users** - **Cloud-only users** are created and managed directly in Azure AD. - **Synced users** come from **on-premises Active Directory** via **Azure AD Connect**. Key limitations for synced users: - Cannot change user properties like UPN or password **in Azure AD** (must do it on-prem). - Cannot **enable SSPR independently** in some configurations. - Cannot be deleted in Azure unless **Azure AD Connect is removed** or **writeback is enabled**. **Exam Tip**: Know which attributes are **read-only** for synced users and where changes must be made. ### **2. SSPR (Self-Service Password Reset)** #### **2.1 Relationship Between SSPR and MFA** - SSPR and MFA **can use the same authentication methods**, such as: - Phone call - Mobile app notification - Email - If a user has completed **MFA registration**, they **do not need to register separately for SSPR**. - Admins should **review combined registration** settings to simplify user experience. **Exam Tip**: Understand that enabling **MFA improves SSPR success rates**, but the two are configured **separately**. #### **2.2 Licensing Requirement for SSPR** - SSPR for **cloud-only users** requires **Azure AD Premium P1**. - Without Premium P1: - Users can’t use SSPR unless they are administrators. - Only admins can reset passwords using Azure portal. **Exam Tip**: Licensing is a commonly overlooked detail. **Know which features require P1 vs P2**. ### **3. RBAC Misconceptions** #### **3.1 Contributor Role Can’t Grant Access** - The **Contributor role** allows full management of resources **but NOT role assignments**. - Only **Owner** or **User Access Administrator** can assign RBAC roles. **Exam Trap**: "Can a Contributor assign roles?" → **No.** #### **3.2 User Access Administrator – Permissions** - Can **assign or remove access (RBAC)** but **cannot modify resources themselves**. - Scope-limited: can only assign roles within the scope they are granted. #### **3.3 Azure AD Roles vs Azure RBAC** | Azure AD Role | Scope | Example | | ------------------------------------ | -------------------------- | ------------------------------------------ | | Applies to Azure AD (identity layer) | Tenant-wide | User Administrator, Global Admin | | Azure RBAC Role | Applies to Azure resources | Scoped to resource, group, or subscription | **Exam Tip**: Don't confuse a **Global Admin (Azure AD)** with **Owner (Azure RBAC)**—they have no cross-over unless explicitly granted. ### **4. Azure Policy vs Azure Blueprints** #### **4.1 Key Differences** | Feature | Azure Policy | Azure Blueprints | | ----------- | ------------------------------------- | ------------------------------------------------------------- | | Purpose | Enforce compliance rules on resources | Deploy **collections of artifacts** (policy, RBAC, templates) | | Granularity | Fine-grained | High-level bundles | | Use case | Day-to-day governance | New subscription setup | #### **4.2 Blueprint Status** - **Blueprints are in "maintenance mode"**, meaning **no new features** will be added. - Microsoft recommends using: - **Azure Landing Zones** - **Azure Policy + Bicep/ARM templates** instead **Exam Tip**: You should know that Blueprints are being deprecated **in practice**, even if still mentioned in legacy content. ### **5. Azure Cost Management Tools** #### **5.1 Azure Advisor** Advisor provides recommendations in **four major areas**: 1. **High Availability** 2. **Security** 3. **Performance** 4. **Cost Optimization** Examples: - Resize or shut down underused VMs - Move workloads to reserved instances - Enable backup for critical resources **Exam Tip**: Know that Advisor is **not a monitoring tool** but **a recommendation engine**. #### **5.2 Cost Alerts and Budgets** - You can define **budgets** and **create alerts** when usage crosses thresholds (e.g., 50%, 90%). - However, **alerts do not block spending or resource creation**. To **enforce spending controls**, combine budgets with **Azure Policy**, such as: ```json { "if": { "field": "Microsoft.Resources/subscriptions/billingAmount", "greaterThan": 1000 }, "then": { "effect": "deny" } } ``` **Exam Tip**: Budget alerts are **advisory only**. **Only Policy can enforce hard limits.** --- # Implement and Manage Storage (Additional Content) ### **1. Blob Object Replication** **What It Does**: Blob object replication allows **asynchronous replication** of blobs between containers — even **across storage accounts and Azure regions**. **Use Cases**: - Cross-region data redundancy - Regulatory compliance - Global content distribution **Key Points**: - The **destination container must have versioning enabled**. - Replication is **automatic** and **does not require application-level intervention**. - It’s configured **per rule**, specifying source and destination conditions. **Where to Enable**: `Storage Account > Data Management > Object Replication` **Exam Tip**: Do **not confuse** this with storage redundancy like **GRS** or **RA-GRS**. Object replication is **application-level**, not storage-level redundancy. ### **2. Azure Files and Azure AD DS Integration** **Scenario**: To control access to **Azure File Shares using NTFS ACLs**, integration with **Azure Active Directory Domain Services (Azure AD DS)** is required. **Benefits**: - Enables **domain-based access control (SMB + ACL)**. - Users can access file shares **using Windows credentials**. - Supports traditional enterprise scenarios with **group-based access control**. **How It Works**: 1. Deploy **Azure AD Domain Services**. 2. Join file shares to the domain. 3. Assign access via **NTFS permissions** and **group membership**. **Exam Tip**: Know that regular Azure AD (without AD DS) does **not support** traditional Windows authentication for file shares. ### **3. Storage RBAC vs Azure RBAC Roles** **Important Distinction**: Azure has **storage-specific roles** that are different from general-purpose roles like Contributor or Owner. | Role Type | Grants Access To | | ------------------------------ | ------------------------ | | Contributor | Manage resource settings | | Storage Blob Data Reader | Read blob contents | | Storage Queue Data Contributor | Write to storage queues | **Key Point**: - Being a **Contributor** does **not automatically grant data-level access** to blob content. - You must assign **storage-specific RBAC roles** for **data plane access** (reading/writing blobs, queues, tables). **Exam Tip**: When troubleshooting access denial errors in blob storage, **check for missing data roles**, not just management roles. ### **4. Configurable Soft Delete Retention** **Scope**: Soft delete is supported for: - Blobs - Blob containers - File shares **Retention Period**: - **Default**: 7 days - **Customizable**: 1 to 365 days **Functionality**: - Deleted data is not immediately removed. - Can be **restored within the configured window**. - Works like a "recycle bin" for Azure Storage. **Exam Tip**: Questions may test whether **soft delete applies at the container level** (it **does**) and what the **default or maximum retention** limits are. ### **5. Private Endpoint vs Firewall Behavior** **Key Concepts**: - A **private endpoint** maps a resource to a **private IP** in your VNet. - Once connected via private endpoint: - Traffic uses **internal Azure backbone**, **bypassing firewalls**. - Public network access can be **disabled** or **restricted** via firewall rules. **Firewall Behavior**: - If firewall rules block all public access, users can still reach the storage account **through the private endpoint**. **Exam Tip**: Expect scenarios asking whether **firewall rules block private traffic** — they **do not** unless explicitly misconfigured. ### **6. Archive Tier Access Latency** **Overview**: The Archive tier is optimized for **long-term, rarely accessed data**. **Rehydration Required**: - Before reading from archive, you must **rehydrate** the blob. - This takes **6 to 15 hours**, depending on the **priority level**. **Use Cases**: - Legal compliance - Financial data archiving - Medical records **Exam Tip**: You may be asked about **access latency** or **cost implications** of rehydration. Archive is **low-cost for storage**, **high-cost for access**. ### **7. Blob Index Tags (Advanced but Useful)** **What It Is**: Blob index tags let you assign **key-value pairs** (e.g., `project=finance`) to blobs. **Benefits**: - **Query** blobs without scanning entire containers. - Apply **lifecycle management rules** based on tag filters. - Easier **search, filtering, and compliance management**. **Prerequisites**: - Available only in **Blob Storage accounts (GPv2)**. - Must **enable versioning and lifecycle management**. **Use Cases**: - Tagging invoices, contracts, backups - Automating data retention or archival **Exam Tip**: This is **less commonly tested** but valuable in real-world design. Be familiar with the **syntax and logic** of index-based filtering rules. --- # Deploy and Manage Azure Compute Resources (Additional Content) ### **1. Monitor VM Performance** Azure provides multiple mechanisms to **monitor performance and diagnose issues** for virtual machines. #### **1.1 Performance Metrics** Collected through **Azure Monitor**, including: - **CPU usage** - **Disk IOPS and latency** - **Network in/out** - **Available memory (Windows only)** Access via: - `VM > Monitoring > Metrics` - Azure Monitor > Metrics #### **1.2 Diagnostic Settings and Extensions** To collect **guest-level metrics** and logs: - Enable **diagnostic settings** on the VM. - Install **Azure Monitor Agent (AMA)** or **Diagnostics extension**. #### **1.3 Recommended KQL Query Example** ```kusto Perf | where ObjectName == "Processor" | where CounterName == "% Processor Time" | where InstanceName == "_Total" | summarize avg(CounterValue) by bin(TimeGenerated, 5m) ``` Use this to analyze **CPU patterns over time**. **Exam Tip**: Know the difference between **platform metrics** (available without agent) and **guest metrics** (require agent or extension). ### **2. Run Command on VM** **Run Command** allows administrators to execute **remote scripts or commands** on a VM **without RDP/SSH**. #### **2.1 Use Cases** - Fix broken extensions - Reset services - Run administrative scripts remotely #### **2.2 Azure Portal Path** `Virtual Machine > Operations > Run Command` Choose: - Windows: RunPowerShellScript - Linux: RunShellScript #### **2.3 Azure CLI Example** ```bash az vm run-command invoke \ --resource-group MyRG \ --name MyVM \ --command-id RunShellScript \ --scripts "sudo apt update && sudo apt install nginx -y" ``` **Exam Tip**: This is often tested in scenarios where SSH or RDP access is unavailable. ### **3. AKS Azure AD Integration (RBAC Control)** While AZ-104 doesn’t cover deep AKS admin tasks, you should understand **how Azure RBAC integrates with AKS**. #### **3.1 RBAC Flow Overview** - Azure AD is used to authenticate users to **AKS cluster control plane**. - **RoleBindings** or **ClusterRoleBindings** authorize access via Kubernetes RBAC. #### **3.2 Enabling AD Integration** During cluster creation: - Use `--enable-aad` and specify `--aad-admin-group-object-ids` for admin group(s). #### **3.3 Example: Grant Reader Access to kubectl** 1. Assign Azure user to a group with `Azure Kubernetes Service Cluster User` role. 2. Use `kubectl` with AAD authentication to access the cluster. **Exam Tip**: You may be asked which **Azure role** is needed to **access AKS using kubectl** → **Azure Kubernetes Service Cluster User**. ### **4. VM Scale Sets (VMSS) Upgrade Policies** VMSS supports **automated VM updates** via defined **upgrade modes**. #### **4.1 Upgrade Types** | Mode | Description | | ------------- | --------------------------------------------------------------- | | **Manual** | Admin must trigger updates; safest option | | **Automatic** | VMs updated **as soon as a new version** is available | | **Rolling** | VMs updated **gradually**, with health probes and batch control | #### **4.2 Rolling Upgrade Details** - **Health probe integration** ensures only healthy instances are upgraded. - Settings: - **Max batch size** - **Pause between batches** - **Failure thresholds** **Exam Tip**: Know the difference between these types—especially **Manual** vs **Rolling**. ### **5. Boot Diagnostics and Serial Console for Troubleshooting** #### **5.1 Boot Diagnostics** - Captures **screenshot** and **console logs** from a VM’s boot process. - Useful when **OS fails to boot** or **VM becomes unresponsive**. Enable from: `VM > Support + Troubleshooting > Boot Diagnostics` #### **5.2 Serial Console Access** - Provides a **command-line interface** via the **Azure portal**, even when RDP/SSH is unavailable. - Works if: - Boot diagnostics are enabled - VM OS supports it (e.g., Linux, Windows Server 2016+) Path: `VM > Serial Console` **Use Cases**: - Reset admin password - Modify fstab or firewall rules - Repair misconfigured startup scripts **Exam Tip**: Expect a question involving troubleshooting **boot failure**, with clues pointing to serial console or boot diagnostics usage. --- # Implement and Manage Virtual Networking (Additional Content) ### **1. User-Defined Routes (UDR)** User-Defined Routes allow you to **override Azure’s default system routes** and define custom traffic flow. #### **1.1 How to Configure** 1. Create a **route table**: - Azure Portal → "Route tables" → "+ Add" 2. Add custom routes: - Specify **address prefix** (e.g., `0.0.0.0/0`) - Choose **next hop type**: `Virtual appliance`, `VPN gateway`, or `None` (blackhole) 3. Associate the route table with a **subnet**. #### **1.2 Common Use Cases** - **Next hop = NVA (Network Virtual Appliance)**: Redirect traffic to a firewall or inspection device. - **Blackhole route**: Route traffic to `None` to **block all traffic** to a destination (e.g., `0.0.0.0/0` to block internet). - **Force tunneling**: Redirect all internet-bound traffic back to on-premises via a VPN. **Exam Tip**: Expect scenarios involving traffic control to/from subnets, and choosing between system route, UDR, or BGP route precedence. ### **2. Forced Tunneling** **Definition**: A technique that **forces outbound internet traffic** from Azure resources to go through **on-premises infrastructure**, typically for **auditing or inspection purposes**. #### **How It Works** - Use a **custom route**: - `0.0.0.0/0 → VPN Gateway IP` - Combine with a **Site-to-Site VPN Gateway**. #### **Why Use It** - Regulatory compliance - Centralized monitoring and egress filtering #### **Implementation Steps** 1. Set up a **Site-to-Site VPN** to on-premises. 2. Create a **UDR** for `0.0.0.0/0` with **next hop** set to VPN gateway. 3. Associate this route with the target subnet(s). **Exam Tip**: Understand the **routing order precedence** and that **forced tunneling requires disabling default internet access** via UDR. ### **3. View Effective NSG Rules** **Purpose**: To troubleshoot and understand the **actual security rules** affecting a VM’s network interface. #### **How to View** - **Azure Portal**: - Go to `VM → Networking → Network interface → Effective security rules` - **Azure CLI**: ```bash az network nic list-effective-nsg --name --resource-group ``` #### **Why It Matters** - Diagnosing **conflicts between NSGs** at subnet and NIC levels - Verifying **rule priority** - Confirming **inbound and outbound allowed/denied traffic** **Exam Tip**: Effective security rules are calculated after **all NSGs, priorities, and service tags** are evaluated. ### **4. App Service VNet Integration Modes** App Services can **connect to VNets**, but the behavior depends on the **integration mode**. #### **4.1 Regional VNet Integration** - Works with **VNets in the same region**. - Used for **outbound access only** (e.g., access to databases, APIs in VNet). - Uses **delegated subnet** and **private IPs**. #### **4.2 Gateway-required Integration** - For **cross-region** scenarios. - Uses a **VPN Gateway** to route traffic. - Slower, more complex setup, but allows integration with remote VNets. #### **Important Limitation** - **App Service cannot be accessed inbound from the VNet** using VNet integration alone. - To allow inbound access from a VNet, use **Private Endpoint**. **Exam Tip**: Many questions test whether App Service can be accessed by other services **inside a VNet**—answer is **No**, unless **Private Endpoint** is configured. ### **5. Network Diagnostic Tools** Azure provides **Network Watcher** for diagnosing and monitoring network-related issues. #### **Key Tools Within Network Watcher** - **IP Flow Verify**: - Test if a specific **inbound/outbound flow** is allowed by NSG. - **NSG Flow Logs**: - Logs **NSG rule hits** for auditing or traffic analysis. - **Packet Capture**: - Collects **live network traffic** from VMs for deep analysis. - **Connection Troubleshoot**: - Checks if traffic can flow between **source and destination IPs/ports**. #### **Enablement** - Enable Network Watcher per region or automatically via portal. **Exam Tip**: You may be given a scenario with failed connectivity and asked which **Network Watcher tool** to use (e.g., use **IP Flow Verify** for NSG blockage). --- # Monitor and Maintain Azure Resources (Additional Content) ### **1. Alert Suppression (Alert Rule Suppression Configuration)** #### **What is Alert Suppression?** Alert suppression allows you to **control the frequency of alert notifications** to avoid alert storms during high-frequency conditions. #### **Key Parameters** - **Suppression Interval**: The minimum duration between successive notifications for the **same alert condition**. - **Use case**: For example, if CPU stays above 90% for 2 hours, you may want only **one notification per hour**, not one per evaluation cycle. #### **How to Configure** 1. In the **alert rule creation wizard**, under the **Actions** section. 2. Set a **"Suppression" time window** (e.g., 30 minutes, 1 hour). #### **Why It Matters** - Avoids **alert fatigue** - Helps teams focus on unique or meaningful alerts **Exam Tip**: Understand **how to reduce alert noise** without disabling alerts entirely. ### **2. Azure Managed Grafana** Azure Managed Grafana provides a **fully managed Grafana environment** integrated with Azure Monitor data sources. #### **Key Features** - Native integration with: - Azure Monitor - Log Analytics - Application Insights - Supports: - **Custom dashboards** - **Role-based access control** - **Team collaboration** - No need to maintain infrastructure or apply patches #### **Benefits** - Advanced, **custom visualizations** (beyond Workbooks) - Ideal for SRE and Ops teams - Supports **mixed sources** (e.g., Prometheus + Azure Monitor) #### **Deployment Path** 1. Search for **Azure Managed Grafana** in Azure Marketplace 2. Assign users with proper roles (e.g., Viewer, Editor) **Note**: AZ-104 does **not test Grafana directly**, but awareness of **monitoring extensibility** can help in hybrid environments. ### **3. KQL Advanced Functions (Join Example)** Kusto Query Language (KQL) supports powerful analytics features like **joins**, **parsing**, and **data shaping**. #### **Join Example: Combine Performance and Heartbeat Data** ```kusto Heartbeat | where TimeGenerated > ago(1h) | join kind=inner ( Perf | where ObjectName == "Processor" | where CounterName == "% Processor Time" ) on Computer | project TimeGenerated, Computer, CounterName, CounterValue ``` #### **Explanation** - `Heartbeat` shows VM availability. - `Perf` shows performance metrics. - The query **joins both tables on the Computer name**, allowing correlation of **CPU usage with availability**. #### **Other Advanced Functions (Optional)** - `extend` — Add calculated columns - `parse_json` — Extract structured data from JSON fields - `summarize` — Aggregate over time windows or categories **Exam Tip**: AZ-104 focuses on basic KQL, but **join examples** may appear in practical or case-study questions. ### **4. Azure Resource Graph (Optional but Valuable)** Azure Resource Graph is a service for **high-performance querying across large-scale Azure environments**. #### **Use Cases** - Query across **subscriptions or management groups** - Inventory reporting (e.g., list all VMs not in a backup vault) - Governance and compliance auditing #### **Query Example** ```kusto Resources | where type == "microsoft.compute/virtualmachines" | project name, location, resourceGroup ``` #### **Key Benefits** - Instant, read-only access to **resource metadata** - Uses **KQL-like syntax** - Supports filtering by **tags, properties, policies** #### **Access Methods** - Azure Portal → **Resource Graph Explorer** - **Azure CLI**: `az graph query -q ""` **Note**: Not directly tested in AZ-104, but helpful for **real-world automation, inventory, and governance.** ---

Shopping cart

Subtotal:

Examination Introduction

Learning Method

Study Plan

Skill Practice Questions