Talk about topics like ; - contract & cost management - subscription management - identity & access management - networking foundation

1. “My organization just went Azure!”
Karim Vaes @kvaes
#GlobalAzure Bootcamp 2018
“What to do now?!?”
“Oh no…”

2. © Microsoft Corporation
Meet “Max”…
He’ll make sure
no nasty cloud
would dare to
touch your
systems!

3. © Microsoft Corporation
The end!

4. © Microsoft Corporation
Just Kidding

5. © Microsoft Corporation
Agenda
## Contract & Cost Management
## Subscription Management
## Identity & Access Management
## Networking Foundation
## Questions & Answers

6. © Microsoft Corporation
Contract & Cost
Management

7. © Microsoft Corporation
Typically three purchasing methods
Web Direct
• Credit Card
• Direct
Enterprise Agreement
• Contract (3Y)
• Direct
Cloud Service Provider
• Contract
• Indirect

8. © Microsoft Corporation
Why does this matter?
Web Direct
• AdminPortal
• Billing Info
• Single Sub.
Enterprise Agreement
• EA Portal (Customer)
• Billing link w. Acc. Owner
• Hierarchy possible
• No reselling allowed
Cloud Service Provider
• Partner Central (Partner)
• Billing link w. AAD Tenant
• Focused towards value added
services

9. © Microsoft Corporation
Enterprise Agreement Hierarchy EA Contract
Enrollment
Department
Account Owner
Subscription
Resource Group
• Resource
• Resource
Resource Group
• Resource
• Resource

10. © Microsoft Corporation
Cost Management
Portal
• High Level
• Very Detailed
• No Tags
PowerBi
• Customizable
• EA Only
• Tags (DIY)
Azure Cost Mgmt
• Drag & Drop (f.e. Tags)
• Multiple Contracts/Clouds
• Alerting
https://powerbi.com/groups/me/getdata/services/azureconsumption & https://docs.microsoft.com/en-us/azure/cost-management/

11. © Microsoft Corporation
0
10
20
30
40
50
60
70
80
90
100
12:00
AM
1:00
AM
2:00
AM
3:00
AM
4:00
AM
5:00
AM
6:00
AM
7:00
AM
8:00
AM
9:00
AM
10:00
AM
11:00
AM
12:00
PM
1:00
PM
2:00
PM
3:00
PM
4:00
PM
5:00
PM
6:00
PM
7:00
PM
8:00
PM
9:00
PM
10:00
PM
11:00
PM
P95 CPU utilization
CPU Utilization
Resize savings
$970
Snoozing
Resizing
Snooze savings
$162
D14 v2 SKU,
$1,400/mo
+
D12 v2 SKU,
$430/mo
+
D12 v2 SKU,
$268/mo
Cost Optimizations

12. © Microsoft Corporation
Cost Optimizations
Pay-as-you-Go
• Per per minute
• No reservation
• D2v3 ~73.88€
Reserved Instance (1Y)
• VM Size reserved for 1Y
• Exchange or Refundable*
• D2v3 ~47.09€ (~36%)
Reserved Instance (3Y)
• VM Size reserved for 3Y
• Exchange or Refundable*
• D2v3 ~32.40€ (~56%)
Azure Hybrid Use Benefit

13. © Microsoft Corporation
Snoozing & Bursting
Non-Prod VM
• 10h per workday
20d per month
= 200h
• 24/7 = ~730h
• Snoozing = ~72%
Scale-on-Demand
• CosmosDB scales within seconds
• B-series
• Functions Consumption Plan
• …

14. © Microsoft Corporation
Subscription
Management

15. © Microsoft Corporation
So…
Subscription
Resource Group
• Resource
• Resource
Resource Group
• Resource
• Resource

16. © Microsoft Corporation
When do I need another subscription?
Trust
Issues
Esthetical Billing

17. © Microsoft Corporation
So how can we help “Max”?
Management
Groups

18. © Microsoft Corporation
Azure Management Group
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management-groups-overview

19. © Microsoft Corporation
Azure Role Based Access Control
https://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-what-is
Built-in role Description
Owner Can manage everything, including access
Contributor Can manage everything except access
Reader Can view everything, but can't make changes
API Management Service Contributor Can manage API Management services
API Management Service Operator Role Can manage API Management services
API Management Service Reader Role Can manage API Management services
Application Insights Component Contributor Can manage Application Insights components
Application Insights Snapshot Debugger Gives user permission to use Application Insights Snapshot Debugger features
Automation Job Operator Create and Manage Jobs using Automation Runbooks.
Automation Operator Able to start, stop, suspend, and resume jobs
Automation Runbook Operator Read Runbook properties - to be able to create Jobs of the runbook.
Azure Stack Registration Owner Lets you manage Azure Stack registrations.
Backup Contributor Can manage all backup management actions, except creating Recovery Services vault and giving access to others
Backup Operator Can manage all backup management actions except creating vaults, removing backup and giving access to others
Backup Reader Can monitor backup management in Recovery Services vault
Billing Reader Can view all Billing information
BizTalk Contributor Can manage BizTalk services
CDN Endpoint Contributor Can manage CDN endpoints, but can’t grant access to other users.
CDN Endpoint Reader Can view CDN endpoints, but can’t make changes.
CDN Profile Contributor Can manage CDN profiles and their endpoints, but can’t grant access to other users.
CDN Profile Reader Can view CDN profiles and their endpoints, but can’t make changes.
Classic Network Contributor Can manage classic virtual networks and reserved IPs
Classic Storage Account Contributor Can manage classic storage accounts
Classic Storage Account Key Operator Service Role Classic Storage Account Key Operators are allowed to list and regenerate keys on Classic Storage Accounts
Classic Virtual Machine Contributor Can manage classic virtual machines but not the virtual network or storage account to which they are connected
ClearDB MySQL DB Contributor Can manage ClearDB MySQL databases
Cosmos DB Account Reader Role
Can read Azure Cosmos DB account data. See DocumentDB Account Contributor for managing Azure Cosmos DB
accounts.
Data Factory Contributor Create and manage data factories, and child resources within them.
Data Lake Analytics Developer Lets you submit, monitor, and manage your own jobs but not create or delete Data Lake Analytics accounts.
DevTest Labs User Can view everything and connect, start, restart, and shutdown virtual machines
DNS Zone Contributor Can manage DNS zones and records.
DocumentDB Account Contributor Can manage Azure Cosmos DB accounts. Azure Cosmos DB is formerly known as DocumentDB.
Intelligent Systems Account Contributor Can manage Intelligent Systems accounts
Key Vault Contributor Lets you manage key vaults, but not access to them.
Lab Creator Lets you create, manage, delete your managed labs under your Azure Lab Accounts.
Log Analytics Contributor
Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings
includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs
from Azure Storage; creating and configuring Automation accounts; adding solutions; and configuring Azure
diagnostics on all Azure resources.
Log Analytics Reader
Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including
viewing the configuration of Azure diagnostics on all Azure resources.
Logic App Contributor Lets you manage logic app, but not access to them.
Logic App Operator Lets you read, enable and disable logic app.
Managed Identity Contributor Create, Read, Update, and Delete User Assigned Identity
Managed Identity Operator Read and Assign User Assigned Identity
Monitoring Contributor
Can read all monitoring data and edit monitoring settings. See also Get started with roles, permissions, and
security with Azure Monitor.
Monitoring Reader
Can read all monitoring data (metrics, logs, etc.). See also Get started with roles, permissions, and security with
Azure Monitor.
Network Contributor Can manage all network resources
New Relic APM Account Contributor
Lets you manage New Relic Application Performance Management accounts and applications, but not access to
them.
Redis Cache Contributor Can manage Redis caches
Scheduler Job Collections Contributor Can manage Scheduler job collections
Search Service Contributor Can manage Search services
Security Admin
In Security Center only: Can view security policies, view security states, edit security policies, view alerts and
recommendations, dismiss alerts and recommendations
Security Manager Can manage security components, security policies, and virtual machines
Security Reader
In Security Center only: Can view recommendations and alerts, view security policies, view security states, but
cannot make changes
Site Recovery Contributor
Can manage all Site Recovery management actions, except creating Recovery Services vault and assigning access
rights to other users
Site Recovery Operator
Can Failover and Failback but can not perform other Site Recovery management actions or assign access to other
users
Site Recovery Reader Can monitor Site Recovery status in Recovery Services vault and raise Support tickets
SQL DB Contributor Can manage SQL databases but not their security-related policies
SQL Security Manager Can manage the security-related policies of SQL servers and databases
SQL Server Contributor Can manage SQL servers and databases but not their security-related policies
Storage Account Contributor Can manage storage accounts, but not access to them.
Storage Account Key Operator Service Role Storage Account Key Operators are allowed to list and regenerate keys on Storage Accounts
Support Request Contributor Can create and manage support tickets at the subscription scope
Traffic Manager Contributor Lets you manage Traffic Manager profiles, but does not let you control who has access to them.
User Access Administrator Can manage user access to Azure resources
Virtual Machine Administrator Login
- Users with this role have the ability to login to a virtual machine with Windows administrator or Linux root user
privileges.
Virtual Machine Contributor Can manage virtual machines but not the virtual network or storage account to which they are connected
Virtual Machine User Login Users with this role have the ability to login to a virtual machine as a regular user.
Web Plan Contributor Can manage web plans
Website Contributor Can manage websites but not the web plans to which they are connected
and custom…

20. © Microsoft Corporation
Azure Policy
https://docs.microsoft.com/en-gb/azure/azure-policy/azure-policy-introduction

21. © Microsoft Corporation
Identity & Access
Management

22. © Microsoft Corporation
Subscription trusts one
directory
Microsoft Azure AD
Active Directory
User Groups
Apps Devices
Graph API
Roles
- Global Admin
- User Admin
- Etc.
Identity management &
Authentications
App Support
Team
Virtual Machine
Contributor and
Website Contributor
Development
Team
Virtual Machine
Contributor and
Website Contributor
Network & Security
Team
Virtual Network
Contributor and
Virtual Machine
Contributor
Database Management
Team
SQL Server
Contributor and SQL
Security Manager
Dev
Subscription
Test
Subscription
Production
Subscriptions
Platform Team Owner
Storage & Backup
Team
Storage Account
Contributor
APPLICATION
Per application policy , Client type, (Native apps,
web apps)
OTHER
Location (IP Range), Risk Profile (future)
DEVICES
Is Domain Joined, Is Compliant, Platform type (IOS,
Android, Windows)
USER / GROUP ATTRIBUTES
User identity, Group memberships, Auth Strength
➢ Allow
➢ Enforce MFA
➢ Block
Azure IAM – AAD Integrated

23. © Microsoft Corporation
Azure AAD (B2E) – Basic Rules
Single
Directory
Enforce
MFA
Operate
JIT/JEA

24. © Microsoft Corporation
AAD & …
https://kvaes.wordpress.com/2018/03/13/azure-subscription-management-beyond-the-101-aka-the-advanced-topics/
The Army
of Portals

25. © Microsoft Corporation
Networking Foundation

26. © Microsoft Corporation
Azure Networking Patterns in a growth model
https://kvaes.wordpress.com/2017/10/02/azure-networking-blueprint-patterns-for-enterprises/
Island Mode
Forced
Tunneling
NGFW
Two Pairs
(optional)
Hub & Spoke

27. © Microsoft Corporation
Island Mode

28. © Microsoft Corporation
Forced Tunneling

29. © Microsoft Corporation
Next Generation Firewall

30. © Microsoft Corporation
Next Generation Firewall – Two pairs

31. © Microsoft Corporation
Hub & Spoke
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke

32. © Microsoft Corporation
If you are reading this…
You made it to the end!
(withoutfallingasleep)

33. © Microsoft Corporation
Questions & Answers

34. © Copyright Microsoft Corporation. All rights reserved.