access control, Azure SQL Database, 302
access keys
rotating, 36
access policies, creating, 177–178
access tiers, 32
accounts. See also user accounts
ACI (Azure Container Instances), 22, 264
ACR (Azure Container Registry), 262
creating resources for container images, 262–264
ACS (Azure Container Service). See AKS (Azure Kubernetes Service)
action groups, creating, 26–27
Activity Log, 5
ADE (Azure Disk Encryption), 53–56
advanced threat protection, Azure SQL Database, 303–304
AKS (Azure Kubernetes Service), 22
configuring, 266
creating a cluster with Azure CLI, 266–267
alerts
viewing, 29
APIs
Gremlin, 284
MongoDB, 283
Table, 283
selecting, 286
APM (Application Performance Management), Application Insights, 20–21
Azure Load Balancer, 195
back-end pools, 197
health probes, 198
front-end configuration, 190–191
URL path-based routing, 192–195
availability, 21
failures, 21
Application Map, 20
application registration, 183–186
creating a client secret, 186–187
archive tier, Azure Storage, 32
ARM (Azure Resource Manager) templates, 63–64
and Azure Blueprint, 235
blank, 67
ASGs (Application Security Groups), 211, 214
assigning members, 215
assessment tools, server migration, 132–133
assigning
members to ASGs (Application Security Groups), 215
auditing, Azure SQL Database, 304–305
authentication
application registration, 183–186
configuring verification methods, 100–101
automation runbook, creating, 75–79
autoscaling, 62
Azure Active Directory Log, 5
Azure AD (Active Directory), 86, 176
application registration, 183–186
creating a client secret, 186–187
configuring user accounts for MFA, 93–95
guest accounts
implementing self-service password reset, 89–91
managing multiple directories, 88–89
storage accounts, authentication, 42–46
Azure AD Connect
identity synchronization options, 118–119
installing and configuring, 112–118
Azure Advisor, recommendations, 9–10
Azure App Service, 249
ACI (Azure Container Instances), creating, 264
deployment slots, 254
enabling managed identity, 182–183
web apps, 250
configuring, 216
connecting to a server, 217–218
Azure Blueprint, 232
and ARM templates, 235
CosmosDB backend, 232
Azure CLI
commands for managing containers, 266
creating an AKS cluster, 266–267
documentation, 273
accounts, 277
Gremlin, 284
MongoDB, 283
selecting, 286
Table, 283
data consistency options, 279–280
setting up replicas, 287
Azure Cost Management, 15
budgets, 16
spending, 16
reports, 17
Azure Data Box, offline migration, 146–149
Azure Dedicated Hosts, 63
Azure Firewall, 199
configuring on a virtual network, 199–200
threat intelligence, 203
Azure Front Door, 204
function apps, creating, 168–170, 258–259
Azure Key Vault, 176
access policy, creating, 177–178
accessing an endpoint, 181
cryptographic operations, 179
key management operations, 179
privileged key operations, 179–180
Soft Delete, 177
Azure Load Balancer, 195
back-end pools, 197
health probes, 198
Azure Logic Apps, 255
logic apps
creating an email action, 257
creating an RSS trigger, 256–257
Azure Migrate, 132
Server Assessment tool, 133–138
SQL database assessment and migration, 141–144, 145–146
virtual desktop infrastructure migration, 146
Azure Monitor
action groups, creating, 26–27
alerts
viewing, 29
Insights, 18
Log Analytics workspace, creating, 18–19
monitoring performance capacity, 10–11
visualizing diagnostics data, 12–13
Azure Monitor Log, 10
Azure Network Watcher, 14
Azure portal
Azure Security Center, 3
free tier, 3
standard tier, 3
Azure Sentinel, 4
Azure Service Bus, 174
message queue, 175
service bus namespace, 174
migrating to Azure, 163
on-premises components, configuring, 155–159, 160
recovery plan configuration, 161–162
replicating data to Azure, 160–161
test failover, 162
cleanup, 163
Azure SQL Database, 289, 318–319
backups, 294
manual, 297
BCDR (business continuity and disaster recovery), 310
flavors, 289
high availability, 309–310, 311
configuring an auto-failover group, 311–314
geo-replication strategy, 311
models, 310
LTR (long-term backup retention) backups, 294–296
creating, 296
specifying connection type, 307–309
DMA (Database Migration Assistant), 314, 315
DMS (Database Migration Service), 314–321
methods, 314
phases, 314
purchasing models, 290
read scale-out, 299
access control, 302
advanced threat protection, 303–304
configuring server-level firewall rules, 300–302
data protection and encryption, 302–303
defense-in-depth strategy, 299
Azure Storage, 30
account failover, implementing, 48
Azure files, configuring, 32–34
blobs
queues, 31
storage accounts
configuring network access, 36–38
private endpoints, 39
SAS (shared access signature), 39–42
types, 31
tables, 31
configuring table storage data access, 274–276
and Cosmos DB Table API, 276
creating a storage service, 273–274
documentation, 273
partition key, 272
row key, 272
SAS (shared access signature), 274–275
Timestamp property, 272
Azure Traffic Manager, 208. See also NSGs (Network Security Groups)
configuring traffic monitoring, 210–211
real user measurements, 211
traffic view, 211
Azure Update Management, 149–150
Azure VMs
high availability, 56
JIT (just-in-time) access, 4
Backup and Site Recovery, 154–155
backups
managing on Azure SQL Database, 294
manual, 297
BEK (BitLocker encryption key), 55
blobs, 30
budgets, creating, 16
client secret, creating, 186–187
Get-AzStorageBlobContent, 43
New-AzWebApp, 252
Set-AzDiagnosticSetting, 7
column-family databases, 270
Configuration as Code, 64
configuring
ADE (Azure Disk Encryption), 53–56
AKS (Azure Kubernetes Service), 266
Azure Bastion, 216
Azure Firewall
threat intelligence, 203
back-end pools, 197
health probes, 198
Azure Site Recovery, on-premises components, 155–159, 160
Azure Table storage, storage data access, 274–276
Azure Traffic Manager
real user measurements, 211
traffic view, 211
Azure Update Management, 150–151
Log Analytics workspace, 18–19
NoSQL databases, storage account tables, 270
resources, diagnostic settings, 5–7
autoscaling, 62
storage accounts
SAS (shared access signature), 39–42
VPNs
ExpressRoute, 225–226, 227–228
Connection Monitor, 15
consistency options, Cosmos DB, 279–280
container images
building a storage resource, 262–264
containers, 261
commands for managing, 266
metrics, 22
cookie-based affinity, 191–192
cool tier, Azure Storage, 32
accounts, 277
Gremlin, 284
MongoDB, 283
selecting, 286
Table, 283
data consistency options, 279–280
disaster recovery, 281
setting up replicas, 287
Table API, 276
Cost Management, 15
budgets, 16
reports, 17
spending, 16
creating
ACI (Azure Container Instance), 264
ASGs (Application Security Groups), 214–215
Azure Table storage service, 273–274
budgets, 16
function apps, 168–170, 258–259
General-purpose V2 account, 31
Log Analytics workspace, 18–19
email action, 257
LTR (long-term backup retention) backups, 296
migration projects, 132
storage resource for container images, 262–264
databases. See also Azure SQL Database; NoSQL databases; SQL databases
column-family, 270
dirty reads, 279
document, 270
graph, 270
relational, 288
deploying, from ARM template, 70–73
deployment slots, 254
diagnostics extension, Azure VMs, 7–8
dirty reads, 279
disaster recovery, Cosmos DB, 281
disks
encryption, ADE (Azure Disk Encryption), 53–56
DMA (Database Migration Assistant), 314, 315
DMS (Database Migration Service), 314–321
Docker toolset
ACR (Azure Container Registry), 262
creating container images, 261–262
documentation, 262
document databases, 270
documentation
Azure CLI, 273
Azure Table storage, 273
Docker toolset, 262
governance, 237
load balancing, 218
logic apps, 257
DTUs (Data Transaction Units), 290
edges, creating for graph database, 285–286
encryption
ADE (Azure Disk Encryption), 53
SSE (server-side encryption), 53
endpoints
adding to Azure Traffic Manager, 209–210
Azure Key Vault, accessing, 181
configuring network access, 36–38
private, 39
Event Grid, 172
subscriptions, 173
exporting
expressions, ARM templates, 69–70
configuring a virtual network gateway, 227
peering settings, 226
failover
storage account, 48
files, Azure, configuring, 32–34
function app
Kudu troubleshooting console, 171–172
Platform Features blade, 170–171
function apps, creating, 258–259
General-purpose V2 account, creating, 31
Get-AzStorageBlobContent cmdlet, 43
GitHub, 66
governance, 228. See also Azure Policy
documentation, 237
policies
Azure Front Door, 206
RBAC (role-based access control), 237
configure access to resource by assigning roles, 240–241
configure management access to Azure, 241–242
creating a custom role, 237–240
Gremlin API, 284. See also graph databases
graph database
high availability, 56
Azure SQL Database, 309–310, 311
configuring an auto-failover group, 311–314
geo-replication strategy, 311
models, 310
hot tier, Azure Storage, 32
IaaS (Infrastructure as a Service), 7
IaC (Infrastructure as Code), 63–64, 71
Insights, 18
Network, 22
installing, Azure AD Connect, 112–118
JIT (just-in-time) access, 4
Key Metrics workbook template, 12
Key Vaults, 180. See also Azure Key Vault
KQL (Kusto Query Language), 10, 11–12
Kudu troubleshooting console, 171–172
latency, monitoring, 15
Linux VMs
Live Metrics, 21
back-end pools, 197
documentation, 218
health probes, 198
read scale-out, 299
Log Analytics workspace, creating, 18–19
logging, 8
logic apps
creating an email action, 257
creating an RSS trigger, 256–257
documentation, 257
LTR (long-term backup retention) backups, 294–295
creating, 296
adding subscriptions, 236
changing, 237
top-level access, 236
managing
containers, 266
on-premises connectivity, 224
manual backups, 297
MFA (multi-factor authentication), 131
configuring verification methods, 100–101
migration projects. See also Azure Site Recovery; server migration
creating, 132
Data Box offline migration, 146–149
server environment assessment, 133–138
SQL databases
assessment, 133, 141–144, 145, 314
publishing an Azure SQL database, 314–321
web app assessment and migration, 138–145
modifying, ARM templates, 66–68
MongoDB API, 283
monitoring, 1. See also Azure Front Door; Azure Traffic Manager; Connection Monitor
costs, 15
budgets, 16
spending, 16
networks, 14
latency, 15
performance, 4
security, 2
Movere, 133
My Apps portal, SSPR (self-service password reset), 90–91
Network Insights, 22
networks
latency, 15
monitoring, 14
New-AzWebApp cmdlet, 252
NoSQL databases, 269
and Azure Table storage, 270–271
Cosmos DB Table API, 276
storage account tables, configuring, 270
NPM (Network Performance Monitor), 15
NSGs (Network Security Groups), 211, 214, 224, 225
associating with resources, 214
placement, 212
OneDrive, connecting to, 166–167
OSI networking model, 195
PaaS (platform as a service), configuring diagnostic settings on resources, 5–6
peering
ExpressRoute, 226
performance
monitoring, 4
visualizing diagnostics data, 12–13
Performance Analysis workbook template, 12
platform logs, 5
policies
AKS (Azure Kubernetes Service), 231–232
Azure Front Door, 206
Get-AzStorageBlobContent, 43
New-AzWebApp, 252
Set-AzDiagnosticSetting, 7
configuring diagnostic settings on resources, 7
configuring URL path-based routing, 193–195
creating a client secret, 187
creating an application registration, 185–186
on-premises components of Azure Site Recovery, configuring, 155–159, 160
on-premises SQL database, migrating to Azure SQL database, 314–315
private endpoints, 39
publishing an Azure SQL database
DMA (Database Migration Assistant), 314, 315
DMS (Database Migration Service), 314–321
methods, 314
phases, 314
purchasing models, Azure SQL Database, 290
queues, Azure Storage, 31
RBAC (role-based access control), 237
configure access to resource by assigning roles, 240–241
configure management access to Azure, 241–242
creating a custom role, 237–240
read scale-out, 299
recovery plan, configuring, 161–162
relational databases, 288. See also Azure SQL Database
replication
database, 287
enabling on Azure Site Recovery, 160–161
reports, Cost Management, 17
resource logs, 5
associating with NSG (Network Security Group), 214
Azure Key Vault, creating, 176–177
configuring diagnostic settings, 5
using PowerShell, 7
creating in Azure Site Recovery, 153–154
deploying from ARM template, 70–73
serverless, 164
Azure Functions, 168
service health, monitoring, 13–14
restoring, LTR (long-term backup retention) backups, 296–297
rotating, access keys, 36
rules
NSG (Network Security Group), 212–214
SAS (shared access signature), 39–42, 274–275
scale sets
autoscaling, 62
scaling, Azure SQL Database, 297–300
SDKs, 265
security. See also ASGs (Application Security Groups); authentication; Azure Firewall; Azure Security Center; NSGs (Network Security Groups)
Azure Key Vault, 176
Azure Sentinel, 4
access control, 302
advanced threat protection, 303–304
configuring server-level firewall rules, 300–302
data protection and encryption, 302–303
defense-in-depth strategy, 299
monitoring, 2
selecting, APIs, 286
Server Assessment tool, 133–138
server migration
Server Assessment tool, 133–138
serverless resources, 164
service health, monitoring, 13–14
Set-AzDiagnosticSetting cmdlet, 7
site-to-site VPNs
verifying on-premises connectivity, 222–223
SLA (service-level agreement), 56
spending
budgets, 16
monitoring, 16
reports, 17
SQL databases. See also NoSQL databases
SSE (server-side encryption), 53
SSE (Storage Service Encryption), 30
SSPR (self-service password reset)
storage
creating resources for container images, 262–264
storage accounts, 160
configuring network access, 36–38
failover, 48
keys, 274
private endpoints, 39
SAS (shared access signature), 39–42
types, 31
stored access policies, 275–276
subscriptions, 173
system-assigned managed identity, 181
Table API, 283
tables, Azure Storage, 31
threat intelligence, configuring on Azure Firewall, 203
topology
traffic management. See Azure Traffic Manager
troubleshooting, RBAC (role-based access control), 243–245
configuring verification methods, 100–101
unused resources, monitoring for, 9–10
URL path-based routing, 192–195
user accounts
MFA (multi-factor authentication), 93–95
user-assigned managed identity, 181
VDI (virtual desktop infrastructure)
Data Box offline migration, 146–149
migrating to Azure, 146
vertices, creating for graph database, 284–285
viewing, alerts, 29
visualizations
Application Insights, 20
VMs. See also Azure VMs
adding a Network Security Group, 211–212
alerts
viewing, 29
Azure Dedicated Hosts, 63
on-boarding, 24
high availability, 56
monitoring performance capacity, 10–11
preparing for migration, 155–160
and private endpoints, 39
replicating data to Azure, 160–162
autoscaling, 62
VMSS (virtual machine scale set), 60–61
VNet(s)
App Service integration, 253–254
configuring Azure Firewall, 199–200
VPNs, 218
creating a virtual network gateway, 219–220
ExpressRoute, 225
configuring a virtual network gateway, 227
peering settings, 226
managing on-premises connectivity with Azure, 224
NSGs (Network Security Groups), 224, 225
site-to-site
verifying on-premises connectivity, 222–223
WAF (web application firewall) policies, 206–208
web app assessment and migration, 138–145
web apps, 250
Windows VMs
ADE (Azure Disk Encryption), 53–56
workbook templates
Key Metrics, 12
Performance Analysis, 12
workload management
Azure Migrate Server Assessment tool, 133
server environment assessment, 133–138
Azure Update Management
scheduling updates, 152
migrating VDI infrastructure to Azure, 146–149