Top Six Benefits of Cloud Computing

Both small and large organizations use cloud computing technology to store information in the cloud and access it from anywhere using an Internet connection.

Moving to the cloud varies based on the organization, but six advantages are illustrated in Figure 1-2.

An illustration depicts the six advantages of cloud computing. They are Economies of Scale, Opex versus Capex, Stop Guessing Capacity, Pay Attention on Business Differentiators, Reliability and Security, and Global Search.

The first benefit is economies of scale: cloud computing is available in both global or local availability to meet security, regulation, and compliance requirements.

Enterprises can lower their variable costs compared to private cloud consumers. Azure, for example, can achieve economies of scale by aggregating usage from hundreds of thousands of customers, which translates into lower prices.

The second benefit is OpEx vs. CapEx: cloud computing eliminates the need for capital expenditures such as hardware and software running in on-premises datacenters, power and cooling, and staffing such as subject matter experts managing complex components 24/7.

Cloud service providers run on a consumption-based model, meaning no upfront cost or no CapEx and only OpEx. Thus, cloud service providers can offer the ability to pay for additional resources only when needed and the ability to stop paying when no longer needed.

The third benefit is forecasting capacity: cloud computing runs in dedicating datacenters connected globally on a worldwide network. The systems are very highly secured and are frequently patched and upgraded to the latest and greatest computing systems. Cloud computing offers excellent benefits compared with on-premises traditional datacenters.

Organizations often end up with expensive idle resources or limited capacity requiring a capacity allocation or procurement decision before deploying applications. Cloud computing allows organizations to stop guessing about their infrastructure requirements for meeting their business needs. With a few minutes’ notice, cloud consumers can scale up or down as necessary.

The fourth benefit is focusing attention on business differentiators. Instead of spending time racking, stacking, and powering servers, organizations can focus on their business priorities with cloud computing. This paradigm shift can free organizations from spending time and resources on maintaining and running datacenters. By using cloud computing, businesses can concentrate on projects that differentiate their specific business, such as analyzing petabytes of data, delivering video content, creating mobile applications, or exploring Mars.

The fifth benefit is reliability and security. Cloud computing makes data backup, business continuity, and disaster recovery significantly less expensive. Cloud computing has site-level redundancy. Application and data are replicated and mirrored across the redundant sites or availability zones simply via the subscription.

Modern-day cloud service providers offer security components, controls, policies, compliance needs, and regulations standards which, when utilized correctly, heavily improve the security posture end to end. As a result, the application infrastructure can be highly data secure and can manage potential vulnerabilities and threats.

The sixth benefit is global reach. Cloud computing also provides the advantage of going global in minutes. Organizations can deploy their applications globally in just a few clicks. Organizations can use this technology to provide redundancy across the globe and provide lower latency and better experiences to their customers at a minimal cost. Cloud computing makes it possible for any organization to go global, which was previously only available to the most prominent corporations.

Three Delivery Models of Cloud Computing

Organizations can encounter abnormal freight on their IT infrastructure to meet growing client expectations for speedy, secure, and stable services. As they strive to develop their IT systems’ processing compute and storage abilities, these organizations often find that improving and managing a hardy, scalable, and secure IT foundation is prohibitively high-priced.

Cloud computing equips DevOps, DevSecOp, and SRE engineers with the ability to converge on what matters most and withdraw undifferentiated trade such as procurement, support, and retention planning. As cloud computing has increased in prevalence, numerous distinct models and deployment strategies have emerged to fit the specific needs of other users. Each cloud service and deployment organization provides consumers with diverse control, flexibility, and management levels.

Cloud-native and hybrid cloud deployment models are the two available cloud computing deployment models that enterprises focus on. Understanding how each strategy applies to architectural decisions and options is crucial. Figure 1-3 depicts the delivery model of cloud computing.

An illustration of two cloud computing deployment types. 1, cloud native with I a a S, P a a S, and S a a S. 2, hybrid cloud with private and public.

Cloud native refers to when all application components are running on the cloud and the cloud-based application is fully deployed in the cloud. Applications in the cloud have either been developed using cloud technology or migrated from conventional infrastructure to take advantage of the cloud’s benefits. In cloud-based applications, low-level infrastructure pieces or higher-level services can be used, abstracting away the management, scalability, and architecture requirements of core infrastructure.

Cloud hybridization refers to workloads run on an on-premises or co-located infrastructure, while also having infrastructure hosted in the cloud. A hybrid cloud environment enables cloud consumers to maximize the agility and flexibility of a public cloud environment while taking advantage of their existing investments.

Imagine using the same tools cloud consumers have used for years to manage all these resources. Cloud consumers can extend the VMware infrastructure on-premises to the Azure Cloud, thereby creating a hybrid cloud. The hybrid cloud enables quick and secure expansion of resources, consolidation of datacenters, building disaster recovery environments, and moving traditional workloads close to cloud-native toolsets to facilitate modernizing applications. The cloud native delivery models is defined by specific elements of IT resources offered by a cloud provider. Cloud computing has three distinct delivery models called Infrastructure as a Service, Platform as a Service (PaaS), and Software as a Service (SaaS), depicted in Figure 1-4.

A block diagram depicts three cloud computing deployment models. 1, I a a S. 2, P a a S. 3, S a a S.

Infrastructure as a Service is about delivering compute, network, storage, and backup as a service that can be consumed on a yearly, monthly, or hourly basis. Resource units and their prices are provided via a catalogue.

Platform as a Service is all about IaaS with an integrated set of middleware functions. Software development and deployment tools mean you have a constant way to create, modify, update, and deploy an application in the cloud environment.

Software as a Service is when the application is hosted on top of PaaS or IaaS, either dedicated or shared. In this deployment model, cloud consumers only pay per the app’s consumption. The cloud service provider fully manages the underlying infrastructure and platform.

Now let’s explore the Azure Cloud.

Microsoft Azure Overview

Azure is Microsoft’s hyperscaler cloud offering. Azure offers 200 or more IT services online and enables businesses to accomplish almost all their needs in modern digital environments. The services are sets of integrated tools, prebuilt templates, and managed services to make building and operating enterprise, mobile, web, and IoT apps easier. Many of the products in Azure leverage the tooling skills cloud consumers already have and the technology they already understand.

Azure supports the broadest range of Microsoft operating systems, programming languages, frameworks, tools, databases, and devices. With Docker integration, cloud consumers can run Linux containers; build apps with JavaScript, Python, .NET, PHP, Java, and Node.js; and create back ends for any device. Millions of users trust the Azure service.

Azure has features such as networking with secure private connections, hybrid databases, storage solutions, and data residency and encryption to integrate with existing IT environments. With Azure Stack, cloud consumers can bring the Azure model of app development and deployment into their datacenters.

Microsoft provides industry-leading protection and privacy to cloud consumers. The EU’s data protection authorities have recognized Azure for its commitment to strict EU privacy laws. At the time of writing this book, Microsoft is also the first global cloud provider to adopt the new ISO 27018 international privacy standard.

Cloud consumers only pay for what they use with Azure’s pay-as-you-go services. At the time of writing this book, Microsoft manages Azure’s worldwide network of datacenters in 26 regions (more than Amazon Web Services and Google Cloud combined). With this fast-growing global footprint, cloud consumers can run apps and expect excellent performance. Moreover, Azure is the country’s first multinational cloud service.

Azure’s predictive analytics services redefine business intelligence, including machine learning, Cortana Analytics, and stream analytics. By analyzing cloud consumers’ structured, unstructured, and streaming IoT data, these analytics can improve customer service and uncover new business opportunities.

No workload is too big or too small for Azure. At the time of writing this book, Azure is used by more than 66% of Fortune 500 companies because it offers enterprise-grade service level agreements, 24/7 tech support, and round-the-clock service monitoring.

Generally, large businesses integrate Azure into their existing environment by migrating from a lower one. Cloud computing is not just about moving workloads to the cloud. With constant improvements and new features, it is much more.

Cloud consumers access Azure services via a web-based unified console that replaces command-line tools. The Azure portal can be used by businesses to manage Azure tenant subscriptions, and IT can deploy, manage, and monitor all subscribed IT services. Customized IT dashboards can be created in the Azure portal so that cloud consumers can see structured views of IT services they consume. Azure portal users can also customize accessibility options for a better experience.

The first key concept to start with is to broadly understand the foundation of Azure Cloud. Azure Cloud mainly offers cloud high availability, scalability, reliability, elasticity, agility, geo-distribution, resiliency, security, and Edge to provide the end users maximum uptime. Figure 1-5 depicts the Azure foundation.

A flow diagram of Microsoft azure foundation flow from High Availability, Scalability, Reliability, Elasticity, Agility, Geo-distribution, Resiliency, Security, and Edge.

The second concept to understand in the Azure global infrastructure is that it is developed with two key elements. The first is the physical infrastructure, and the second is the connective network components. The physical infrastructure comprises 200+ physical datacenters organized into regions and connected by one of the most extensive interconnected networks.

The Azure global infrastructure is classified into the following: Azure regions, Azure geography, Azure availability zones, and sets. Figure 1-6 depicts the Azure logical building blocks.

A block diagram of Azure Geographics built on Azure Region Pairs. The Region Pairs are comprised of Availability Zones made of Availability Sets.

Azure Region

Azure regions are a collection of physical datacenters installed within a security and latency-defined network perimeter and connected via a dedicated, low-latency network.

Dedicated regional low-latency networks connect each region’s datacenters within a latency-defined perimeter. Azure’s design ensures optimal performance and security for all regions.

With Microsoft Azure, cloud consumers have the freedom to install and configure applications on demand. The Azure region is equipped with a variety of IT services and pricing.

A pair of regions is what Azure calls a logical boundary, and regional teams contain two geographically defined regions.

Azure regions are defined by a specific geographical boundary, typically hundreds of miles apart. Figure 1-7 depicts the Azure region.

A world map of Microsoft Azure geography marks availability regions, announced regions, and availability zones.

There are more Azure regions globally than any other cloud provider. Because of the global presence, Azure architects can bring cloud consumer applications close by putting them in these regions no matter where cloud consumer end users are located. The global regions provide better scalability and redundancy, and cloud consumers can also maintain data residency.

Azure Geography

Azure geography is composed of regions that meet various compliance and data residency requirements. As much as possible, Azure geography enables cloud consumers to keep their apps and data close to their business. Azure geography is fault-tolerant to withstand region failure via the dedicated high-capacity networking elements of Azure.

By utilizing dedicated high-capacity networking elements, Azure geography is fault-tolerant to withstand region failures. There are at least two regions separated by a considerable physical distance in each geography, which is vital to Azure Cloud. This pattern allows Azure to achieve disaster recovery in the region.

Microsoft encourages customers to replicate their data across multiple Azure regions. Microsoft promises network performance between regions of 2 milliseconds or less.

Azure Availability Zones

Microsoft Azure developed a cloud pattern named availability zones to achieve maximum availability for IT services that demand maximum uptime. Locations are unique to a region. Datacenters in each zone/region are equipped with independent power, cooling, and networking. Microsoft Azure mandates a minimum of three availability zones enabled within each region wherever they exist.

In Azure, availability zones are physically separate locations within a region that can withstand local failures. There can be a variety of failures, including software and hardware failures, earthquakes, floods, and fires. Due to Azure’s redundancy and logical isolation, it has a high degree of fault tolerance. Each availability zone-enabled region has a minimum of three availability zones for resiliency.

Availability zones apply only to the available services and not all services offered by Azure.

By deploying IT services to two or more availability zones, the business achieves maximum availability. Microsoft Azure offers a service-level agreement of 99.99% uptime for virtual machines provided if two or more VMs are deployed into two or more zones.

For the first-time learner, it isn’t easy to differentiate between availability zones and availability sets. Availability sets allow IT service to create two or more virtual machines in different physical server racks in an Azure DC. Microsoft Azure offers a service level agreement of 99.95% with an availability set whereas it provides a service level agreement of a 99.99% with availability zones. Figure 1-8 depicts the Azure availability zones.

A diagram of the azure availability zone. It depicts the linkage between availability zone 1, 2, and 3. The connection of zone 1 and 2 with diverse fiber paths connecting A Z.

Microsoft Azure offers three types of availability zones: zonal services, zone-redundant services, and zone non-regional services.

Microsoft Azure zonal services are IT services such as virtual machines (VMs), managed disks used in VMs, and public IP addresses used in VMs. To achieve the HA design pattern, the IT function must explicitly install zonal services into two or more zones.

Microsoft Azure zone-redundant services are services such as zone-redundant storage and SQL databases. To use the availability zones with ZRS and SQL DB services, you must specify the option to make them zone-redundant during deployment.

Microsoft Azure Non-Regional Services

Azure services are constantly ready from Azure geographies and are resilient to zone-wide blackouts and region-wide blackouts.

Azure services enabled by availability zones are designed to offer the right reliability and flexibility. There are two ways this can be configured. Depending on the configuration, they can be zone-redundant, with automatic replication across zones, or zonal, with instances pinned to specific zones. Clients can combine these patterns. Figure 1-9 depicts the zone-redundant setup.

A diagram of the azure availability zone. It depicts the linkage between availability zone 1, 2, and 3. Availability zone 3 is connects the disaster

High availability zones and protection from large-scale phenomena and regional disasters are essential to some organizations. Azure regions are designed to protect against localized disasters by utilizing availability zones and protection from regional or large geographic disasters by using disaster recovery by utilizing another region.

The third key concept is to understand FinTech management, a choice offered by Azure. By grouping your Azure subscriptions, you can take bulk actions on them. You can manage your subscriptions and resources efficiently by creating an Azure management group hierarchy tailored to your business needs. You can apply governance conditions to any Azure service, such as policies, access controls, or full-fledged blueprints using the full platform integration. You can manage resources better and get visibility into all your resources. Via a single dashboard, you can monitor costs and usage.

Microsoft Azure requires you to assign virtual machines to Azure resource groups when you create them. Even though this grouping structure may seem like just another form of administration, you can use it for better infrastructure governance and cost management. Figure 1-10 depicts the Azure infrastructure governance and cost management.

An image of the Azure infrastructure governance and cost management. It flows from management groups, subscriptions, resource groups, and Azure resources.

Let’s get started with the Azure resource group.

Azure Management Groups

Management groups are an efficient method to enforce policies and privilege control to Azure cloud resources. In a similar approach as a resource group, a management group is a logical container for structuring Azure resources. However, management groups can withhold a single Azure subscription or nested management group. The Azure management group hierarchy supports up to six levels only and it is impossible to have multiple parents on a single management group or a single subscription.

Azure Subscriptions

An Azure subscription is automatically initiated as soon as a user signs up for Azure Cloud Kick Start and all the resources created within the subscription. However, enterprises or businesses can create additional subscriptions that are tied to an Azure account. Other subscriptions use cases are applicable whenever companies want to have logical groupings for Azure resources, especially for reports on resources consumed by departments.

For a Microsoft Azure subscription, each one has a unique identifier called a subscription ID. Microsoft recommends using the subscription ID to recognize the subscription.

Azure Resource Group

A resource group is a logical collection of virtual machines, containers, storage accounts, virtual networks, web apps, databases, and dedicated servers. Users typically group related resources for an application, divided into production and non-production, but you may decide to further subdivide on demand.

There is a logical group for all Azure services subscribed to a resource group. Azure admins can deploy and run all services integrated with a specific app by grouping them. Maintaining an enterprise array of services within a silo is now unnecessary.

It is impossible to attach an Azure resource to more than one resource group. You can move resources from one group to another whenever you delete a resource group. All resources associated with a resource group are deleted when the resource group is deleted.

Azure Resource Manager

Azure Resource Manager (ARM) is a crucial component for managing underlying IT resources. To avoid operational overhead in managing all Azure services separately and to quickly deploy and manage Azure services, Microsoft developed a solution named Azure Resource Manager.

Azure Resource Manager is a deployment and management service that runs in Azure, and it interacts with most Azure services.

Both the Azure portal and the Azure command-line tools work by using Azure Resource Manager, which permits cloud consumers to deploy multiple Azure resources on the go quickly.

Azure Resource Manager makes it possible to reproduce any redeployment with the consistent outcome if there is a failure of the existing build.

Azure Management Offerings

Management in Azure is the foundation building block for deployment and operation support of the resources in Azure. Management tools can be divided into visual (graphical user interface, GUI) and code-based tools at a high level. Figure 1-11 depicts the Azure management tools classification.

An illustration of Azure management has two methods. 1, Interactive with visuals. 2, command Line with code-based.

Azure’s visual tools provide full access to all functionality in a visually friendly manner. It may be less valuable to use visual tools when you’re trying to deploy a large number of interdependent resources and have multiple configuration options.

In most cases, a code-based tool is the better choice when configuring Azure resources quickly and at scale. The correct commands and parameters may take some time to understand, but they can be saved into files and used repeatedly. Setup and configuration code can also be stored, versioned, and maintained in a source code-management tool such as Git. When developers write application code, they use this approach to manage hardware and cloud resources. It is called Infrastructure as Code (IaC).

In IaC, two approaches are available: imperative and declarative. The imperative code details each step required to achieve the desired result. Contrary to declarative code, imperative code specifies only the desired outcome, and it allows an interpreter to determine how to achieve it. It is crucial to distinguish declarative code tools from those based on logic, as declarative code tools provide a more robust way of deploying dozens or hundreds of resources simultaneously and reliably.

For managing your cloud environment, Microsoft offers a variety of tools and services, each geared toward a different scenario and user.

Management refers to the assignments and methods required to maintain IT applications and the resources supporting an organization’s business. Azure has several services and tools that operate together to give complete management for cloud consumers. Figure 1-12 depicts the Azure management methods.

A pyramid diagram depicts five Microsoft azure management methods. They are Microsoft Azure portal, Azure power shell, Azure C L 1, A R M templates, and Azure mobile app.

Microsoft Azure portal: Deploy, run, and monitor everything via a single management plane from web apps, databases, virtual machines, virtual networks, storage, and Visual Studio team projects to the aggregate cloud-native application from a unified console.

When you sign up for the Azure portal, you can take a tour of it. If you’re not familiar with the portal, taking the tour is a good use of your time.

The Azure portal provides a web-based interface that accesses almost all Azure features. Azure’s portal provides an intuitive GUI to view all of the services you are using, create new services, and configure them. This is how most people engage with Azure for the first time. As your Azure usage grows, you will likely choose a more repeatable, code-centric approach to managing your Azure resources. The initial view in Azure is shown in Figure 1-13.

A screenshot of the Microsoft Azure portal with a web-based interface that accesses almost all Azure features. It provides an intuitive G U I to view all of the services being used, create new services, and configure them. It has a welcome message, a list of Azure services, navigation guide, and tools.

Microsoft Azure PowerShell: Azure PowerShell is a kit of cmdlets for operating Azure resources immediately from the PowerShell command-line interface. Microsoft developed Azure PowerShell to make it easy to read, write, and execute code to provide powerful automation features for IT support functions. AVD administrators can use Azure PowerShell when they want to automate code.

Microsoft PowerShell 7.x and the following higher version are recommended.

Microsoft Azure CLI: The Azure CLI is convenient for deploying in Windows, macOS, and Linux environments. The Azure command-line interface, the Azure CLI, is an excellent option; the most straightforward way to begin with Azure PowerShell is by trying it out in an Azure Cloud Shell environment.

Microsoft Azure Cloud Shell: The Azure cloud shell is the completely online version, so there’s no need of any deployment. Upon the first launch of the Cloud Shell, you choose the environment to be used. The Cloud Shell presents two choices: bash and PowerShell. Cloud consumers can change the choice after it is configured the first time.

To reach Azure Cloud Shell, click the Cloud Shell button in the Microsoft Azure portal. Figure 1-14 depicts the Azure Cloud Shell icon.

An image of Azure cloud shell icons. It depicts square with greater than symbol, filter, bell, setting, question mark, and person icons.

Upon clicking the icon, the console loads. Once bash or the PowerShell environment is selected, you create an Azure storage account; however, you need an active subscription. Figure 1-15 depicts the Azure Cloud Shell at launch.

A screenshot of the Azure Cloud Shell upon launch. On top is a welcome message, followed by subscription options to be able to create an Azure storage account.

Microsoft ARM templates: The Azure CLI and Azure PowerShell both allow Azure administrators/developers to set up and tear down one Azure resource or orchestrate an infrastructure comprised of hundreds of resources. However, there’s a better way to do this.

Azure Resource Manager templates (ARM templates) allow Azure administrators/developers to describe resources in a declarative JSON format. As a result, the entire ARM template is verified before any code is executed, ensuring that the resources are correctly created and connected. The template then orchestrates parallel creation. Consequently, if Azure administrators/developers need 50 instances of the same resource, all of them will be created simultaneously. Developers, DevOps professionals, and IT professionals need to specify each resource’s desired state and configuration in the ARM template, and the template takes care of the rest. Scripts can even be executed before or after a resource has been set up using templates.

Azure Monitoring Offerings

Microsoft Azure Monitor: Azure Monitor lets cloud consumers maximize the functional and non-functional KPIs of applications and services. It gives an end-to-end solution for gathering, interpreting, and acting on the data feed from the Azure tenant cloud and integrating it with on-premises environments. In addition, it offers golden signals to identify issues affecting KPIs proactively.

To reach Azure Monitor services, click the Monitor button in the Microsoft Azure portal. Figure 1-16 depicts Azure Monitor.

A screenshot of the Azure Monitor services. The options include Overview, Activity log, Alerts, Metrics, Logs, Service Health, Workbooks, and 13 more options under Insights.

Figure 1-17 of the Azure Monitor dashboard provides an overview.

A screenshot of the Azure Monitor dashboard, with a main message saying Monitor your applications and infrastructure. There are options to Monitor and Visualize Metrics, Query and Analyze Logs, and Setup Alert and Actions.

Microsoft Azure Advisor: Microsoft Azure Advisor offers recommendations and impacts of services regarding cost, security, reliability, performance, and operational excellence. It also guarantees that cloud consumer resources are configured accurately for availability and efficiency. In addition, Microsoft Azure Advisor can inform cloud consumers about predicaments in Azure services configuration to avoid trouble.

To reach Azure Advisor services, click the Advisor button in the Microsoft Azure portal as depicted in Figure 1-18.

A screenshot of the Azure Advisor services. The options include Overview, Advisor score preview, Recommendations, Monitoring, and Settings. Under Recommendations are Cost, Security, Reliability, Operational excellence, Performance, and All recommendations. Under Monitoring are Alerts and Recommendation digests. Under Settings is Configuration.

The Azure advisor dashboard provides an overview, as depicted in Figure 1-19.

A screenshot of the Azure Advisor Overview page depicts separate boxes labeled Security, Reliability, Operational Excellence, and Performance. Each box indicates Recommendation, High, Medium, and Low Impact, and Impacted resource.

Azure Security and Compliance Offerings

Security is one of several critical aspects of any design. Assuring cloud consumers that their business applications and data are secure is essential. A data compromise can destroy an organization’s reputation and create financial wickedness.

When end users, end user devices, and organization data are contained inside the organization’s firewall, it’s assumed to be trusted. This implicit trust can be an easy target for a malicious hacker.

Critical defense in-depth and identify key security technologies and methods to promote a defense-in-depth strategy into reality.

Identities, devices, infrastructure security, network protection, application security, and data encryption are essential and integral to any security design. Securing cloud consumers’ networks from attacks and unauthorized access is vital.

Microsoft uses a layered path to security, both in datacenters and across Azure services. A key component to know is defense-in-depth. The zero trust model drives security researchers, engineers, and architects to design using an applied security approach and layered maneuvering to guard their resources provisioned across the cloud and on-premises with shared responsibility.

Defense-in-depth: Defense-in-depth is an approach that applies a series of tools to slow the advancement of an attack to acquire unapproved access to information. Each layer gets protected so that a subsequent layer is already in place to prevent further exposure if even one layer is compromised. Figure 1-20 depicts the defense-in-depth process.

An image depicts the defense in depth in a triangle with multi layered oval. The edge of the triangle is labeled integrity, confidentiality, and other availability. The oval has Seven layers.

Azure Security Center: Azure Security Center (renamed to Microsoft Defender for Cloud) is a consolidated infrastructure security control system that extends the security posture. It provides exceptional threat protection across hybrid workloads running in the multi-cloud, including the cloud consumer’s private cloud.

Keeping cloud consumers’ IT resources protected is a collective work between the cloud service provider, Microsoft Azure, and the cloud consumers. Cloud consumers have to make sure data and app workloads are secure when running in the Microsoft Cloud. At the same time, when you move to IaaS, there is more customer responsibility than there was in PaaS and SaaS. Azure Security Center provides cloud consumers with a rich set of tools to strengthen their networks and secure their benefits.

To reach Azure Security Center services, click the security center button in the Microsoft Azure portal. The Azure Security Center dashboard provides an overview, as depicted in Figure 1-21.

A screenshot of the Azure Security Center Overview page depicts the Azure subscriptions, A W S accounts, G C P Projects, Assessed resources, and Active recommendations. Below are separate boxes for Secure score, Regulatory compliance, Azure Defender, and Firewall Manager.

Azure Key Vault: Azure Key Vault is a cloud-native service for securely saving and reaching secrets (keys). A key is anything cloud consumers want to control access to, such as API keys, passwords, certificates, or cryptographic keys.

The Key Vault service supports two types: vaults and managed hardware security module (HSM) pools. Azure Key Vault strengthens the Transport Layer Security protocol to guard data when moving among Azure Key Vault and clients.

Azure Sentinel: Azure Sentinel is Microsoft’s cloud-native SIEM that presents exceptional security analytics for the entire cloud enterprise at a cloud scale. Microsoft’s SIEM solution is designed as a cloud-native security-monitoring platform that uses the power of the cloud for analytics and detections. Azure Sentinel provides straightforward amalgamation with flags and statistics from security solutions despite Microsoft Azure or any other cloud inclusive of a private cloud. Azure Sentinel combines machine learning algorithms, global security investigation, and the extent and intensity of the essential security data available to Microsoft as a significant enterprise vendor. Azure Sentinel helps cloud consumers discover known and unknown attack vectors, recognizing threats across all steps.

Azure Compliance: Azure compliance has 90+ certifications, including covering 50 distinct global regions and countries, the US, the European Union, Germany, Japan, the United Kingdom, India, and China. And you get more than 35 compliance offerings particular to the requirements of critical industries, including government, education, finance, manufacturing, health, and media.

Regulatory compliance in Azure Policy presents built-in action representations to observe a listing of the controls and compliance domains based on obligations (cloud consumers, Microsoft, shared).

Microsoft Azure offers global coverage with Center for Internet Security (CIS) benchmarks, Cloud Security Alliance (CSA) STAR Attestation, Cloud Security Alliance (CSA) STAR Certification, Cloud Security Alliance (CSA) STAR Self-Assessment, ISO/IEC 20000-1:2018, ISO 22301:2019, ISO/IEC 27001:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, ISO 9001:2015, System and Organization Controls (SOC) 1 Type 2, System and Organization Controls (SOC) 2 Type 2, System and Organization Controls (SOC) 3, and Web Content Accessibility Guidelines.

Getting Started with Azure VMware Solution

In this section, you’ll learn what Azure VMware Solution is. Over the years, organizations that run virtualized environments on-premises have faced many challenges, including incurring significant capital expenditures, spending a lot of resources, and spending a lot of time managing and maintaining the servers. Additionally, in this model, licenses are typically purchased with elaborate and lengthy enterprise license agreements (ELAs), which are inflexible and unable to scale rapidly to meet ever-changing business requirements.

Is it possible to leverage cloud consumers’ current investments while implementing virtualization in the cloud era?

In a partnership with Microsoft, VMware offers a streamlined approach for migrating VMware environments. VMware workloads can be deployed in a hybrid cloud architecture with Microsoft Azure Cloud, enabling cloud consumers to achieve significant benefits while using the familiar tools, resources, and capabilities of VMware deployments on-premises. VMware and Microsoft enable IT departments to create dynamic, virtualized pools of resources from static servers and networks. These resources can be provisioned on-demand based on evolving business and technical needs.

More and more organizations are moving to the cloud, and Microsoft and VMware’s Azure VMware Solution, a jointly-engineered offering, speeds up the transition and reduces long-term costs. Microsoft develops, operates, and supports Azure VMware Solutions, backed by VMware and cloud-verified by the company. Figure 1-22 provide an overview of Azure VMware Solution.

A cloud image of Azure VMware solution has Azure and Private cloud VMware icon.

Key AVS Capabilities

AVS increases cloud consumers’ productivity by moving VMware workloads to Azure and utilizing the elasticity, scale, and fast provisioning only available via the cloud. Cloud consumer productivitiy means saving time and efforts in phyiscal provisoning compute, storage and networks.

Azure is the best choice for cloud consumers running Microsoft Windows and SQL Server workloads, based on licensing and support options from Microsoft.

Cloud consumers can get on-demand access to additional capacity when they consolidate, retire, or expand existing datacenters.

They can move to Azure seamlessly using VMware’s HCX technology and continue to manage their environment using the same VMware tools they already know, such as vSphere Client, NSX-T, Power CLI, or any popular DevOps toolchain.

They can ensure operational continuity when redeploying vSphere-based applications to Azure and avoid the complexity of application refactoring.

Using Microsoft’s Azure operating platform and back-end infrastructure, it is possible to run VMware vSphere, VMware vSAN, and VMware NSX-T natively and at scale. Cloud consumers’ workloads can run on a single-tenant, fully managed, bare-metal Azure infrastructure, eliminating the hassles of procuring, deploying, and managing a hardware infrastructure. Azure ExpressRoute is a high-speed, low-latency connectivity option for cloud consumers.

VMware Solutions for Azure are based on VMware Cloud Foundation, a comprehensive provider of compute, storage, networking, and management software deployed on Azure with integrated Azure services. By leveraging the global Microsoft Azure infrastructure, VMware customers can utilize their existing skills and tools. Using the Azure VMware Solution, VMware workloads can be seamlessly migrated or extended from on-premises to Azure without requiring costly rearchitecture or retooling of operations. Cloud consumers can build, run, manage, and secure applications across VMware environments and Microsoft Azure with familiar and established VMware tools, skills, and processes.

In Azure VMware Solution, a bare-metal Azure infrastructure is used to build vSphere clusters running on private clouds. Clusters can be expanded to 16 hosts over time, starting with a minimum of three hosts. vCenter Server and NSX Manager, the management tools for Azure VMware Solutions, are configured to be available 99.9% of the time.

A VMware-validated Azure VMware Solution includes ongoing testing and validation of enhancements and upgrades. It allows cloud consumers to focus on developing and running workloads in their private clouds while Microsoft manages and maintains their private cloud infrastructure and software.

Cloud-to-cloud networking allows Azure services or vNets to be integrated with private clouds via SLAs. Azure VMware Solution connects a cloud consumer’s on-premises environment to the Azure VMware Solution private cloud. Figure 1-23 provides an integrated view of AVS.

An image of the Azure VMware integrated view depicts the connections of On Premises environments and Azure with clouds and virtual networks and Azure services.

Figure 1-23 shows the relationship between private clouds and virtual networks in Azure, Azure services, and on-premises environments.

VMware vSphere: Uses the server virtualization platform designed for modern hybrid clouds to run existing applications along with modern containerized applications in Microsoft Azure.

VMware vSAN: Improves business agility while reducing costs with VMware vSAN, the enterprise-class storage virtualization software.

Azure VMware Solution uses hyper-converged Azure infrastructure hosts. High-end hosts are equipped with the processor of Intel 18-core and dual 2.3GHz processors plus 576GB of memory. Additionally, high-end hosts have two vSAN disk groups with 15.36TB of SSD for VMware vSAN’s basic capacity tier and 3.2TB (NVMe) of VMware vSAN’s cache tier.

VMware NSX-T: Connects and secures apps across datacenters, clouds, and containers, all from one interface. Cloud consumers manage most cluster configurations or operations via vSphere and NSX-T Manager. Each host of a cluster has access to their local storage through vSAN. The solution includes four 25 Gbps NICs per ESXi host, two of which are designated for ESXi system traffic and two for workload traffic.

VMware HCX: Continuity and workload rebalancing are built into the tool for extending the on-premises environments of cloud consumers into the cloud.

An Azure VMware Solution private cloud can be connected to a cloud consumer’s on-premises environment using ExpressRoute Global Reach. Cloud consumers connect circuits directly at the Microsoft Enterprise Edge (MSEE) level. Connecting via a virtual network (VNet) with an ExpressRoute circuit to on-premises requires an Azure subscription. Consequently, VNet gateways (ExpressRoute Gateways) cannot transmit traffic, which means cloud consumers can attach two circuits to the same gateway, but it won’t transmit traffic between them.

The Azure VMware Solution environments each have their own ExpressRoute region (their own virtual MSEE devices), so cloud consumers can connect Global Reach to “local” peering locations. Azure VMware Solution customers can connect multiple instances to the same peering location in a single region.

An Azure VMware Solution provides an on-premises and Azure-based private cloud environment. Physical connections are provided through Azure ExpressRoute, VPN connections, or Azure Virtual WAN. There are, however, specific network address ranges and firewall ports needed to enable these services.

Building a private network results from deploying a private cloud for management, provisioning, and vMotion. Cloud users use the private networks to access vCenter, NSX-T Manager, and virtual machine vMotion or deployment.

Azure VMware Solution monitoring patterns are the same as those for Azure VMs within the IaaS platform.

Key AVS Benefits

Key AVS Terminologies

In this section, you’ll learn the top 10 terminologies used in the Microsoft Azure VMware Solution. Figure 1-24 gives a holistic view of the key terms.

A diagram depicts the azure VMware solution terminologies, labeled Virtual Machines, Hypervisor, Containers, Kubernetes, Virtual Networks, Hyperconverged Storage, Bare-Metal Hypervisor, Software Defined Storage and Networking, and Virtual Desktop Infrastructure.