Unified Operations and Management of your cross-premises server fleet with Azure Arc

For organizations that want to simplify the management and governance of complex and distributed environments across on-premises, edge and multi-cloud, Azure Arc enables deployment of Azure services anywhere and extends Azure management to any infrastructure.

In this session we will focus on Arc-enabled servers scenario. We will begin with a deep dive into the architecture of Azure Arc to understand how it works under the hood.

The main part of the session will be a series of demos that will show how to onboard your servers to Arc at scale and leverage Resource Manager policies to automatically enable capabilities like operational and security monitoring, patching, backup, guest configuration, and inventory management.

We will also explore the Jumpstart ArcBox, an easy to deploy sandbox for trying out different Arc scenarios (including Kubernetes and data services) that is suitable for prototyping and proof-of-concepts. It will allow session participants to start quickly and get all the tools and components they need.

Transcript

2. Unified Operations and Management of your cross- premises server fleet with Azure Arc David Pazdera @pazdedav Cloud Solution Architect, Microsoft
3. Start with WHY
4. • Are you using Azure Governance and Management services in production? Do you like the experience? • Are you responsible for managing heterogeneous infrastructure spanning Azure, on-premises, multicloud, and edge? • What pain points are you trying to solve? • What objectives and requirements do you have? • Do you have a clear (PoC) project scope? Start with Why
5. Jumpstart ArcBox 2.0 – IT Pros edition aka.ms/AzureArcJumpstart
6. Unified Operations domains Configure & automate Protect & secure Govern & organize Monitor & observe Policy guest configuration Resource tagging Resource Graph Azure Automation: Update Management, Change Tracking & Inventory, Hybrid Runbooks Custom scripts Azure Automanage Sentinel Defender Key Vault Managed Identity Azure RBAC Log Analytics Workbooks VM Insights
7. Design and prepare a landing zone
8. • Minimum prerequisites • Provider registration, permissions, supported OS++ • Azure Arc landing zone accelerator for hybrid and multicloud • Extension of Azure Landing Zone • Seven ‘Critical Design Areas’ Architecture guidance Identity and access management Network topology and connectivity Resource organization Governance and security disciplines Management disciplines Cost governance Automation disciplines
9. Landing zone example Workload subscription with RP registered* Resource Group * Microsoft.HybridCompute, Microsoft.GuestConfiguration Service Principal RBAC Role assignment Platform subscription Centralized automation account Centralized Log Analytics workspace Policy assignment(s)
10. Onboarding
11. Options for onboarding VMware vSphere with PowerCLI SCCM/MECM with PSH or Task Sequence Ansible Playbook AD Group Policy Soon coming to the Portal Extend existing infra provisioning tooling (e.g., Terraform) Windows Admin Center
12. • Limit the scope (blast radius) • Limit permissions (specific role) • Limit the secret lifetime SPN credentials is used only once for onboarding, CMA uses Managed Identity and HIMDS • Extra: Limit source IPs for onboarding • Conditional Access Policies for SPNs (Preview) • Allow onboarding from within ‘Trusted locations’ • Source: @SeifBassem, Blob post Onboarding SPN security hardening
13. • Customize resource name for Arc server (e.g., due to reserved resource name error) > azcmagent connect … --resource-name XYZ • Validate network connectivity > azcmagent check --location <regionName> • Regional availability (e.g., Norway East is not available yet) https://azure.microsoft.com/en-us/global-infrastructure/services/?products=azure-arc&regions=all • Check agent status and other metadata > azcmagent show Onboarding tips & tricks
14. Network topology and connectivity CDR
15. Connected Machine Agent – how it works
16. Govern and organize your (Arc) resources
17. Resource organization CDR • Scaffold for management scopes (ALZ) with policy-driven governance • Naming standards • No documented constraints • Unique server name per RG • Reserved names • Tag definition and enforcement • Policy for appending mandatory tags • Resource Manager limits • 5000 Arc-server instances per RG (no sub-level limit) • Same limit for extensions
18. • Extend the onboarding script with Cloud Provider’s metadata Inventory and tagging Example code for getting Zone and Instance ID for a Windows VM on GCP: # Get GCP VM Instance data $GCPZone = Invoke-RestMethod -Headers @{'Metadata-Flavor' = 'Google'} -Uri "http://metadata.google.internal/computeMetadata/v1/instance/zone" $GCPInstanceId = Invoke-RestMethod -Headers @{'Metadata-Flavor' = 'Google'} -Uri "http://metadata.google.internal/computeMetadata/v1/instance/id" # Create Tags $tags = "Datacenter=GCP,CountryOrRegion=Germany,GCPZone=$GCPZone,GCPInstanceId=$GCPInstanceId“ ... # Run connect command & "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" connect --service-principal-id $env:appId --service-principal-secret $env:password --resource-group $env:resourceGroup --tenant-id $env:tenantId --location $env:location --subscription-id $env:subscriptionId --tags "$tags“ --correlation-id "d009f5dd-dba8-4ac7-bac9-b54ef3a6671a" Source: @thomasmaurer, blog post
19. Monitor status and health
20. • wrapper for software installation & configuration / small apps providing post-deployment config and automation tasks • purpose: enable services on Arc machines • auto-update in Preview • only one extension per extension type can be installed/enabled per VM/Arc server • Check requirements for each service! Extension-based Management - MicrosoftMonitoringAgent - DependencyAgentWindows - CustomScriptExtension - IaaSAntimalware - WindowsAgent.AzureSecurityCenter - KeyVaultForWindows - WindowsAgent.SqlServer - AzureMonitorWindowsAgent - HybridWorkerForWindows - OmsAgentForLinux - DependencyAgentLinux - CustomScript - LinuxAgent.AzureSecurityCenter - KeyVaultForLinux - AzureMonitorLinuxAgent - HybridWorkerForLinux
21. • MMA (Log Analytics, OMS) vs. AMA vs. Dependency Agent • MMA is used by Azure Monitor, Defender, Sentinel, Automation • Which one to pick? • Workspace: RBAC for log data • Agent deployment “at scale” • Workbooks and dashboards Monitoring agents
22. Configure and automate
23. • Azure Automation services • Update Management • Change Tracking and Inventory • Hybrid Runbooks • (State Configuration) • Custom script extension • Azure Automanage • Not all features are available for Connected Machines Configure and Automate Inventory Management Change Tracking Update Managemen
24. Protect and secure
25. • Managed Identity and HIMDS • Secret auto-rotation • Microsoft Defender for Cloud • Advisor recommendations • Azure Policy Guest configuration • Enforce security baseline for OS level • Microsoft Sentinel • Key Vault integration and cert management • Azure Backup Configure and Automate Guest Policies Sentinel Key Vault
26. • Uninstall / disable all extensions first • Deregister using azcmagent • Uninstall CMA agent from the server • Cleanup in Azure: • resource group • SPN and role assignments • Note: collected telemetry doesn't get deleted Offboarding
27. Azure Arc Jumpstart For meeting Azure Arc customers and partners where they are, we created the Azure Arc Jumpstart project that introduce a ”supermarket” experience by being able to take “off the shelf” automated scenarios and implement it. • Provide a “zero to hero” scenarios for multiple environments and deployment type using as much automation as possible. • Ready to go technical demos • Jumpstart ArcBox is a sandbox environment that allows users to explore all the major capabilities of Azure Arc in a click of a button. • Jumpstart Lighting is a show where people come to share their Azure Arc/Jumpstart/Hybrid experience. aka.ms/AzureArcJumpstart
28. • Microsoft Learn – Manage Hybrid Infrastructure with Azure Arc • https://docs.microsoft.com/en-us/learn/paths/manage-hybrid-infrastructure- with-azure-arc/ • Azure Arc Jumpstart YouTube channel • https://www.youtube.com/channel/UCoIJw-P_9Jp6Jo_0Ca9avcA • Azure Arc Jumpstart project site • https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_servers/ • Microsoft Docs – Azure Arc-enabled servers • https://docs.microsoft.com/en-us/azure/azure-arc/servers/overview • Cloud Adoption Framework – Landing zone accelerator for Azure Arc • https://docs.microsoft.com/en-us/azure/cloud-adoption- framework/scenarios/hybrid/enterprise-scale-landing-zone Resources
29. Slides and demos from the conference will be available at https://github.com/nordicinfrastructureconference/2022