Cloud as a Story - Vunvulea Radu

Just realized a few days ago that there are so many flavors of SQL inside Microsoft Azure that you need to be careful when you decide which one to use. In this post, I want to present the most important flavors of SQL that you can have inside Azure and to define a demarcation line between them. 1.0 SQL Server inside Azure VMs (IaaS) The classical IaaS approach where customer needs to manage the VMs and the SQL Server instance that is running on top of Azure. The list of tasks that you need to do when you run your SQL instances on top of Azure VMs are the same as you would have the SQL Server instances inside your own data-centers. From license, to backup and restoration procedures, all of this needs to be managed by yourself. 2.0 SQL Database (PaaS) The current offer of Azure related to SQL on the PaaS environment is more complex than you would expect. In this moment there are 3 options available, that cover most of the uses cases that you might have. SQL Database (Singleton)...

In this post we will talk about things that you should know and take into account when you want to use SQL Data Sync from/to Azure SQL. What is SQL Data Sync It’s a synchronization service offered around Azure platform that is allowing us out-of-the-box to synchronize multiple databases that can be inside Azure or on-premises. SQL Data Sync it is one of the services that makes our lives 10x time easier. The coolest thing on this service is that you can make the configurations from Azure Portal. This is useful especially when you want to try the service or make a fast configuration. From UX perspective, the experience is wonderful and when you want to automate the process, you  can use PowerShell. Base Concepts Synchronization Group represents a groups of databases that you want to keep in sync. You’ll have all the time a Master database used to sync between all the other databases. In the Master-Slave topology, the Slaves are called Sync Members and  the master is calle...

In the last post , I talked about how I connected the yard gates to the IoT Home solution that I started to develop. Unfortunately, I was not able yet to connect the Paradox alarm system to the solution. It’s not clear for me how to connect the relay as a keyswitch zone, but I hope next weeks to receive some help and resolve the near future. Why? Because the WiFi connection is not stable, there are times when I lose the connection to the devices. This can be annoying, especially because I do not have yet a tracking mechanism that can provide me information related to the current device state. I decided to enhance my solution with tracking capabilities. Until now I didn’t add any logs to the solution because I wanted to see exactly where and what kind of data I should collect. Easily you can add logs capabilities to the system and end up with a bunch of logs that you don't need it. What? In day to day use I observed that I need the following information: When was the last ...

In this post, we will take a look on how Shared Access Signature (SAS) is generated. We would like to understand: How such a signature is generated What are the inputs that are required for it  What does the signature contains I assume that you have base the knowledge’s related to SAS. If not I would recommend to read the following introduction before - https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1 What does the SAS signature token contains? This signature (token) is just a specific HMAC (keyed-hash message authentication code) generated using SHA256 hashing algorithm. There is no magic behind it. Inside this token all the relevant information related to access permissions, expiration date and many more are ‘hashed’. By ‘hashed’ I understand a hash that is generated from the string that contains in clear text all the information related to SAS together with storage account key. For example, for the below SAS ...

In this post I will describe the basic steps that needs to be done to configure App Service Authentication using Azure Active Directory. Out of the box, App Services allows us to put in front of our system an authentication and authorization layer. For basic flows, us described below, the configuration can be done directly from Azure Portal, without having to write a line of code. Step 1: Enable App Service Authentication This step can be done directly from Azure Portal, from “Authentication / Authorization” tab. After this, once you specify that you want to use “Azure Active Directory Provider”, do not forget to select “Log in with Azure Active Directory” from "Action to take when request is not authenticated". This is required if you want to not allow anonymous users to access your web app. By selecting this option, you will redirect unauthenticated users to the login page. Don’t forget to hit “Save” (smile). Step 2: Create and configure Azure AD Application Th...

During discussion on different cloud projects I observed that people are using “Lift and Shift” terminology with multiple meanings. This can create confusion between different parties, especially when technical team from each team understand a different thing. What is Lift and Shift? Lift and Shift is a migration strategy that is based on the concept of replication 1 to 1 of the environment that exist on-premises inside cloud (Microsoft Azure). This involves the migration of all computation, storage and other services without replacing them with specific Azure services. What is not Lift and Shift? When you have a File Server system on the current infrastructure. Lift and Shift in this case shall not include replacing it with Azure Files. Involves just taking the File Servers instances from on-premises and putting them inside Azure VMs. Another good example is when you migrate a web farm. If you decide to do just a Lift and Shift, than you should just spin Azure VMs where you ...

In this post, we will talk about web endpoint security. Let us start from a basic requirement and see what we need to fulfil it. The web application hosted inside App Services shall not be public available from internet. Context The requirement is simple and clear, but can give us headaches if the team does not cover it from the beginning. Microsoft Azure is offering two options to fulfil it: IP Restrictions App Service integration with VNET VNET with dedicated App Service Environment IP Restrictions App services is allowing us to specify a list of IPs that can access our web application. The feature is similar with the IP restriction functionality offered by IIS and can be configured inside web.config. The difference between this two is the location where these checked is done. Using IP Restrictions the check is done a layer before the IIS. Additional this, the configuration can be done from Azure Portal or using ARM templates. There is no need to modify the configurati...

There are times when you make mistakes, big mistakes like… …deleting an Azure SQL Database… In this post, we will take a look on what are the steps that needs to be done to recover and restore a deleted database. We are in the context where you have a Standard database, without any special features related to backups. Trigger I just realized that I deleted the wrong database and I do not have any custom backups mechanism configured. What should I do? Time is crucial  Time is one of the most important factors. The backups of deleted databases is stored for a limited time. The time window depends based on the instance type. In this time window, you can restore a deleted database without any kind of problems. The retention policies for backups is 7 days for Basic and 35 days for Standard and Premium. Azure SQL Server created automatically backups to your databases. These backups are used to restore a deleted database. Don’t forget that as for on-premises backups, things can g...

In this post, we will talk about a simple problem inside Microsoft Azure: How I can see what my quotas are for Azure Subscription that I am using? Context When you start to use you Azure Subscription more than for playing you realize after a few weeks that you do not know what your current quotas limits are. Additional to this, it is not easy to count the number of instances for each resource. For example if you use multiple Azure Storage in different Resource Groups, how easily you can count the number of Storage accounts that you are using? To make the problem a little more complex, you should know that a part of these quotas are per Azure Region. For example, you have a default limit of 50 VNETs per Azure Region. It means that it would be pretty hard to calculate the total number of VNETs that you are using on each Azure Region. It is not impossible, but you would need to do some additional things. Usage + Quotas Inside Azure Portal, we have a dedicated tile that provide t...

Let’s take a look on what are the current solution on Azure when we want to migrate our local file storage from on-premises to cloud. Context On the current system, let us imagine that we have Windows File Server that it is used to share filers inside the company. The File Server is fully integrated with our Active Directory server and based on roles we allow/restrict access to different folders/files. What we want to do? We want to migrate to Azure this solution in such a way that we don’t need to manage the File Server machines and also to be able to have control on file sharing permissions using user roles (Active Directory integration). Addition to this, we want to be able to attach as a shared folder or partition the shared content on the client machine. Azure Files An extremely powerful solution provided by Microsoft, which allow us to store our files in Azure and share them with others. The SMB protocol is fully supported, meaning that we can attach the shared on ou...

One of the core services of Microsoft Azure is Azure Storage that is used to store binary content, key-values pair (Azure Tables)  or message queue (Azure Queues). In today's post, we will discover how a small change in Azure Storage capabilities is changing our life and simplify our IT solutions. Current solutions The current maximum capacity of Azure Blob Storage used to be 500TB. Even if this might sounds a lot, there are multiple cases when you had to overcome this limits. If you have a system where devices and users are uploading content to your system, than you can reach easily 2-5TB per day that would force you to use a new Azure Storage account every 3 months. To overcome this limitation, your solution needs to be able to manage Azure Storage accounts automatically. Besides being able to clean and archive content automatically, you will need a system that can create a storage account on the fly and redirect traffic to it. When you use multiple Storage Account, you are f...

The current trends are clear. We should develop software applications using only microservice approach. This sounds goods for new application, where system requirements guides us to go with a microservice approach. But what happens for the other types of systems. We might need to develop a normal web application, with some backend processing behind it. No crazy NFR, no need to scale to 100.000 RPS or similar stuff. Monolithic application As an example let us imagine that, we need to develop a web application that resize our pictures to Instagram size (1x1). There are no special requirements related to availability or scalability and the load on the system is a low. The system is used just by our employees (less than 5.000) for company images that needs to be published on commercial web sites. Of course, we can imagine a state of the art microservice implementation, with different services that scale by themselves. What if we do not need something like this, but is very appealing...

It is not uncommon to configure the firewall and other security and control mechanism like User Defined Routes (UDR) and NGA (Network Security Groups) to restrict access to your Azure Resources. In the moment when we want to do such a thing we need to know the IPs that are used by Azure Infrastructure. Let’s take as example a web application that is hosted inside App Service (using VNETs, Traffic Manager, Azure Storage, Azure SQL and many more). To be able to properly configure the access rules, we need to know what are the IPs used by Azure Storage and Azure SQL in that region, Traffic Manager IPs used for probing and so on. Azure Region IP Range Most of this information can be found in a XML provided by Microsoft ( https://www.microsoft.com/en-us/download/details.aspx?id=41653 ), but I expect that this will not enought. You’ll find inside the document the IP ranges that are used by each Azure Region, but without a tag that specify what IP ranges are used by each Azure Resource i...

I saw on Twitter a discussion related to Azure VMs and RDP connection that are open by default. The main purpose of this topic is to present different use cases when the RDP connection (not) is available by default. Use Case 1: Single VM (VM with Public IP inside a default VNET) – RDP Active by default for public access In this context, we have a VM that is created from Azure Portal (or script) as a single entity. It is not part of any scale set or other type of custom configuration. It is just a simple Windows Server 2016 Datacenter machine, which is part of a default VNET with a Public IP allocated to it. In this case, by default the RDP will be configured. The default Network Security Group (NGS) that is created together with our VM will allow RDP connection to the machine. The default VNET allows RDP connection to our VM, because there are no custom NGS rules to restrict it and we have a Public IP attached to our VM. Use Case 2: Single VM (VM without Public IP in...

In this topic we will cover what we shall do when we: Configure Azure Traffic Manager on top of Web Applications hosted inside App Services  Over HTTPS With custom domain  Client certificates Context When we are using HTTPS in combination with App Services, everything will go smooth. You just need to activate the HTTPS and upload client certificate, if you want to use a custom one. Things are a little different when you want to configure HTTPS on top of Traffic Manager. In theory, the steps are clear and it should work as expected, but combined this with custom domain and client certificates things can end up with a 404 error code.. Initial Setup Pre requirements: Web Apps are configured over SSL using custom domain and works as expected. Let’s take a look on the base steps that needs to be done when you want such a configuration Create an instance of Traffic Manager inside Azure Portal and add your Web Apps that you already configured for HTTPS Add your custo...

There are two new features of Azure Storage that will make the end of 2017 very interesting. New Archiving Tier A new archiving tier is now available for blob storage. Additional to Cool and Hot access tiers we have now Archive tier. In contrast to the existing ones, it was design for situations when you need to archive data for long periods. An interesting fact, in comparison with Cool storage is related to SLA. The availability SLA is the same as for Cool storage – 99%, in the context of a tier that is it secure and durable as Cool storage, but it is much cost efficient. From what I see know is more than 5 times cheaper than Cool storage. The new tier comes in hand-in-hand with the current trend of moving existing infrastructures to Azure. In many situations, there are cases when because of regulatory aspects, you need an archiving solutions for audit data. Audit data needs to be stored for at least 5 years. With the current price of Hot and Cool tier, it was hard to do someth...

In this post, I will try to find answers and guidance for technical people that needs to decide if they shall use .NET Core or .NET Framework inside Docker containers on Azure. The same answer is applicable for on-premises, because Docker runs in the same way on Azure or on-premises. The directions from Microsoft related to this topic are clear. The default option shall be .NET Core. From this way, .NET Core is design in a such a way that is align with container concepts. For example the footprint was reduced drastically in comparison with .NET Framework. One interesting fact that people do not know is related to the type of Windows image that you need to use when you use .NET Core or .NET Framework together with containers. When you use .NET Framework you need to use a Windows Server Core. This image is heavier than Windows Nano Server. This can have a direct impact at infrastructure and resources requirements. There are many things to say why Windows Nano Server is better, a few ...

Another year passed as Microsoft Azure MVP and I realize that this is the 6th year as Microsoft MVP. It is a pleasure to be part of MVP Community, that has extraordinary people that are ready to help and offer support to any community all around the world. I’m honored and exited to be part of this great community for one more year!

Nowadays IoT is appealing for everyone. These opportunities made the two biggest cloud providers from the market (Amazon and Microsoft) to come up IoT platforms and solutions. The main purpose this this article is to compare the current solutions from features perspective and capabilities perspective. The interesting thing that happened in the last few years is the way how IoT solution evolved. At the beginning the solutions were oriented around transport and communication, but now the IoT platforms evolved and are integrated with systems that runs on the edge and in the cloud, supporting the business needs. X-Rays Let’s take a look on the available solutions that Amazon and Microsoft offers. Both providers are offering a central Hub that is used to establish and facilitate a communication between devices and backend systems. At device level, each provider is offering a set of package libraries that allows clients to integrate their devices with the communication platform faster. ...