AZURE OPERATIONALIZED

Transcription

1 AZURE OPERATIONALIZED Steve Buchanan System Center MVP Concurrency Natascia Heil System Center MVP Celanese

2 Natascia Heil MVP CDM MVP CDM 23 years IT, 7 years SysCtr 17+ years IT, 8 years SysCtr & Cloud Italian, Spanish, Mexican food, Sushi I like Mexican food!

3 Gartner to IT: Get a grip on cloud services, or else

4 DEMANDS ON IT TODAY

5 AZURE SERVICES

6 AZURE SERVICES Where to start? IaaS, PaaS, SaaS? List of Azure Services Azure Periodic Table Utilizing Azure applications is usually cheaper than running the same on IaaS

7 Savings AZURE SERVICES Build-in benefits of SaaS and PaaS over IaaS: Load balancing Fault tolerance Backup Security updates New IT Reality Hybrid Cloud Implementation Public Cloud Off-Premises Commodity Modern Apps Existing Workload Placement SaaS (CRM, Online, Office 365, etc.) PaaS (Database, Web, Worker, etc.) IaaS (Virtual Machines) Private Cloud On-Premises Workloads Optimized Workloads for Private IaaS VMs

8 AZURE SERVICES 5 RS Retire Refactor Replace Rebuild Rehost

9 AZURE SERVICES CURRENT WORKLOAD ASSESSMENT What you need to know: Owner Components Databases Integration Points Dependencies Servers Technology Stack Usage & Performance Metrics Business Value

10 Potential Benefits AZURE SERVICES CURRENT WORKLOAD ASSESSMENT Current Workload assessment needed Security Jurisdiction Regulatory Data Classfication Architecture User interfaces Complexity Authentication Data Structure Latency Coupling Life Expectancy Risk Business Impact Technical Impact Relative Difficulty of the Migration Financial Operating Costs Workload Type Compute Intensity Type of Users Scalability Elasticity Required Degree of Benefits App Valuation Score Weighted Assessment Framework 3% Operations Monitoring Tools / Integration Operations Business Continuity 17% 13% 13% 20% 34% Suitability to Migration Workload Architecture Financial Risk Security Operations

11 Low Level of Difficulty High AZURE SERVICES CURRENT WORKLOAD ASSESSMENT Activities and Associated Cloud Benefits Evaluation Aspects Workload Architecture Financial Risk Operations Security Current State Assessment Replace (SaaS) Rebuild (PaaS) Rehost (IaaS) Refactor (Hybrid) Rehost (IaaS) Rebuild (PaaS) Replace (SaaS) Operational Degree of Benefits Strategic

12 WORKLOAD PLACEMENT DECISION TREE Future Investment SaaS Offering Available? Yes Yes SaaS Evaluation Buy (Build/Buy Decision) SaaS No Passes PaaS Evaluation? Yes PaaS No No Passes IaaS Evaluation? Yes IaaS No Hybrid Cloud

13 AZURE SERVICES Criteria: IaaS systems can be shut down temporarily Systems/Applications are Azure compatible (no deprecated software versions) Application parts can be spread over PaaS services Do not start with too complicated applications => too many interfaces

14 CLOUD MIGRATION Experiment Migrate Transform

15 CLOUD MIGRATION PRINCIPLES Go fast Push the boundaries Make data-driven decisions Simplify Communicate to succeed Fail fast, learn fast Try many, use best Design new applications and capabilities for PaaS/SaaS Refactor PaaS/SaaS Build your planof-record to take advantace of cloud capabilities Think Experience Manage your costs Use telemetry to gain insight into operational efficiency Understand your blockers Manage your plan-of-record Retire legacy applications wherever possible Aggressively right-size Review frozen and cold servers weekly Clean up CMDB/CMS data Communicate customer and stakeholder impacts transparency is key Share learnings and best practices

16 AZURE FABRIC

17 AZURE FABRIC How to connect to Azure? Site-To-Site VPN Point-To-Site VPN ExpressRoute Microsoft Peering (O365) Azure Public Peering Azure Private Peering - Site2Site VPN - - ExpressRoute -

18 AZURE FABRIC Regions Depends on your environment and where your provider has a connection to MS Performance/Costs of the Azure Site Networking VNets - Storage Will you have shared Vnets? Will you have Vnets across regions? Network Security Groups Load balancers / traffic manager Type? Shared (SSD or STD) (Blob, Tables etc..)

19 CLOUD GOVERNANCE

20 RISKS OF NO CLOUD GOVERNANCE Cloud Security Risks Cloud Sprawl (i.e. VM Sprawl) Cloud Portability & Interoperability (Vendor Lock-In) Continued Shadow IT Business Objective Misalignment

21 CLOUD GOVERNANCE - TEAMS Consumer Stakeholder Board (Cloud Steering Team) Cloud Governance Team Cloud Assessment/Innovation Team CloudOps Team Obtain input for requirements, Cloud services, Cross-functional IT construct to ensure IT governance and oversight of Cloud (end-to-end) Initial start-up activities, R&D/POC Day to day operations, management, resource management, provisioning, etc. pricing, accounting and chargeback models Begins the Cloud adoption process prior to formalization of strategy

22 CLOUD GOVERNANCE - ROLES Who can decide, how much money is available for which areas? Who can consume? Who gets the reports? Required Roles: Financial management (contract) Global Administrator Department management Account Owner Subscription management

23 CLOUD GOVERNANCE DEFINE HIERARCHY Azure Enterprise Enrollment 1 to Many Departments 1 to Many 1 to Many Accounts Enterprise Subscriptions Enterprise Departments Accounts Finance IT Acct Owner Acct Owner Subscriptions Project 1 Dev Project 1 Test Production Web Sites

24 CLOUD GOVERNANCE DEFINE Azure Resource Groups taxonomy ARM Tags taxonomy. Examples of common tags: BillTo Department (or Business Unit) Environment (Production, Stage, Development) Tier (Web Tier, Application Tier) Application Owner ProjectName ARM Policies. Policies can do one of three actions audit, deny, append. Potential policy uses: ARM Locks Require tags for resources Geo-compliance Cost control Configuration best practices Security

25 CLOUD GOVERNANCE AZURE BILLING Switch from capital expense to operational expense /subscription model Costs need to be monitored (compared to what was predicted) Cloud billing is consolidated no other billing is excepted Create charge back mechanisms A lot different options to buy Azure: Enterprise Agreement Pay-As-You-Go MSDN Some have build-in spending limits, others need to be manually controlled

26 CLOUD GOVERNANCE AZURE REPORTS Financial management Partner offers: Cloudyn CloudCruiser Azure Billing REST APIs: Usage: Azure consumption data, supports RBAC, resource tags RateCard: resource details and pricing, not for EA, supports RBAC Azure Usage and Billing Portal Billing reports summary

27 CLOUD GOVERNANCE EXAMPLE BILLING USAGE DASHBOARD

28 CLOUD GOVERNANCE CHANGE MANAGEMENT New Change Management functions needed Operational readiness User readiness Organizational readiness Application and ecosystem readiness Track changes in ITSM change management system

29 CLOUD GOVERNANCE - CONSOLIDATED FOR CLOUD ITIL ALM Lean IT IT Ops CloudOps Many Methodologies/Frameworks Digitally Transformed Methodology

30 CLOUD IS A MODEL, NOT A PLACE! Cloud model defined software central tooling funnels top best practices CloudOps business application at the core

31

32 AZURE PROCESSES

33 AZURE PROCESSES Grant User permissions Create user in Azure AD Grant user READ access to subscription level Browse for Resource or Resource group and add role to it Add user to role

34

35 CLOUD MANAGEMENT PLATFORM Managing all aspects of multi-cloud platforms from a single point of reference

36 MULTIPLE PLATFORM MANAGEMENT TOOLS The Toolbox of Administrators Today

37 SOLUTION - CLOUD MANAGEMENT PLATFORM Describe Deploy Control Source Control Gallery Unified Control Plane Unified Control Plane Unified Platform = Single Pane of Glass YOUR DATACENTER PUBLIC CLOUD

38 CLOUD MANAGEMENT PLATFORM What are traits of a Cloud Management Platform System? integrate into other systems (i.e. ITSM, SIEM) Self- Service Manage Backup Analyze/ Report Automate /Desired State Monitor/ Security

39 CLOUD MANAGEMENT PLATFORM Portals Classic: manage.windowsazure.com Modern: portal.azure.com Hybrid: portal.local.azurestack.external DevTest Labs Operations Management Suite Log Analytics Assessments Azure Automation Runbooks Desired State Configuration Azure Recovery Services Azure Backup Azure Site Recovery Integrations

40 CLOUD MANAGEMENT PLATFORM RightScale Scalr CSC Agility Platform Cherwell ServiceNow Rackspace Other numerous cloud-native CMP vendors in the market

41 AZURE - CLOUD MANAGEMENT PLATFORM

42 SCALR - CLOUD MANAGEMENT PLATFORM

43 CSC AGILITY - CLOUD MANAGEMENT PLATFORM

44 RIGHTSCALE - CLOUD MANAGEMENT PLATFORM

45 AZURE TRAINING AND LAB OPTIONS

46 AZURE TRAINING AND LAB OPTIONS IT Pro Cloud Essentials DevTestLabs Channel 9 / YouTube Azure Development training IT Pro Carrier Center Microsoft Virtual Academy Classroom Training Community Blogs / Conferences

47 AZURE TRAINING AND LAB OPTIONS Additional resources: Azure Testdrives Azure Friday Azure Architecture Center Catapult Azure BootCamp And much more One general comment from us: Azure is not for free!

48 AZURE SECURITY

49 AZURE SECURITY New responsibilities Existing security and compliance controls need to be reviewed and modified to support new application types On-Premises Security Dependencies IaaS Infrastructure as a Serv. PaaS Platform as a Service SaaS Software as a Service 1. Security Strategy Governance and Operationalization: Provide clear vision, standards and guidance for organization 2. Administrative Control: Defend against lost of control of your cloud services and on-premises systems 3. Data: Identify and protect most important information assets 4. User: Identity and Device Security: Strenghten protection for accounts and devices 5. Appliaction Security: Ensure application code is resilient to attacks 6. Network: Ensure connectivity, isolation and visibility into anomolous attachs 7. OS and Middleware: Protect integrity of hosts 8. Private or On-Premises Environments: Secure the foundation

50 AZURE SECURITY MFA RBAC MFA is free for use with Azure administrator level accounts. Plan out and configure RBAC ahead of time with regular audits of resource access. Deploy standardized groups for RBAC at subscription and resource group levels. Leverage current built-in RBAC roles to reduce administrative complexities. Azure Security Center Utilize Security Center to prevent, detect, and respond to threats through Security policy, assessment, and recommendations of Azure resources including VM s, network, and SQL databases. Key Vault Security Center can be integrated into a SIEM solution. Utilize Key Vault for encrypting credentials in ARM templates and any application code on Azure. ARM Locks ARM policies Endpoint Protection on all IaaS. Network isolation via subnets and NSG s. Utilize Network Watcher and OMS for monitoring, alerting, and security visibility.

51 AZURE SECURITY - CERTIFICATIONS FOR US COMPLIANCE

52 AZURE GOOD TO KNOW Subscription and service limits Cloud migration assessment or TCO.microsoft.com Hybrid use benefit

53

54